a57aa3f1483debb4e6f98d041def34944c72e1f68bada7eb331e5cd542951c9d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Size 1.4MB
Sample260504-tkwqtabt5n
SHA256 a57aa3f1483debb4e6f98d041def34944c72e1f68bada7eb331e5cd542951c9d
MD5 6a971f9867f170e120167dffa4d27f5e
SHA1 42179e1c968b673a7467901fb2485fe7dab36a37
SHA512 11be34956e0e6aa9272b095e77dcc7a7a870b975d0c190e5e28bc556b38ba64ffd2bc06c7aab1546ab788c95507ed9d92cb3397454ccb3ce808d14e6c380aac9
SSDEEP 12288:sCEhwdbTUI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:sKdHUUPXlDSRS6/IHMaY5QNg5G
TLSH
T10665F186325421DAD523B275981F935FA3727C7F0B20BA2B135CBF2A5F362816D16B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1128	alg.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
788	fxssvc.exe
2424	elevation_service.exe
5984	elevation_service.exe
3312	maintenanceservice.exe
1676	msdtc.exe
1636	OSE.EXE
4024	PerceptionSimulationService.exe
4252	perfhost.exe
5928	locator.exe
2280	SensorDataService.exe
2156	snmptrap.exe
3040	spectrum.exe
3376	ssh-agent.exe
5096	TieringEngineService.exe
1176	AgentService.exe
988	vds.exe
4164	vssvc.exe
4584	wbengine.exe
3992	WmiApSrv.exe
6112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\18350e50b9e5d6ca.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_82828\javaw.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fc7f923e0dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091433925e0dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d55d9224e0dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019312625e0dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088dbed23e0dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042247824e0dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cd92b24e0dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab134624e0dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	788	fxssvc.exe
Token: SeRestorePrivilege	5096	TieringEngineService.exe
Token: SeManageVolumePrivilege	5096	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1176	AgentService.exe
Token: SeBackupPrivilege	4164	vssvc.exe
Token: SeRestorePrivilege	4164	vssvc.exe
Token: SeAuditPrivilege	4164	vssvc.exe
Token: SeBackupPrivilege	4584	wbengine.exe
Token: SeRestorePrivilege	4584	wbengine.exe
Token: SeSecurityPrivilege	4584	wbengine.exe
Token: 33	6112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6112	SearchIndexer.exe
Token: SeDebugPrivilege	6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	6088	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5056	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4440	6112	SearchIndexer.exe	112
PID 6112 wrote to memory of 4740	6112	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4004

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1676

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1636

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4252

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2280

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3992

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 98d3a49776ed38379bf20d732a048e25e440a02185f534604a827137a0917272
MD5 44874565cb22728024d70dfc8bfe4f6f
SHA1 4aae73ce7762d8dc57603825c41fd79e89a1b411
SHA512 1769adf22acce2f365c1e087a1aaefaafae274ec196d625c92175b8d20930df9045b929bd466d4a9f86afebe989a1811b9695c8b63de3786397f16b76cfefcd8
SSDEEP 49152:Jb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnjUvlDSRSQIHMaYDG:f3q60jBFv9lYD
TLSH
T168D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 703947d9d8c7d194bba24a40033b556497d540c47cf0f600184428cdc7350bfc
MD5 74d647b84dc4a39ac97116185d502c7c
SHA1 b067bd57cbc73dc1f67c7c30f8474eaeab21d21d
SHA512 95a8a68dc38563303f59fd63946da8dde1ac01c13ffd28c3cb99a751961937d0c5e6498c40093e5704e5f27a481ed2d9e44f42c2f7c70fb97c17b0e04136ffa7
SSDEEP 12288:S1XLsswWkxy2lRq2czAYI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:4XYfDtczAYUPXlDSRS6/IHMaY5QNg5G
TLSH
T10E65F12833A509F9ED67827DC8B18105E632786907A0FBCB03E499795F372D45E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1abca30590d519c64e080510c2aacd713fac6197f6b5c6ee4a5cf5f3eaaec75d
MD5 e14608cb75ce7a2df2e3b840abb62dd8
SHA1 68056a9043b2d6aa259fd8d834c70049ce0b468b
SHA512 7e0f9c6abc64475dea8209890393741810fc2f3b58f746a5575a265209ecb35ed96bd7f1f138135838fe2bd138f40728bcf981c6d857f60b7d5b86459a69f70e
SSDEEP 24576:H0Le5ji0hmxTrMrUPXlDSRS6/IHMaY5QNg5G:HPji0AFmUvlDSRSQIHMaYDG
TLSH
T112859E16F6748371D073C0B9C5D2A68EE97130861B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 96b5a5a191278a7888821e7940cf3c401c5e9b99059d71bba562dfea0605e885
MD5 c29d0dbcfc5573594452af0c45d41801
SHA1 b2537c076bcb37126a26e9867d2c4df6b8d14f2c
SHA512 f2daab59a1b0f09e06ca05d89eb714d8ff27ecdc090d4778d486e89a6a25429990a8ecf843de4522cf8f07846737464210dd942f16b3b25c3767fc419f8d2597
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWr6q8wyuVUPXlDSRS6/IHMaY5QNg5G:P/ezSC6vUzPviHjyKUvlDSRSQIHMaYDG
TLSH
T169755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1aaa42056be3a1875267a6838b7a1112a575a056620c13a4c6b809882b0be93e
MD5 4846416fd040bb06ebe708beb93dee9f
SHA1 117b09cfe5e4cf436a71310572ad0599ccd15bae
SHA512 8e74ac816581d7ddc0d2cd4e4832df2ce53dc7c559a3a4e88415fb605818a76f6f9e4b4f012fd2c3f45985fcf342f44c9421d94cc92805ab7ec6c0a2728515e4
SSDEEP 24576:YVbqPb88hv/l+bEUPXlDSRS6/IHMaY5QNg5G:YVO88hXl+QUvlDSRSQIHMaYDG
TLSH
T15F559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e387e50c2098e656af75ec4c456f9928a3c59939a80c004888db192596930d6a
MD5 80df6b271298cc910915a6e787cffabc
SHA1 6ae2330ba096e037991eea3e535db762c7950b36
SHA512 dcf55f0edfbe1672a668dc9a450ec2fe1330493c0b4d969f13d3b5420df7f4e9736782eb16f3cb85ab048b0265f09cf68c7842b6bdb917f0286a62ed6563eb61
SSDEEP 12288:h4XI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:h4XUPXlDSRS6/IHMaY5QNg5G
TLSH
T17345239A275A47C2DF7B83F6A47821C8F1146C7D18A87D8620F1F9B9D63C5D1A2033B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 55ccbae1d7408dc3ac38cc4428e068b334760a654eda40056016b650943ccd44
MD5 25a7f6ead3649321d31cc36acbb58bf9
SHA1 cdd13729cdcd021c9918f6df38b1f6e77c732aba
SHA512 d8b5001e08d7c56fd0bf2d8982a11f94b823ef2bc4ee444f3c30e26f8202de04a35392cb5a948f2871a8a4b9a6b7cde24132b12d3608f604d0dfc91adaad3711
SSDEEP 12288:jeBNUbTVO86UsI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:jJIUsUPXlDSRS6/IHMaY5QNg5G
TLSH
T1FF65D03BAE28FCD2C67E89B956918240E77278304F61A3CBD175C20EDE275E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7156668f90dcc4af4944d5c6224c2af2aa6b037b7b65a3f59635fae7605e0633
MD5 a3f313e500697a1340b3fa8f3231f41d
SHA1 2945bfe3cee31ea8cdfb4d81dbb9e20266568906
SHA512 cd39c1128b9e991b07c42cdd07e501da285237fa40ca57c6777a9fcbb8128cae3eb7d1e84bc1aa0996e79c5f9cbb9bdb463692bab87a8db5264d7b69fa82ba07
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH5:wQvGAdlCEL8c/RRNw5CCv9lYD
TLSH
T122266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c7af9794585c6420cfff775955402043dafbeed8f0b87252f265fb1977197649
MD5 ef5153f2328dad5fa695b2359db12999
SHA1 31a0d7da6bbac03406c431679f3a6ece347e23cf
SHA512 717afe658066c3122d27d1c18271f7a269f6488bf7a02df217a2a6e0dce3e1a6b55e7e5257918431b8d44ee32932f5940f8b7f45ee4d13e85a1f0e0a9cb2859a
SSDEEP 12288:XAwSfxL/2Dc35DLLmt0LDQewsAj2I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz4:wMewsAj2UPXlDSRS6/IHMaY5QNg5G
TLSH
T1B275E031FA75D036C7BB0DB61B35D706642C79204F612AC3E3E89E9D99342D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed6c2ef7f7c46be5209b1c09a7c8436b22354515843b7c0f011e2cd1e5ce1d8e
MD5 580d45275f8984c084f27544714c420a
SHA1 ce461733b042c3bfeb5ef536989ff3fbba1861a2
SHA512 0bb42bf80e3850e046c354d67400f746a4d3644035d9ed1a0f77007bfe5fdc4d06f01e10b44deb468d104ef1286033ce2554b51f7d79192544a19e64c625c10a
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHoD:JUEtQevvqc2W1cpV2RI32o
TLSH
T130474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4154e5e9bbf8ab1f106ae3d324baf93945d23ae0620e22ef63129e01d2b156cc
MD5 b44a6573f654f3603bafdc36e87ccdeb
SHA1 dfbe4f3f03e81ab96dff57f6d1f31c7e3a5a46bd
SHA512 45bc4dfc25dc7ab625b6ea4f43559cc0ddbdabd2e011ab2c4f72e22632cfb202fc813fa2c2baafb4aebd79e6028c700273618269627b0726d534c868b378b28c
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/zWUvlDSRSQIHMaYDG:4oq2Vjnm2v9lYD
TLSH
T166D58D0976B8C2E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4b9b0067afb6ec16091edcbd68cbf6aca32b8534a5a16afe1e1896f189455f3f
MD5 5881f4ab657f23d98b9f4c521679cfa8
SHA1 2e3242e8ba729ef590a6092c0d88572d48ea81a8
SHA512 6ae26280b8dd6f278b1cddf4a5792a8bb3776fb7dfc2116cc27ac4259179de0fc18447b7cc99fbc4137dab99f2354b9fdd703466b0b0003d7410570d9d3a3d60
SSDEEP 24576:2AhGL2IFoiwtA5l7S53ZUPXlDSRS6/IHMaY5QNg5G:2AM1Foiq5JUvlDSRSQIHMaYDG
TLSH
T1D5359D81E7F955D4F5B3AAB899B69170EA76BCA95E30D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 39a791572e574f208194a3c1f0e46ddc336f4475148293ab32203d39a90b8e5e
MD5 77dd0f570d9996b468ae57e411251d57
SHA1 9d7356590ce11fa33dfde929defc921a76b5bf7b
SHA512 c36b301653fc40503a442eb0c756110833bd7d4ed3e038ac223208470a6759ace8ce5b7dc333977120561d27bda8474f7d82ad22bdfec8256f6edd9d3b1695e4
SSDEEP 12288:8mw5HEjsChNoBFgl0WDm+C1I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg59:5wuxOWqUPXlDSRS6/IHMaY5QNg5G
TLSH
T13C65F14A33A50CF9EA778239C5578135F7B2B8152A21DB1F13B0C66B5F373616E2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ab04b9e2af25c8feb88d88903a5bfaa6b3f1f37bb218eb9dfdd0eb93de700fcf
MD5 ae1c930e8bda36e6d990501291bb0caf
SHA1 a21b2fc1a75ebc166b10a77151b106a80977edaf
SHA512 52daa50a8508304dd9d720c37c5303dc957463d3ec4d321e74ea7359de35ef77c5a39582a62556647dfaf025f168d7a4372175fd709ea2f03c40d4a208baf0a3
SSDEEP 12288:+lZ1IyGI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:sZuzUPXlDSRS6/IHMaY5QNg5G
TLSH
T1DA55128A33A822F6D6B783B9C8F45188E331746A277557CF11B086795F36AC11E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d6d63fd04794e54186de4bb6bfab301f15398e8a0c92ba8e01bbe3af13e5ea2
MD5 913f053034fd44cdc664e3d9e48e2ee0
SHA1 e0f3d9acc865c8fcbc4dd3838a815c25169f536a
SHA512 e1153c88abcd60bd616b3ea534f8cfb240ff450824d06ab8e04b668a959951c4b43cce34633ed4782e5f56f18046a92c8bb63dbfc0499a4e7f22be2bc7ce45f0
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ud:iQRQyi36YOcPhLvw2gAf+PN3Bv9lYD
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 645a9c3d12b55b13933635058da44eb9867eafdd436f08405dc4344d171613d7
MD5 aa4903e389f175d93c29ef6f77253bcd
SHA1 17ed352003f5835c272adaadacd69a34d93aeb30
SHA512 7436dfb6794c03cff303082eb7ebddba22bce10e24ee475bc5cb28be748e9be8b0149c59055a4244c846e834b25361e81603af9d4f7b358ce8c8ead32374117a
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ud:cQRQyi36YOcPhLvw2gAf+PN3Bv9lYD
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 337f54eeb04060d7d87a6400861a09dd5d27a91f22d3efd3ce48addd1dc9d813
MD5 a1c796eec2c4aa0fe847af461b840c77
SHA1 e6fc5c0d4b6689659d1d5472150188bc018ef814
SHA512 a818169401f7f46e86c5cfcad6fdf544ea2cbeb94e06be126d344fc3fad4af9e56196c56a625a78e87304e2fb347c5e89cc8e9c4466e7af93553841a76c113c5
SSDEEP 49152:J68Qg55nhceWu7PNU3/mUvlDSRSQIHMaYDG:XthLRc/vv9lYD
TLSH
T1FAB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8151721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a673bfdbee34c5da1d286a0e56a4cec0ada0a78ad5ed0f99c5ed96c4352dfb65
MD5 9ae21f73f23b95c35777bea68589dfe7
SHA1 219d018029989b9012e0090804c70de9cefa5441
SHA512 3b8d560040edb45bb056a53c693ac694707d7cb5baa45724d1480e4893f8505e505dce9d71289eee987e50a74e889dfaa2d8dd20569069c3a33bc4f292e98c4b
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99X:sy5112gYy5azzVva69nLKnhZEv9lYD
TLSH
T1CF167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6584ddc8846cc67b05691afb18dc41f199a3105df3a2bdcaf1258eb023680148
MD5 e71337290afb81995cea82f398c39afa
SHA1 abf32d36560aa5319f099cbca34054d374e02fe1
SHA512 c431f343a981e38fc21e8576008e5bc1933cecf0cf76c2f13ca0b639895cb339759a0153f54ef035d08c3102ba2b6d52999aa10ff5634ca7f3615baadd4f1c4b
SSDEEP 49152:/B+taZ3usBWOBr4tEG20bqx0z+n217aau1glIUvlDSRSQIHMaYDG:Bu6JmUxd2dpv9lYD
TLSH
T1CDD59D13F1DA01E8D06ED178974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39595eeb767d0c636c6b8dd66e27ddbe6fdefcc0211c42186bef9a452e97c80a
MD5 5aff5092da81b7dd84d3363e5f9f28b4
SHA1 6c4323393f8a1d958444317e0b891acc8dca87e1
SHA512 9919142e2b8b57b6ccd7d5e2bcef2ea7d23d331630448287277253920569bda89c1077ec3c1ea962e6375056cc7135197fd65c2d5b893fd0adbf2c51547d3f76
SSDEEP 49152:s1hpsNoJpF1A6BU44CwH7R4xMUvlDSRSQIHMaYDG:smifPkR2v9lYD
TLSH
T112B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d470ceeffa80355ae75572b2e1aac3cb5f604b4ef678a0dcd3f305748fe191f5
MD5 793f06e8a84da0f839048331b23c2a76
SHA1 cdc0f21661f699dc7c8aaf1365233fae69dfc4b8
SHA512 d21abf4fb4d14d025e926932c79c92db92f1f487e2713e72961038e59f36b3e9bb61d6a82c666185f290e545903f2df2a2fe04365b35b488536282eaf0580e06
SSDEEP 49152:iSuZQIY0Be2KNRVtOnks6NMHqzUvlDSRSQIHMaYDG:85dKvi61Qv9lYD
TLSH
T17EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aaf68a718055fc5abc637626a97278aca8d23a740e6966ca8979f6c42f943982
MD5 678acd1f50a4bd2ac578058ba91f18b9
SHA1 f601b290e4a89082464062c06e653ea7e0036f1e
SHA512 caef740cae294e4ff0b614503322b25eec84a40201e7af44569bc3afb667420e596987a99d5cb6d2dacb8b059f39afc2bc46aa260c5badafdcbae2755ea745e3
SSDEEP 49152:phtSn8EApI0figXgiDn0AP5wYUvlDSRSQIHMaYDG:YX2iyph6v9lYD
TLSH
T1E795BE13F2D901E8D06ED178C7568632E962BC160B34BADF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cdb9c6a6a6b75b594e1cb281e490c282bcf68d7c1417ab03546e7871090829f1
MD5 6eb6bc7bf06d98dde8e61679b20e3609
SHA1 e4de122e695d48683a340b709fbb28a090343448
SHA512 5e0b6becaaa9d97bbc02afc3353bd1d5801e3d5c969aa3b83d158d472bdc8f7ead47f7aa43be1415fa12ce0fa28d479358b2540dc1eb4f9f4b8135a7be17621c
SSDEEP 12288:PfI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:PfUPXlDSRS6/IHMaY5QNg5G
TLSH
T13045238A376B47C2DF7AC3F6957821C8E118297E29A5398B30F5A435E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f52c6d0e57f1e12bbba06fd807d3646a55e27684c90aa7b728426e43bda74b4e
MD5 d5332fa1ea8ac7fe977a1a1e685a5bca
SHA1 01901e553e5a5e13a20a1a2d5887ac542b0ca9ac
SHA512 a95ef7149b100a80dab17a752e53ec04fea380b9a819ce20889a4819123e40a454eeb4eac120bbd73730b7c2bb33f53426b8790c5142afd321682ec510b12428
SSDEEP 12288:+iI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:+iUPXlDSRS6/IHMaY5QNg5G
TLSH
T12E45229A376B47C2DF3AC3F6957821C8E118297E29A5398B20F5E475E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b24d86438f518d1ad0044186188a8a9fcfd27cb1f6e2652135c61bf7bd6e51c1
MD5 4f0675735fd23edc917a8f3eafc00460
SHA1 9247eab4eabadc0a10221c6b8508f5faa2262403
SHA512 a9de8f49077cd2926c950505ee011bc0736ab6638b5a06e70e538f96e51fcad0c98018b2a3e077635f6d6b929fd129d83bb1464f4a826c515168f1980c898747
SSDEEP 12288:e0I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:e0UPXlDSRS6/IHMaY5QNg5G
TLSH
T1FE45238A376B47C2DF7AC3F6957821C8E114297E29A5398B30F5A475E63C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 326096c3be6c49869fd90ce5c1f40b00ddd9a29819e25054713ffe21401a38c5
MD5 8677a31ac7106a1969b218513ce55f40
SHA1 a600df56611103fa2688204c9e7525d6b0635e64
SHA512 53f72d0dc01205f1867e2a3a160a8b8108740c50f46b5eae160026cf43e7237c05d366a7fa4a06622c8ff8718f11f5d86ff70ea6d85803abb8e6c726cdeaffb2
SSDEEP 12288:WV5I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:uUPXlDSRS6/IHMaY5QNg5G
TLSH
T13045234A376A43C2CE77C3F6C47451C8F22478BD2A757ACF61A095695F787D02622BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 004bb35432caf1afac087ccb852f1722caf21fd75416f8291337b10f7219e330
MD5 8e76e7c48a50ebc0126aebadd5489fcb
SHA1 0e5f9385c6d8460e813cd9101c06e3c25e695cfb
SHA512 f6ed28026949a2df3b1b97aed0fb872c8620fea547753e0db648533fca72359e77b5f399166b290d3a9c9bfac8b2d6152a23eefa038a562a37c9682be6c8de1c
SSDEEP 12288:9RI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:9RUPXlDSRS6/IHMaY5QNg5G
TLSH
T18945238A376B47C2DF7AC3F6957821C8E114297E29A5398B30F5A479E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f21903a6c1e64ac5b801724fae246d25c624d2826fd5ca3413f3908acddcb2f9
MD5 3f69ed2fe9135f6466ac810f7009c900
SHA1 7e1b8cc86f71c9df394ceb7bebd8da0a7f31849f
SHA512 357033f0ad74cc4aae2718b7b583084c7717579ee578daffa8516d79dab933e67adedde976c0c6252c6992afa87cad83909b26989d6b0756499afc685e08055f
SSDEEP 12288:++I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:++UPXlDSRS6/IHMaY5QNg5G
TLSH
T1BD45238A376A47C2DF3AC3F6957821C8E114297E29A9398B30F5E475E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0adf798becf45618856aa813b18935da90960e6a5d57ee602ea37713cd774940
MD5 026cb428eac0f4cd3ca019b55d15e4f3
SHA1 2fb2b7ff78eb721a35109494ed0f3d226056065e
SHA512 0e3d5077a2698aaa3a1b3d794f63f2e01cc1f5a1b2345ff6a98f0da6d834cd4e827696b237c8ba58d117885f60a5f7710ba342be20de322171e25aa40c88f876
SSDEEP 12288:qaI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:qaUPXlDSRS6/IHMaY5QNg5G
TLSH
T15B45239A376B47C2DF3AC3F6957821C8E114297E28A8398B30F5E475A77C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0dd9f7268b58de68aeb7a644be63ff28c993407e8f8e2db1670b103b2da3be42
MD5 29ad78c8ccec8256cf6b70e96f268709
SHA1 5e4e7ca24caf6746093b588ec3053199d2ed8178
SHA512 9d47997b9b46c6a5930ce0cb125cc9aae1c6954858157a0be3b0628fc8a9989eaf579a6edbada72d1360690adb6096b67479802dca7bca6bcc90f08eec4db5b9
SSDEEP 12288:giZwbqzzFEoS2cPvyCI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:jZMCzFVSOCUPXlDSRS6/IHMaY5QNg5G
TLSH
T16C650199739009F4DD77827EC8258945E2B27C6A0B70CA4F13F4362A5F373A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 344c0deae650919d86b77c4e0663887fecb6f4aa8f142411fa0bf68f5e5470e4
MD5 add2c9238fdaa18bb7b6793f5a86c132
SHA1 12c083ab6978e453f4b8d52538a51149027befbb
SHA512 cac01f5982f3edcab537831fc68c2aa34c141e2fac00bb756f3179558cd790a35c4fbf646620bac42c25853b2f55cc3a39e1e9664d5fb898944a169a89a92586
SSDEEP 12288:fDI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:fDUPXlDSRS6/IHMaY5QNg5G
TLSH
T1A045238E376B47C2DF7A83F6957821C8E114297E28A5398B20F5E479E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fa339c5ccb21d9926cd551745b262934cc8726e6a9fd77646053c55807da0a09
MD5 0615a8fcb3252c64caeaa836b8e4e7a8
SHA1 c7288848b26bbbe5865965493d1681565cf35e6b
SHA512 f2bedc6d51c13231f2d29d5a4e1693c4ae1b4dede6e53099b1f94c432777142c9fdf1525a1830d0c4a3a5289d8921c2589e1e59a40789f6bf57cfd77ce1e9ae1
SSDEEP 12288:9nI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:9nUPXlDSRS6/IHMaY5QNg5G
TLSH
T15645239A376A47C2DF3AC3F6957821C8E118297E29A5398B30F5E475E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3b6dbcd463f368f5034adcebff65c87494954e8415b8a31864939b6bd7334967
MD5 851b916385918809ca700789bde3d558
SHA1 d840144237e96eda8d44a42cab89a7a6931001db
SHA512 74009568b68135510830fcb3842313b98e7376c8a617f573c78508cb9560d54ad82a9e7fb41e29e401e2443bf74ec8969c3d8c9b586da8068f11a759392ef88d
SSDEEP 12288:syPz5L8GI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:1zyGUPXlDSRS6/IHMaY5QNg5G
TLSH
T13E55024B33A621F9D6378379C8651645F371783A0B209E9F12A046766F3B6D05E3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 84de853718f936ad35c66c5e21e439045cad096783bb9fcaded4efbab3d1c668
MD5 1bdc4a6c14ee43535f3236462b2c2e67
SHA1 6b8b87cd006d4105acd969dfbb26f47e9d568677
SHA512 d98024f0b6181dde263bdda35e70c6ce40a6a3800f73bb204a7f40c307497713a4d46a93d00574be2026016baa5228136ac70a2005b10d2ba95e6889c5d6ed2c
SSDEEP 12288:2DI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:2DUPXlDSRS6/IHMaY5QNg5G
TLSH
T11F45238A376B47C2DF7A83F6957811C8E114297E29A5398B20F5A475E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 03132509246c60997bd3a1cc38427d6db897546fb83cf97a0a1042848ca7c0e9
MD5 16f4fc787da750cec998b76175b81833
SHA1 7f32eb47fd1e2b8a0431403447c9e2b5c323f109
SHA512 c02776acf8a187c2d0aefdaff23f41c7b7f8fc99fde66f0a5c94c0f0d5fbabc5e6d398ad9d80f087630c894dcc8c94f9bfa1fa87318a83204273cf6b348751b6
SSDEEP 12288:+DI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:+DUPXlDSRS6/IHMaY5QNg5G
TLSH
T1EF45238A376B47C2DF7A83F6957821C8E114297E29A5398B20F5A475E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d2e1c6fe38a3cfc0633c0754bc0932ce1ac15a4761cfd6eecf28647b4bac8238
MD5 f6f389bd682eb1d1a6f7bcea3759fdaf
SHA1 88a3a5226256760d7f74b0eeee1a9c8c57bf0c41
SHA512 b340dc6d2ba652ff5a0b0ddfe713da496af98a8fa7428e902f662d29a32af913170ea27add88f32a46b6578809b68bb4f684b01cd12ff00c8630a7e2825ff37a
SSDEEP 12288:syPz5L8GI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:1zyGUPXlDSRS6/IHMaY5QNg5G
TLSH
T1DC55024B33A621F9D6378379C8651A45F371783A0B209E9F12A046766F3B6D05E3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1776e1eeff1a887ba4a8b21ed2a1716f6edc28cbb9b1f9e896556f7cb3e2df8a
MD5 7b1b313a4350a7546bd37d297385da9e
SHA1 6e3f11a5e9f273b68c7ecc0f444e40a7ac8bbf02
SHA512 2ef10ecdc38c0d8f6eba08bfb388424e41841dfb8aa8d50c869cbcdebdedaaa457f87f470fe4a53fc02de12be92129f6a44f27705627c05b49e5cbba5b462b1d
SSDEEP 24576:LcP4mcvIjkGOxhKP2l71nNKbrh/8KBbUPXlDSRS6/IHMaY5QNg5G:gP4m4IpOO67W8KlUvlDSRSQIHMaYDG
TLSH
T1BF65AD2DABDC0096D0BA917885658A49FAB1742E2F3286CB1160933D7F77EE14F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e81ca817095abc6e59eabd721145e7eebc6f98c36eb63813e9dcbe703a804701
MD5 768055c59b0b150a19fa1d63e8e1fbc9
SHA1 6c35e65584b9f551d6cf5a35e9a1f9ac523867f3
SHA512 8c1eebad3ddaaa275888c98e5118c573c0515080842ad2ee4d285a4d2954b713bc6023844352c863dd3e5544572ab3b728a58433caf6610224e82b33e73032b0
SSDEEP 12288:08sfzI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:qzUPXlDSRS6/IHMaY5QNg5G
TLSH
T1EF55F10AE29802D9C56E92B6C7654680F3333C2957E1A7CB22D0F53E1F396D05EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1e9c409e951430f2bfcfb75a5bfa4ce62429a5971c9d3f163b560ba2aee6aac8
MD5 b28a701a219a1e5624a03ee3b8851e63
SHA1 3db5339eac0e5398e81db26273f984ea56cc2ad9
SHA512 6c6fa31857a114d830e6513d78ebadfb1a749f570798124ddaccd6f13a3a1faec7cfe3453dfa555d8d5a81689e982da6a16599dce10fb6265aad39d32f62e61c
SSDEEP 12288:vTI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:vTUPXlDSRS6/IHMaY5QNg5G
TLSH
T16145235A336E8783DF7BC3F254385088F119397D1E647C8B70A1A179A63CAD16A23736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 38cee84128b222fa2d65aa18ea625afc3fb454346143d997cfe08d76c8e06f91
MD5 54ed71c1362a502ea5c65eca64a1674b
SHA1 9f20842f984672bf9c4a22f80ac171757403c542
SHA512 dfa96e21d8d6dcef388a0680ed466d58de07bebf3813b5dc35498dcb6ba3f09e558169d3f40d2ab6763959d1b81446845132b577f31bba1c35a50d17d60af902
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQRUvlDSRSQIHMaYDG:ea0hNYG4JwXv9lYD
TLSH
T11385AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 98e7db5407a845f65d09a52facf397cd74c8e4f9332239686262caf2ec83f431
MD5 39a067c9d3ca7351b8b951a21f44ba0a
SHA1 5c1258273bc1d8e265bb6f2a0f7e6a8485e33481
SHA512 aac8cee4e15177aa28c502341c1c8d219cc5a69ed2db4daff0e77bbe9401d3a31a5095a934ef06802aa1300e495ecac357081f04d4269c54d4464434f44b2d76
SSDEEP 12288:1hbHjfXSI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:1hbHjPSUPXlDSRS6/IHMaY5QNg5G
TLSH
T18655127E23AD12C5E672D2BD85654149E330B8391B21A7DF22E1827D4F3BEE01D36B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1f6ffec62d92c735b1daec34149d0b713b95e3e0ffc09113adf72d0d88d6cf55
MD5 1b139de12e216e47d652d11158d29212
SHA1 0a770956b56db606180041a8c3bc9570db45384f
SHA512 144063034271d7334da2e2cf1e3a392dca8861547d226cb6df10198154b077a34b25aa0be74076646c3358a22f89377366f966a183b39405919f892cacea2bf3
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/qUPXlDSRS6/IHMaY5QNg5G:wIgnaTk46pBR/qUvlDSRSQIHMaYDG
TLSH
T1A945BF2EF2B910B9D8AAD236451143B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 98b36ce6f5ac27ac1bc56a9d5adb4b060c9f75856c7db0a7893e014b8fc0884a
MD5 b7fb9f974f79e48011cffc2b8c90fd30
SHA1 13743bc3ad292253190e67e23493acb9a3311e2b
SHA512 58b083ebd0be0f2f56798299773db8b41c48144c93a5c755b8b803f50ec4fe1298c4296a3ce090d9841feb38d351cb1ec087f276418dd81cdc94abd6442689af
SSDEEP 12288:L3I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:L3UPXlDSRS6/IHMaY5QNg5G
TLSH
T1C045238A335A47C2CF7AC3F6947811C8F114397D2B6539C720F5E579A63CAE226227A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 01a662b2f32912ccd559d8fb9351bde8c35d286cdb5fc5ab7525aca8ac989b5c
MD5 4d84c30dbf088047bad062f5d0d9d03b
SHA1 0db11fbf39b3738f054479ed93fe169a820b6d54
SHA512 a18e8267c95626ad5ddde79cf2f09a782f7b52f96bbf61f0a90129bae25bf3053abd7bd56b58ef5acfb16ccfa347a8f4f7419f6cc039eb283503bf37d761849c
SSDEEP 12288:zObZA4LWOsvAYFTYI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:ctL3UTYUPXlDSRS6/IHMaY5QNg5G
TLSH
T14975F159F7A500F9E97BC27CC8668506E272746D0764EBDF03A88A651F237E14E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d1ee71aec04900d742069cb3c904c448d8bfa2547760f490eb13b52b307beb00
MD5 133764734adfab57034360090a81b9c4
SHA1 465db0ebb1965e0cea884fbdf2bf9a55130bbfd7
SHA512 a37597e084a050e2a266ed9e5c410b5532da83203e47ee83825e8207d5f5db74e8ab149a83a6c2eb6a7fa33bf3678126a05a98091713303abaeac5259b23a328
SSDEEP 12288:BpFteOMI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:WOMUPXlDSRS6/IHMaY5QNg5G
TLSH
T10455021E33AD11E5D63A927D89A6424CE331787A0B2127DF01E0817E5F67FE46C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 85c3106d0d72917e2371b72dd253f7aa25ecbf002a98337caf015eb3ffd1409c
MD5 171acb40be8371bbf7ac2f8beeecc483
SHA1 1213e18cbeb91abd15980dce891ac8dc8d9a8199
SHA512 64101a07710f4d70dea89c70893bcec75e5daee8fba732c6d9a8096710b1c0b1a58194ddbc416828ea007b190d21c23c6ac7e6efd164ba9bad2635ca3b978671
SSDEEP 24576:W7NM9YqZqmWMUkPjZM48Mv6bEhsDUPXlDSRS6/IHMaY5QNg5G:W7cBWMpPjN8DbEhyUvlDSRSQIHMaYDG
TLSH
T1A465AE2E6BAC81E5D577D13DC9A28205F2B1B4651B318ACF1162833E7F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8e334297750af542e1e740aa943cc1bccea30061da762d1b7d9cde3eaf6226c8
MD5 66d737e67f39ee42bf51dc5115b258ce
SHA1 5049e4db9ae5bbbd4ee8227b014e660dc8c3c0e4
SHA512 4b8a9a28798b4e22c4aae3aff542ac894dfc5aef2cbb975f41d84fe555f9437a1cdde54a97584c2b4f7d95dd8a75ceb3f7961e785160650d56240b864a9d7dc0
SSDEEP 49152:6F2YuHNETovAvNYf8kmjUvlDSRSQIHMaYDG:z6BCf8kdv9lYD
TLSH
T11E858E2A27ED80A4E0BBD2BD45B6D246FAB2B8551B3055CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2f7345294340ea449be03f6f6a0f808a5aa51d4da078c534b88b5b053cf41c11
MD5 187eaf9cdc303e9eec0b2b96d2beb018
SHA1 bcbad2e3cb848f2231279dafde8a9ca7ec743b66
SHA512 63d39de9b0f533069373f18a1ecb3446e05deeaa2d1cd02a20d43ee624b318cf9db2c5420a4820efb418fb9438c4a3a61ac612db7a2a1b496d0192b75964bb71
SSDEEP 24576:rAFs06+OmlfQNXEbToAUPXlDSRS6/IHMaY5QNg5G:kFs060lcXuxUvlDSRSQIHMaYDG
TLSH
T1B165AF2F62AC00D5D07ED17E8997C91AF6B1746707256ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e01f52e346669ce302d1bbe3fa9567c396be5d859159b2eff570c2336cd2b01b
MD5 aa3ba505c491693f01995a84ac464e3f
SHA1 4c6578e98be8dafe6dca4469a59c5199e30417dd
SHA512 a6bb518ca817545a1afefad5cad61d6e4c6e2c8f48634afad1dd78f8bd26ab8aa89b274aaab41f10511d72e7b83aedee2a0a60173e30b677fc5038fcf1147bef
SSDEEP 12288:KCJnJ5D3VkrFzxjI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:LJnJ5D3WNxUPXlDSRS6/IHMaY5QNg5G
TLSH
T1BA75D02DD2A810E8D4B7C3B4815A1785FE72383D2F226AC724B4D5357F16EE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c9e6475aa0028684149b81fe15eb370a3a407276925e2603ca77bde82b5d1568
MD5 4b9484ebc4fa38922f029f9eac392391
SHA1 64c7920c824b198c51a6d50e6c74b70f0b771b4c
SHA512 21a0c516540bccd8433d7c3b3ee72889e0b473a6ab7809edb9cfe1d105338ccc1a9468cb5d4ce31fa0c6ea893d3ae39499cad681c5945aae97d0c4979c0dbf0a
SSDEEP 49152:1g06DIKdwc+eQnSt65aVfUvlDSRSQIHMaYDG:OKv9lYD
TLSH
T19D955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 348c1c5b3f01a034e04577f140bfe74073d1ac0bfac18aecbe26c39acdd35acd
MD5 7818317456117a0b1526814c4f8f5641
SHA1 178916c0c2b355618b7f1058349f109de5847f7c
SHA512 f1f6726a91bf683bfcfa12d492e3346ba74f2da3b188438a0b3d902617dd3987ec2cbec06e9b3b11dd4da0e1d11ff55f850afc38d38a3695afcb76a16241d9ce
SSDEEP 12288:4EP3Rh1I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:Th1UPXlDSRS6/IHMaY5QNg5G
TLSH
T1E755025E27AD61D5D63A927D85A08148E371F0782B623BDF11E1C13D8F3BAE12E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 f0616a177a3776bc88c29c69b479432d1f98537bb1431888c16acaae897adcb1
MD5 4182f0b3224e1a4cbeb0fd53e30ac707
SHA1 01b882c66f1aa0b4202334f4f3de6c3ea58f2d63
SHA512 a25751f163909556b94c2f25bef2f36baf922c532a93a4a570ba04a14e235eda395fc585f49cb2a2f9fa115544be3843f1565c501dcc3b155bd0d3cca67f99ff
SSDEEP 12288:wjkyiI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:wIyiUPXlDSRS6/IHMaY5QNg5G
TLSH
T182551249339852C5DA7A8379997641C4EA34BC341F2167CF60E0F63EAF3ABD06931B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9b14d546bdc325c9056fa078f41f31a72164306630381ef72fbd454d4b0184d4
MD5 8fb68eddba3d4c358ff9516238cf82f5
SHA1 d8ff80da72096cb8aa7e41194ed67e462df9ac9e
SHA512 195fecb37fd4eb2c025a4fc02795f43fc0198532d183f87bd35026711e004f18e8d6cf5e78ec7af79b51e746385762c84ba876d81270b3e736bf31391c7ba98f
SSDEEP 12288:7lcI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:5cUPXlDSRS6/IHMaY5QNg5G
TLSH
T19F45225E336A57C6DF3A83FA853811C8E124347D2B6439DB20F1E579DB3D6D12223AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a76b94464c45ff1a3f565f4ad711252e3f7a0e86c361301a038965d91f462f46
MD5 6b065433658ce819b3b10b8db8d38102
SHA1 b4c5936815955e1079ca2ffca0d92282250f50d6
SHA512 3a11b871d237acf9594043187948c7299ecaee8df0ddee6b45bcbc30a686b092d8bb262ee8a308874155796d3642e6eecbc3d443ac345ca779f6ec8c67205631
SSDEEP 24576:MQ9MxZKdcz9dw3LUPXlDSRS6/IHMaY5QNg5G:MVKZLUvlDSRSQIHMaYDG
TLSH
T114558C2DABE9058AE177D27595B250C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 742600a795efe63f790c5bc7529a8791eb15bf7389c1414674cc590dc424dfc3
MD5 58db83b31a7c7333aec813dd191db994
SHA1 032ab8e202a29b056d86528aeb9ec89d8f158b1e
SHA512 0443014272cc18260bb3299cfedd8c9b9c4aaddc4e709ea2c4302f2878bc5a9422c7cfbaadf87627bdb63b04e13357241649d60f5963cb38f7acd8c57750342c
SSDEEP 12288:ryoKo2XRple9p2I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:ryochAp2UPXlDSRS6/IHMaY5QNg5G
TLSH
T1A865E01F7B6E40E2E176823C89958284E773B0341B6267CB6191C33D8F27AE9BD35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 274624c57d3c649d9df941ed84bee90b9bca3fa0f60b3628d04ee900e851c790
MD5 a9148d498f82eb9067eda0956d0d1ca5
SHA1 9fb1c0b013f8ba1411692ba661c27e3dd3de0111
SHA512 4f7af1d6cde51293322f288985c92ceff1c919b3a83ad761b5b280d4ebe2767e1fd5004ffd1472fcffc5b6db3340f4c05305f67788858ee53ac4b612b29ef05e
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK2UvlDSRSQIHMaYDG:V0zuNI5v9lYD
TLSH
T1E6A57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 57ae6f2e332249d6dfa42777049c1e61d281aa59ad42b10d3ccaff1f8a0b58e9
MD5 d251d2b9fe4609e0bce4e62dd99d4071
SHA1 f5bb031613439325f5d71c9939719e23fbfd962f
SHA512 2dcf82afc68d3dfb2e6bf5556d791e9b3f0f991f22f6572a8c4cd9d5dd3e124f354c4eb89ab01350058d273abba1ed99440d6a9af0f4432cb0f3908dccc2d118
SSDEEP 24576:h1QT7EcpfxR+N5AWAz3ooiYsjMqb1UPXlDSRS6/IHMaY5QNg5G:kTDxR+N5YzTujMsUvlDSRSQIHMaYDG
TLSH
T1B455B02E67F915E9D17EC6799A23C502FA727821033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e7b647923255fc2fd646224c932353fc6ca0c3342532324b8f31e6cf3f64d756
MD5 9dc6e0b1529c238ad4acfb5be5303a4d
SHA1 8100d366039a406e6786d434c65978a6c4989438
SHA512 344a15efa085ba90317c1c0d5469615d2bc47451850d98036ecee0ccda0c83d405cea5df2313316f8b4f82bbaf3c6f62d61617f80d9e8d1959156c58be3cf77c
SSDEEP 24576:pTMdOz0FFS+jmSL5UPXlDSRS6/IHMaY5QNg5G:j0K+jmSL5UvlDSRSQIHMaYDG
TLSH
T1C865E17E636D14E5E57BC2BD96538906F672347603217ADB02E0C0792F5BEE03A3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 ce6471217f9319918e80fcb9bbe6a8940286a566120d25aa09022422f956f926
MD5 82bad58508309ec6953fc895000b7731
SHA1 e09ca79faa1d2e1e270531c5153f1d3985a67400
SHA512 a5cad39c55f359b79bcf4791f16ac5edf3dd31ee7112aec62db365726f1834da14539965cc47c9042997de300bfeb04c549143352d77011cd533076732e4b2c0
SSDEEP 12288:b4YYI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:1YUPXlDSRS6/IHMaY5QNg5G
TLSH
T11D55125D23ED21D5E977D3B589350188D230787D27243AEF30E0D57A9F3AAD09636B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/788-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/988-167-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1128-13-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1128-101-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1176-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1636-84-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1636-82-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1636-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1636-358-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1676-357-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/1676-72-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2156-128-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/2280-445-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2280-127-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2424-264-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2424-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2424-39-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2424-33-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3040-411-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3040-124-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3040-129-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3040-118-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3312-62-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3312-56-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3312-68-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3312-66-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3312-64-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3376-140-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3376-166-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3376-412-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3376-134-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3992-170-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4024-90-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4024-98-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4024-391-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4024-96-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4164-168-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4164-479-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4252-126-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4252-102-0x0000000000720000-0x0000000000787000-memory.dmp

Download

memory/4252-107-0x0000000000720000-0x0000000000787000-memory.dmp

Download

memory/4252-392-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4584-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4740-372-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-360-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-386-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-385-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-388-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-390-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-389-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-387-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-384-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-382-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-381-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-380-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-393-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-394-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-395-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-397-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-398-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-396-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-379-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-378-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-377-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-376-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-359-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-375-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-365-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-383-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-366-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-370-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-374-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-361-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-364-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-363-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-373-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-371-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-362-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-367-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-369-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/4740-368-0x0000027333610000-0x0000027333620000-memory.dmp

Download

memory/5056-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5056-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5056-25-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5096-172-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5928-130-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/5984-337-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5984-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5984-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5984-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6088-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/6088-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/6088-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/6088-3-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/6088-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/6112-352-0x000000000C920000-0x000000000C928000-memory.dmp

Download

memory/6112-215-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/6112-179-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/6112-195-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/6112-171-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/6112-353-0x000000000C910000-0x000000000C911000-memory.dmp

Download

memory/6112-355-0x000000000C910000-0x000000000C918000-memory.dmp

Download

memory/6112-480-0x0000000140000000-0x0000000140179000-memory.dmp

Download