a57aa3f1483debb4e6f98d041def34944c72e1f68bada7eb331e5cd542951c9d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Size 1.4MB
Sample260504-tkwqtabt5n
SHA256 a57aa3f1483debb4e6f98d041def34944c72e1f68bada7eb331e5cd542951c9d
MD5 6a971f9867f170e120167dffa4d27f5e
SHA1 42179e1c968b673a7467901fb2485fe7dab36a37
SHA512 11be34956e0e6aa9272b095e77dcc7a7a870b975d0c190e5e28bc556b38ba64ffd2bc06c7aab1546ab788c95507ed9d92cb3397454ccb3ce808d14e6c380aac9
SSDEEP 12288:sCEhwdbTUI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:sKdHUUPXlDSRS6/IHMaY5QNg5G
TLSH
T10665F186325421DAD523B275981F935FA3727C7F0B20BA2B135CBF2A5F362816D16B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4408	alg.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
3896	fxssvc.exe
5840	elevation_service.exe
484	elevation_service.exe
2608	maintenanceservice.exe
2440	msdtc.exe
4168	OSE.EXE
4184	PerceptionSimulationService.exe
1188	perfhost.exe
3392	locator.exe
388	SensorDataService.exe
5508	snmptrap.exe
1900	spectrum.exe
3972	ssh-agent.exe
5316	TieringEngineService.exe
2716	AgentService.exe
932	vds.exe
4400	vssvc.exe
4588	wbengine.exe
4660	WmiApSrv.exe
1772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\45428211da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc67e12ee0dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d8b802de0dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
4240	DiagnosticsHub.StandardCollector.Service.exe
4240	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	3896	fxssvc.exe
Token: SeRestorePrivilege	5316	TieringEngineService.exe
Token: SeManageVolumePrivilege	5316	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2716	AgentService.exe
Token: SeBackupPrivilege	4400	vssvc.exe
Token: SeRestorePrivilege	4400	vssvc.exe
Token: SeAuditPrivilege	4400	vssvc.exe
Token: SeBackupPrivilege	4588	wbengine.exe
Token: SeRestorePrivilege	4588	wbengine.exe
Token: SeSecurityPrivilege	4588	wbengine.exe
Token: 33	1772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1772	SearchIndexer.exe
Token: SeDebugPrivilege	5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5904	2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4240	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3916	1772	SearchIndexer.exe	104
PID 1772 wrote to memory of 2940	1772	SearchIndexer.exe	105
PID 1772 wrote to memory of 6140	1772	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_6a971f9867f170e120167dffa4d27f5e_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5500

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:388

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2924 3024 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2940
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2868 2036 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6b244cf1b7f266f1961df8c8dda4c7555e9db5232dd82c13831366c916734a0e
MD5 36e1865a8a0bb7aa251982a371833e43
SHA1 16f9ab1bb99e90d5a66151e9538cfbc436fce5b0
SHA512 749f262c093328abcf44ddfb5d69b48e4099dcda17e990159482729e2d1946c72fce5c9a3d89b39ec8831d1061cbc0202a2470c99faa00e26a6a6ef77d32a6a8
SSDEEP 49152:gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxncUvlDSRSQIHMaYDG:K3q60jBUv9lYD
TLSH
T13BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ccbfdc63734ce3f4f6a441ff1d5711ce0a087d539918410f1224ccf91c614059
MD5 bf0d735b9e32b76487021efa3959cd2f
SHA1 06dc9e0f3c4b93ab229575bfad596fb248709013
SHA512 5d1aa22a3521bfc512bfe644aec1a8069fd6e59e2af0c3aaf66028f3e7f06f349b2f86cd752ffbb035574e49071a62275aa71fda1f77ecc42b3a6385d2ee66ab
SSDEEP 12288:c1XLsswWkxy2lRq2czA7I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:qXYfDtczA7UPXlDSRS6/IHMaY5QNg5G
TLSH
T1CD65F12933A509F9ED67827DC8B18105E632786907A0FBCB03E499395F372D45E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 08ec7c9fda58e68812aef99df71285587822edd16a8dbceb72c7e7ce0d77a598
MD5 aff3e0e06e5eff9786ad381972ca52c6
SHA1 36ffd2bdc63891b59a57c0d9dce68a3497915f76
SHA512 a6e18d197a99faa183226f01975a63e75994c7ac08427bf329186f951e0295d747ea269e8640cba2b0636842a15d9db78b4145c5cf0b58fd9c3edcf7dfbb12d7
SSDEEP 24576:90Le5ji0hmxTrMkUPXlDSRS6/IHMaY5QNg5G:9Pji0AF1UvlDSRSQIHMaYDG
TLSH
T1F8859E16F6748371D073C0B9C5D2A68EE97130861B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f1eefb33de04586e26b60455e42d63bf3587ad970323aebdda745e621aa1087
MD5 32880b246cb3ab7fd397f5daf60a3dae
SHA1 f2a38345f9b27e8f0b4aeea9ef7ac9bc860ec1d9
SHA512 992f4e91ac36d8898c3b0c87394e0b598a459279edfcc7fc67dab8220f41568010842c01d21b2bec115fc2edc1b2e66e46393be3797a12fd434927d896bca9e2
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWr6q8wyuKUPXlDSRS6/IHMaY5QNg5G:Z/ezSC6vUzPviHjypUvlDSRSQIHMaYDG
TLSH
T19A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 01d84368928ae8db915b59c7de997d56de1b48d763707861bcab427927c6148c
MD5 8e6bbb242222f509e2ffb8a4456b7c04
SHA1 d74106fd9d2ad84c94eca423eb9a6101311f1948
SHA512 7d1440acb8ebace63cb8a313e8c7464de701745df937f2d57dc65c04e6110ce549efc92f7028207e202e7406701a213f480ca8f73e98378bc7cf7d59a2123177
SSDEEP 24576:LVbqPb88hv/l+bXUPXlDSRS6/IHMaY5QNg5G:LVO88hXl+TUvlDSRSQIHMaYDG
TLSH
T1D8559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 22f4ab05a523b6274e28765dd80c89ca64e774b144ccb2932ece10528c67639e
MD5 26efc24e2b2fd977c76b4d1dbdd69867
SHA1 23be5d2f947def180befe1d70898a557af0b4ec0
SHA512 4858097f4b28d2177c4179201dfc933cf04db46fd2ea3cd26884053f622132d7966384b92203462bc881db224f01996d9a46a8b20d7a2fd7ff140e6ae8d3e377
SSDEEP 12288:A4gI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:A4gUPXlDSRS6/IHMaY5QNg5G
TLSH
T1F245238A276A47C2DF7B83F6A57821C8E1146C7D1CA47D8620F1F9B9D63C5D1A2033B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7fa9fdbd75fe2bc304a711deb7dd0c3b22bd16e61a9b1e1ea410a92df997c602
MD5 6678c366c13e69d2fa0eefd7e716ab2e
SHA1 3dd5c38ccf38191ac6be2a404bd62f5d895bdd4c
SHA512 3745b67a0504f4925bb057c3235246123c208f74875f5800d9d22e9222a3413cfe300b8887db3ba7fa937da4e911a8ab32b61eccecd06615e544a4f138db93dd
SSDEEP 12288:EeBNUbTVO86UfI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:EJIUfUPXlDSRS6/IHMaY5QNg5G
TLSH
T1FC65D03BAE28FCD2C67E89B956918240E77278304F61A3CBD175C20EDE275E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e56333a626f1d4fbc50a5376d18eb0c52d792136506e42741401c2639d314537
MD5 e75a19658fb51b26f2a71e1e89bb2b64
SHA1 0b80d3f2239665d8b9de30d754fab5ff774ace06
SHA512 7a408975de894432592f95db68ff936103492b62b3add87c1fc13eb93898f960fc809b9a9f3f4499d388d02c0bbfbc0cd334ea77b1917dfc7101f01555e001f7
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:wQvGAdlCEL8c/RRNw5CDv9lYD
TLSH
T130266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f177046e3a0b8f31c77dc2db4ca622e129dd9261b7cbec47c7e4acd957953c24
MD5 0b61b2bae096f2998316ca7671ae1d88
SHA1 e7dd7c04abe3f60f1b534231880d224026bf9f7e
SHA512 274ad59a158f810b66931fcb7a5994e2472f05dd823952edd3db46bc32b2eef1cf965dd1dd71cbb65ac60dfffd1cde74d26170690dbd7259804a61deb99016c2
SSDEEP 12288:GAwSfxL/2Dc35DLLmt0LDQewsAjlI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz4:bMewsAjlUPXlDSRS6/IHMaY5QNg5G
TLSH
T18075E031FA75D036C7BB0DB61B35D706642C79204F612AC3E3E89E9D99342D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 436d61357d0a3327130df0ad2b45ef153ce345da240b1209dae7b8d0ab55ce03
MD5 e3eea4b6a9c459ea72118de9a7b97320
SHA1 550c02fdd871196b10db6fa389bfe1a1cee50f76
SHA512 e81f75ba91879673cab9bd12b299fcd6fec41e6cabff7e873aa989d714f21a79b921b2eb7bd1489130e786f37cb6e7b8eb466d5d2a41eb43500b96ed651fb913
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHTD:CUEtQevvqc2W1cpV2RI32T
TLSH
T197474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 41b35307feda35aa719cace638b11d1c4c0b47e2902a0b14d8857a068ce9fa7d
MD5 8936e65ecd099dd84de7e1bd29ff146f
SHA1 0486c990666fe2a5ed2d8f17e0c6428a53918f45
SHA512 477e401bb87883a63d87f1b9a8294d85705fb35f49e363490fa9a719e1931f28f0c4525c787d69fd89533bf736751bf5248a5f7d717869950a1522455596eac4
SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zFUvlDSRSQIHMaYDG:foq2Vjnm3v9lYD
TLSH
T185D58D0976B8C2E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5b09b33b06d359a66e4833d99509b7e4c85febb527c7922e52963a0c8c3c3cbb
MD5 a2417df0e72c93d4e6b31a312cd387b9
SHA1 3e3f38ddef0eee67334944d89df1eb5ce003b124
SHA512 ee62899205e3e3b4c624745bc3848061f866bf081116d311374960b8c34f95c6bf226ea8d61fb9111bd28e06895dbbae6cfeec6e05dbe1d8fe41998905efe20b
SSDEEP 24576:aAhGL2IFoiwtA5l7S53uUPXlDSRS6/IHMaY5QNg5G:aAM1Foiq5+UvlDSRSQIHMaYDG
TLSH
T195359D81E7F945D4F5B3AAB899B69170EA76BCA95E30D20F2160D11F0E37E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e38c3b804eedecf70bd4f18f06ab0ea5eeacaeb26f323aba5c52cd02200606fe
MD5 d80dc14e64ff5eb0da6032986eb2a291
SHA1 2edfe4e61a66291afb08b8bed8fdbb3b01c48e5c
SHA512 8b6143933cf31b8cb5065d14f38cd19637e66d20c6a4c1e78a449971b4335ebbecb143863e8ffd6156bbfecb0f002dbfdcc5ca6d549337554246b8d480f31771
SSDEEP 12288:Amw5HEjsChNoBFgl0WDm+CqI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg59:dwuxOWJUPXlDSRS6/IHMaY5QNg5G
TLSH
T1AF65F14A33A50CF9EA7782398557C135F7B2B8152A21DB1F13B0C66B5F373616E2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 75d87459b6fa711369de5c3b7e86eb068d6b567fa89a54a56399368676e1b8b9
MD5 604ccc6ad2078eed0a64db1085c57d13
SHA1 2517a887fd51845143c757077b49c5c9223d9a7b
SHA512 5953929250a5d82faaa8904def299ec321217b23e930aa05624b87e3c44f2f573dd6f1b7ad50c9d96fd7e467d27ffb5d6d55e2c62bd396bd6c703054fdd2144d
SSDEEP 12288:HlZ1IyVI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:FZuMUPXlDSRS6/IHMaY5QNg5G
TLSH
T11855128A33A822F6D6B783B9C8F45188E371346A277557CF11B082795F36AC11E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 26fb52ce6b8ecf8df5bd597ababd4c759e5f393e6d4ba3de63ba6a949ef98390
MD5 9e32b1ef1c56c7d113cdc2f818994a62
SHA1 c8bed4bfc7b775dff13d5bf996eb7043e400e7fa
SHA512 6cc49e0d46d3a55f2b548738a4d0a2e109260087c8cccfea7007227db57063bfe196b51226afa16d33921c3f9e47f036a7cb35ce18c4e87b97937ae85c8a9cb0
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ug:SQRQyi36YOcPhLvw2gAf+PN3gv9lYD
TLSH
T18A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b4559f70a777efaf410136bdaeadce731a84aa2b90a8eeab86e86440e0ebc12d
MD5 434e31844b7972b656c9b16fb7d5c838
SHA1 57c76d05f7634731839eec225dcc032cebda5ddc
SHA512 e589d5948e318734d07d4a8b106c78dcaa7f1f061cbf483123c7c0d163a332c079f49b79930b0508168a73c2ab32fd6dd02688d3d1554565337a855ebe3c095d
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ug:iQRQyi36YOcPhLvw2gAf+PN3gv9lYD
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c1d4e080139d57f62e61262f504f6f872fe7937003c93efb1d1c5372aa924039
MD5 5985ed268396dd49d13816fd4a964f68
SHA1 808a062ecf46a99dc677b75865c47483ca30a74e
SHA512 9cc3c626d4e6d9c78bf5b590373ef988e7ad559bd2e86c3f294f9e943f47d2a0af91eac64f93334678010cedc650158fe76efbdf4bfbb2aeef0889fd08be3355
SSDEEP 49152:x68Qg55nhceWu7PNU3/1UvlDSRSQIHMaYDG:vthLRc/Sv9lYD
TLSH
T139B55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8151721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 170af2e68fcf91a75bab96f727b0886a44616ab79cbb6ee15e8ee1cd5fc6e026
MD5 76af77fd8c202d0c24c49cab8be38697
SHA1 49d283192a341e75a786bd27fae5eb23d181e0cf
SHA512 1adc3eb13afe644bff92d5db15a7c7daeff9c18075bb8885266773207cbb548900718806bf9706e6f4540bd452a43c0757e359d733ea515e36e1d5ea6a55a7f9
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99e:Dy5112gYy5azzVva69nLKnhZBv9lYD
TLSH
T16C167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 81275cb1a69c22f6e043ed0bfad0f66f7c949d8c1bdfe7db11c827f36aa6ba73
MD5 faadb50641ce36224afb841c71bd8ba0
SHA1 a9face6242e65913d413bc83e0142e0011c480a3
SHA512 ddc6326b90fadf1ce7eed91de9125fa8607462f6e76ae5ff8c612b504e91aed2a0d7151d0962e7d9587a3c0202669ae0edbe319ac0d133e32c467e0b0ad25352
SSDEEP 49152:VB+taZ3usBWOBr4tEG20bqx0z+n217aau1glLUvlDSRSQIHMaYDG:bu6JmUxd2dIv9lYD
TLSH
T169D59D13F1DA01E8D06ED178974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3343a0f9a613c917c304f19f447c2eab2ca835fe442b2745db85c656bc1cfb87
MD5 d1290031911fc6b492d8465b9d8573f9
SHA1 29523133e045e9bf90fe5b2f8a67ffcd6022a2d4
SHA512 a85bebf2ed2c829684401b38a3bef260ef8dc718ab974e94400769f5a1581cfd199af3d2d984a4c49fb636e4f9346125a1170a5fa937846ab23d9d973a0567f9
SSDEEP 49152:H1hpsNoJpF1A6BU44CwH7R4x/UvlDSRSQIHMaYDG:HmifPkR3v9lYD
TLSH
T126B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 64dada0b4c576c02abb33ad980781d7b6573aea59aa2dbbfe7f2fe183801216f
MD5 eb1301253423c04d301089b59fb9bef4
SHA1 9a1c8d3fbfb8eb85299734110278612cddf52885
SHA512 9d32816ed1f73fd65298fc86bfd8d7c1a79745ec8f2b6198816fb96ead6013fd7a5cac1d4e9490ac612b2a1ca92f1d54c600e06d7deb27331264e0be2c3364dc
SSDEEP 49152:8SuZQIY0Be2KNRVtOnks6NMHqMUvlDSRSQIHMaYDG:+5dKvi61dv9lYD
TLSH
T17AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 66d255a363622d520494e655cfdc2d0eeb6ebf329dbb69f7b5b75fc57a1d3499
MD5 8487df8170a1c024701bf7ee232a5791
SHA1 1e64fffdd0356f6c6fea9b5cc4716d32ab631571
SHA512 61340a6a79f083d05bb333e87b73b4a2622bfe3e4ec7e90f73712e5994f914e29e1bd9d1a249e5e2b868e14f7d42aec6a16f65a898e01f7f7207220ca830ed99
SSDEEP 49152:chtSn8EApI0figXgiDn0AP5w7UvlDSRSQIHMaYDG:dX2iyph7v9lYD
TLSH
T10095BE13F2D901E8D06ED178C7568632E962BC150B34BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 61bb20f757957bb0e944e06997ca5b4871a9a7a2b41add4c0e2d45704bb7428f
MD5 e5689c3bcc0d981b01b7eb0c20d9c08a
SHA1 c11345a983f9f090b9115ed68b8fbf40b0bf7c07
SHA512 c2654c3728cc419d1cd67028dcace03a8adb8a89d615e9cc1782b9e70a62565b49e2c06100365fcec833668aad5e84cb6f8d9c59d0622c904223fa508d2b3f22
SSDEEP 12288:JoI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:JoUPXlDSRS6/IHMaY5QNg5G
TLSH
T1C645238A376B47C2DF7AC3F6957821C8E114297E29A5398B30F5A539E73C6D122037B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fe301c199d17128a1bb3408573279a3da15baa55d9d32f6bb6b8357e387db2f9
MD5 2d7e9cac9e7729d62c631f0bb1d8f9fe
SHA1 94bb7320c24ee116ed4de23dfd2cb07acf46d8ac
SHA512 3972f54a6025643169fe8173c2d324702c9a0d8a380ef7e5da0cdd6dc55daf51b251f80e5e0f990e5a5528de96e214d88d9251a6d5b08a3ae380aed66cd032d5
SSDEEP 12288:XBI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:XBUPXlDSRS6/IHMaY5QNg5G
TLSH
T18C45239A376B47C2DF3AC3F6957821C8E114297E29A5398B30F5E439E63C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f4a5e7d8104a435ad7ec3ebd93ee094f513552326cfd2e15e760f32d16df3df1
MD5 dac13007e042b8572ac6ccbe3c44e28c
SHA1 0d0838c5175ecb7ee3644d13985d5dcf5817d6fd
SHA512 be3c180ddff27bbb7b445b95e4af9978bb217da7da886423e3327f52268de04748fdb9b309b2d0bb0cd49678a401d618ad736f3461bc1baa7a4d16c58f5433bd
SSDEEP 12288:WnI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:WnUPXlDSRS6/IHMaY5QNg5G
TLSH
T15145238A376B47C2DF7AC3F6957821C8E114297E2DA5398B30F5A439E63C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0ee77ab8bfb06f0edfc56fcd787a5d9b286ef7c186dcd8dccce468f3f65edac0
MD5 700c4959993bbca1458c12ccbf2e6d1a
SHA1 0701abbfe900eec35486d3935bacd3417bbdd1bd
SHA512 ca796b71f06282a56c2ebe3019f7f7a9f649c6b0842224a6a01232092ec48dc4afd0f4588cb4d35a210c90fec59ad2606fcfe368984a9b6254691735ae6a78fa
SSDEEP 12288:GVOI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:NUPXlDSRS6/IHMaY5QNg5G
TLSH
T12A45234A376A03C2CE77C3F6C97451C8F2647CBD2A757ACF61A055699E387D02622BB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4c0f40d053b7c30423f6d88720d93be16663ca30c96bd6811958325f32204b8c
MD5 eef49901b81f806bacd297662feb14ff
SHA1 e90abe07afdeef50908cd61d4804926678117d42
SHA512 e2b891c5e138fa3c2d80ff6137ab5ff4a23dcef5441f5746f77bd40fe8c8b4329728fc38c80efbc46b316bd10c6cbca06d0ca79631f995de336d1c0900c68233
SSDEEP 12288:emI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:emUPXlDSRS6/IHMaY5QNg5G
TLSH
T1B445238A376B47C2DF7AC3F6957821C8E114297E29A5398B30F5A439E63C6D123077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6d9c272f5f97e7a078d1d23f0f879f67285b256c569886a3383fe109e63a4f53
MD5 8184b7f0c89ac80abb92252c3470c39e
SHA1 dbc3353e7bcc13f5065d043059ab656793f369e7
SHA512 a7a604702b9fc3cf9c0b27a3964373af671df3069b1a3b1541756126fdaa3c26b45ad188749ffe32f4c65b4bec2b6b8ead8c87ac04faf0a11d83d5dba4cad63d
SSDEEP 12288:5tI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:5tUPXlDSRS6/IHMaY5QNg5G
TLSH
T1F845238A376B47C2DF7AC3F6957821C8E114297E29A5398B30F5A439E63C6D123077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f5dfe460407534e0e9a54fbcd79a2435e525a04b6a2082e7e00043d44c49088f
MD5 3b16e89cd1f9a3cd45b1ece2d2ce4134
SHA1 316cfd9e59a5c22a9c03048a29fd380e1b95ff28
SHA512 409028fc4827affd7b52e80a0e0c0bcd0644b877c1b87c9b290255f83e4e7287f53ce751d6be67fcbbb6c9d086a9fd4af7fa91469e81e1646788ee8ad1acbd41
SSDEEP 12288:4ZI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:4ZUPXlDSRS6/IHMaY5QNg5G
TLSH
T14645239A376B47C2DF3AC3F6957821C8E114297E28A9398B30F5E475E63C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 75c08b5094bd0e282387a369b4717da8b0d5c2c13042cdb5e3d9c077e130a33b
MD5 e6046c41cae9f8406bad8848d727c6a5
SHA1 01546adcd8756167eb877cf0b4b1f691afc91c1f
SHA512 8cb2c26cd759943d2bc36c508e882b8b58e8f5db31121527004f6846ab3c208eb0920c7a6f40f447b853f9e6e133fccbbcdfac0a2b9a4063803a7d5c686096ff
SSDEEP 12288:yiZwbqzzFEoS2cPvyhI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:VZMCzFVSOhUPXlDSRS6/IHMaY5QNg5G
TLSH
T115650199739009F4DD77827EC8258945E2B27C6A0B70CA4F13F4362A5F373A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3afba4584b05498b2e0dc411fcc9e9b02822fe013465f93b1c496eb75063586a
MD5 767ec517452ac71a604204e431adee61
SHA1 96188b641c835c7b0048e312437911f4086be578
SHA512 4423bf46ab3a3c94b54adddeb931918f662ed86ea21990e820799d4359c7f9f1702bbd9da3f44140cb65e5f38da6eb16a9d7b634a9df4b439519d725a7e22d94
SSDEEP 12288:E8I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:E8UPXlDSRS6/IHMaY5QNg5G
TLSH
T14345238E376B47C2DF7A83F6957811C8E118297E29A5398B30F5A439E73C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3cdfb68d0e3d03fff6c4a34fbe2b6c7c331398dd79c3ea9e3770024a5e0db132
MD5 33c62486e9ea78d4cabb026132872670
SHA1 2469dd0d8aeb706162535e81dd78c75463317748
SHA512 a9e0a695e12b556daa3ea1c100ef70a1d3d50ffbc773cbf9b1238c465c78427f55a2b188e51d1b00765e71a11be3a6215bea1f4fa9122896e8940233de6692a5
SSDEEP 12288:SQI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:SQUPXlDSRS6/IHMaY5QNg5G
TLSH
T19445238E376B47C2DF3AC3F6957811C8E114297E28A5398B20F5A579E63C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1fe9dcc2517f1cbdc5f0d44a42cdd65e424d4e3eb5d3055431bcd2a8912abcd4
MD5 58f54ee171a79ce4160faf132bd0e78d
SHA1 32516c33ec4d3b74a54df8c4dbd21f6f459cc9cd
SHA512 e88339ea8f1843de6a9f2a018378b90c347ff5775f5a40c2fd916976863bef8cd4fd713cbb9700000a476c379abdf01af3ceba76c5632e1c8d4d26b120d2b2f5
SSDEEP 12288:UyPz5L8VI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:NzyVUPXlDSRS6/IHMaY5QNg5G
TLSH
T17F55024B33A621F9D6378379C8611645F371783A0B609E9F12A0467A6F3B6D05E3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 07835ff7cf83e458179868af03df0a445c02b6d7c2a6dce61de15da7911d4438
MD5 1889126d3000725f77f3e3271ba4a7ed
SHA1 51f7179d89a410fac7a785900b7acf4e2f4a5847
SHA512 1dcf5995f3c5093659fdeed97d8ecfb220d516fb2c575ffeef5c142c3c3c35917894974751c23bc4bb341f586e9a0bc8f45aec947343d63bb247bfcfad6f3f61
SSDEEP 12288:Z8I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:Z8UPXlDSRS6/IHMaY5QNg5G
TLSH
T1AA45238E376B47C2DF7A83F6957811C8E118297E29A5398B20F5A439E63C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f990e59771a835d254f3bac8a112bbfe896b24456ce69013456cba1c8f855bc4
MD5 5c5e161084070534d00a13998563d5e5
SHA1 20234ac22956d9a3e2ac36ecaf9e3ec6f8244aeb
SHA512 643668f5b21b6dea7dd89601a5f187583a886fea68b7fbd668e07d108bd6a6735d9363938b3a5b98a5387b24769f698738e0a76aa89ca87d8f3ec034b42a2544
SSDEEP 12288:48I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:48UPXlDSRS6/IHMaY5QNg5G
TLSH
T1A845238E376B47C2DF7A83F6957811C8E118297E29A5398B30F5A439E73C6D122077B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 51605bff79d6d95f949e6e0c8e3e0f4d5c3b3cd1b8ce4ecde827428252f87c8b
MD5 34ed6afe572bde0560021affbe58244e
SHA1 2bc57074539300a41a28cf617b0fde6f80420639
SHA512 6f1bc68da95d2e230354f328146bd523a4100152ff635a6d5fe7fe1a52521fafdd014ea67f268abee0a5b53191a51909894cc6022af49d21f19adfd8ec15801d
SSDEEP 24576:eCUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvATUPXlDSRS6/IHMaY5QNg5G:eCUEPTY+8Wg2lIL8lrIUJLWwmUvlDSR2
TLSH
T1FE65AE1EA3EC0896D4BB827589518A06FB32782E1B3196CF2170C37D6F27AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 188fde70e2241b74d6b800f94acbed06798db6b84749536011cdd7c1f742e712
MD5 aeea933966e2f19e169afef82da5edab
SHA1 4a8c3c7726ee281cb4a5fb71b386294003f4498a
SHA512 97c4a8764450ab136176bafac578088dbe4e2c8528e62f37ed7f35c850fb4740f33eb016979322b2e6ad05e523cabcc0675dfb32714ed9b3499e2f83c2a05e87
SSDEEP 12288:l8sfMI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:hMUPXlDSRS6/IHMaY5QNg5G
TLSH
T13C55F10AE29802D9C56E92B6C7654680F3333C2957E1A7CB22D0F53E1F396D05EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 838961322c530c9bfbf90d82706ee43a8c53287e459f266f594457f1af18821d
MD5 74ef7284e7cf452918e4f5c9cd4b2bb7
SHA1 4f2b3d083822cd6cbc174438ff610a362895f490
SHA512 6c88b073cc4b8b639f86d5c78f5956cbba9e248d5c765e2cde3c4aac6fe2a608f8f97d78aca76063a2504098816f5fdafaf86b6e01ab674883f433189ae36a43
SSDEEP 12288:IHI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:IHUPXlDSRS6/IHMaY5QNg5G
TLSH
T18245234A336E4782DF7BC3F2447C5188B118397D1F6478CB70A1A1B9E63CAD16A32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a012d9c35b17abca21a36393122d11df06cb0819c6c44a8eefc56e9863beac43
MD5 20b45fa2ba6559fd52aa9c6b79020c6f
SHA1 3ede04bf328adf6cf0362e635d54dc10ac3c5861
SHA512 6cfd1e88c70d1ca2f9b27868ea446b5d2b0d8f97d327707b7fb3ae9e48486dc859b4dd87e40edb50ef58f162b83204895c8686f97cd62e66fcdc69621f880cdd
SSDEEP 49152:XRZwQCyiHiQEaaPnMEUvlDSRSQIHMaYDG:h9xvPOv9lYD
TLSH
T16985B01E63DC46A5E0BAD2B8CD674407E6B278161731A7CF1190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1b4f67d659e2e837361775e961bad593de3dbc7948e61169b8c1dd133a2c5f3f
MD5 afb34fa5c7e61323fb708fc73b2dd592
SHA1 a8042445ccc0e8938f6da852dc5d851379d80d15
SHA512 ce44ffb376091d03142a5aedf465b128006d5962f9103a05d0eba1c0e7e6735581b1b4319fc02802d3aa80a2c573c70c8fa0078a62cd20d91e6fb8876c683a60
SSDEEP 12288:JbxA1U7K3I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:JbxA1UG3UPXlDSRS6/IHMaY5QNg5G
TLSH
T14A55126E23AD15E1E676D27A88A54144E331782E1730A7DF20E1C27E4F3AEE05D36F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7a63a0de015667d2c04459df695b9ac6544952049a428922d36d32375310cc24
MD5 a25e0155201feb0f8d35cdee251eb722
SHA1 5489268039df09e15e7b7d70f2f5a5530ca85e1d
SHA512 0110d8ce67cd3c7442076b310771e601a2559557c4b726311ad9137fba51d2da2ef7db2c7a89da77b0d4ea62d9e6c4ebca471ed15882d7309ab0c00bb98a0101
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrn+UPXlDSRS6/IHMaY5QNg5G:BjRP0yHfVqzlAsrn+UvlDSRSQIHMaYDG
TLSH
T13B45AF2EF2B910E9D8AAD276454107B5FB71742D1F209AC701B0C634AF0AEE49F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c842d4f275194f739af587169d30fbbf6e504c403492ff342ba91e4ebe7f3012
MD5 1c938ec4dd3451f9dc8b35f8005d42b5
SHA1 b50e9ca4abebecf39301a976727af06b49db90dd
SHA512 c222df9911bc7fcc432fcd2b85e4f5804335c4bf8543221f5444317e431423abe95f25fc0c356ea821ae7d348a3f0c3c1528604d57ae641bced049a11f90b53a
SSDEEP 12288:TNI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:TNUPXlDSRS6/IHMaY5QNg5G
TLSH
T18645238E335A47C2CF7AC3F6957811C8F114397D2BA53ACB20F1A579963C6D226237A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 594b3731bb6b4218ce07be67acdd6547517a52b54a5c352c7289e3f079cdf9f1
MD5 7fd4339ae97bfc84f3c83824ed02e221
SHA1 d63082f09dee8f31a228828f1c24923850867be9
SHA512 476ed82430e65db7a040fa259e132fec7b743031e54208cbac17752211ffc736aae308a707c38528a0d957f979bfe88fb3eac6fffbfd933a11408dadfab12bb5
SSDEEP 12288:MObZA4LWO+vAYFT7I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:xtLBUT7UPXlDSRS6/IHMaY5QNg5G
TLSH
T1BA75F159F7A500F9E97BC27CC8668506E272746D0764EBDF03A88A651F237E14E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b4ecf35ffe8d8d6204ba12acdb20b0b84693a5c5d6f4d98126598031dc6c2aaf
MD5 3439f5c98c18b1a75a2d9301e211c9b7
SHA1 db993606fdea38704115280a7b29452938359f57
SHA512 53dda1da444b79c6d6b1d5b34afc43b4cf22b37171d2ab5310de1f7dc3757db37da4de9f6567f3b02d6d3c80dea8ccf02ebe95839b287683b26f166c83b8145b
SSDEEP 12288:j70VmUIYNvUyBp4I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:MYYNHiUPXlDSRS6/IHMaY5QNg5G
TLSH
T1B665F11F62AD09E5D63B927E8AD28248F27278661711A6CF00F0C27E1F17EE47D3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eceda52c574fa0a4ae0ae24abba1468b49596399e410ea293457e07660474b57
MD5 319a56af77ea0ed52a4bd61eb00504be
SHA1 0f6722a370402ca46518127eabb14b8982310871
SHA512 4924bde9dfcec52ac8f357969d3fe43fdecd4505dd184fbc28b73d2abfeef1edcd78414939d380ee6682a4d0fdcdcbbdb5faff9774bade9764f989e8cdf19ac4
SSDEEP 24576:jnXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKa:jnXoJJYH84VVS6AmERJas+cHBjSSKHPK
TLSH
T11465BFAEA2BC04E8D5BBD17DC5C24506F5B178661331CACF026182BA7F27AF15E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a5d5d2e6df29b74055fab6e2a2b1386b87d147446da139c90b28c4322844d140
MD5 3d2fdb90a99bf9bb8289840c92165394
SHA1 ec1a0d032f04fff7ea9144a4b821b279556a464c
SHA512 c00425f168153fcd965f2d81d1e1115bbbb4aa356bf871c2fe4d3109d2df331456761ee0fb60e44003135c70df0ab5e664013fc80408669c9346b784a301fdad
SSDEEP 49152:ZDLL9TuJ0M/TYW2PtUvlDSRSQIHMaYDG:ajv9lYD
TLSH
T106858D5EA3EC42D8E47BD6BD85B79046FAB2B855173091CF0290856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 e1587adacc6eaeb7385977bcef536090246acda9e82a836508fbf7d612cf3e49
MD5 f1fc5ef2f5ab1d7a7e7ff7f123983b7d
SHA1 4a82e20709549aac3061ac4f5f854cd9df79acbc
SHA512 d9f4c08f31d789f79af6d3faf0b97a2779ed334b882f1884b89f2a8ffc5907db303a92908650e8f04523e4c48cefbe5a9e6613375e4cbe91a267e953e890b684
SSDEEP 24576:PegJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10w7UPXlDSRS6/IHMaY5QNg5G:PngOJOmPOHc7UvlDSRSQIHMaYDG
TLSH
T1F955BF3FB7BC15D5D03EC17D8A968906F6B1782613255ACF01A0827E5F1BEE42E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 565763823ba36247cd28310b5b247f51120ce22d84a423eafd9943143a1a3684
MD5 2576ecf4457c137e00378d7bfded7894
SHA1 30877e681ecbdeedcec639ef825d6bd4343f67f4
SHA512 0c86fd09a66ddc39bf465ed2af5fbe765dc0e3f358c8f66accfc7e4f55abf46fe87cc0e851cb088a94bfeb5f86cb813038b398397d8370cb2b09b5c57455d1c7
SSDEEP 24576:vLJnJiTk3R3waE4JrOtUPXlDSRS6/IHMaY5QNg5G:vLJnJK8R304lOUvlDSRSQIHMaYDG
TLSH
T1B675D02DD2A810E8D4B7C2B4816A1796FF31347D2B2169CB25B4D5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 417282f06523a8ed337df9c6b28a24b6ca727621634413fa1a05a1bdfd894a5d
MD5 355820a5771659080ef738826f951e1e
SHA1 3f2e0b731beb61c8889745d4cf2258404c4920b3
SHA512 bc3caa09e7c4950d350ca0b46773bba36cf2d8d523ec0c6b9a8ee5ff041c5fa015abe96ca903f0bd93ff36d7183aa2a832eb4dffc044c1a8ae33d0d213ab5ee7
SSDEEP 49152:J9GqCzDScAZmlvTcFg8Ph6ZUvlDSRSQIHMaYDG:lLv9lYD
TLSH
T132955C05F7EB5298E8B3CAF1C96294159B327C509B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 26ee174e16938e8ffb30ff187db209db08f6933112d1b0e091663d248c197d84
MD5 8c078650e32e645e4fec28db36a1d7a0
SHA1 8ca561b3c49eba0010a28e2aad5037ca0e7e43f8
SHA512 79f7abf7abb75763ddc0226bfd30167749bd3c2caa3e5d72648b5213828bd89b05045f4e105b1a31daf46bb90f3d17b6348b0310b285e6470d8c904fe861ee5a
SSDEEP 24576:RlYJeXm5jUuErUPXlDSRS6/IHMaY5QNg5G:RlYJeXmRUuErUvlDSRSQIHMaYDG
TLSH
T19B55125D36AD21E5D63FC2BA85B54588E331B079175137EF10F0C1798F2AAE12E3AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 7ea5152553107870bca6a4ff41a049108ef12bb71e41c47a4de404243dc6eb3b
MD5 288c257d8eb2a242bb4df15fa00db862
SHA1 bd11becd655eb614fbecfec91f8ceb47b18c6221
SHA512 18b6c29a55266c59871f8ef081add023764599f9d7850da50126a8855f489e553e71b5e9bb9631c3e404e401a5c19d5bff66539c7c0fab777e37a99f511dd59e
SSDEEP 12288:lOu6kyeI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:lDtyeUPXlDSRS6/IHMaY5QNg5G
TLSH
T1DE551249339952D5DABA83B9D97241C4EA347C381F2067CF20E0E63EAF397D06931B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 60b16136d3f067f88e7549bd3dda4ddbc1ff66288405989e10b2b3c4fbe95f4e
MD5 d83ec374aea12e6735519b6913eb9429
SHA1 f3a6a57e82ea52818150cca9bda5c88d5a0275c4
SHA512 7e4778a66597ee3cba0393872bddc003957ad9f2c3fe85c00db45ccdf9e63d390fe193e2793213a064e2d2aa2421e8bc8e7c41fda453001e32dd0e4edc73023f
SSDEEP 12288:IP7I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:Y7UPXlDSRS6/IHMaY5QNg5G
TLSH
T1B745225E236A53D6CF3A83F6843811C8E124397D2A6439DF20F0E579DB7C6D16623BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 90ae71f94e62a348cabc25d26f33ad0f21e1f197f03211197ffe8f457d2e819e
MD5 082fa945d1a7a19e91ebb1193fbf25cf
SHA1 76fe369671ecf5217c6d162d4837607d4dd2ddaa
SHA512 d6dce96417ce570a7c3c2b2a1ccb1a10e28aa33379204cd879ee857cb67dae64fcecf12b8b812eb0881267d3f8942139115f33feb0861719e178c907b4d14e10
SSDEEP 24576:gC+TyQIu93VAumZr7jmsUPXlDSRS6/IHMaY5QNg5G:g/TfIq+YsUvlDSRSQIHMaYDG
TLSH
T185558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 519ea057dc18577a868f0457b93a75aa8b5be31ebf5288910a915e267853437b
MD5 b6f3b0598bbe86b9f5eddfc83471490b
SHA1 aa418f4ca9370ff3e039553931d9dbb5b4bca46a
SHA512 c3422fa47c1bdc481fe1bef93e697a9e7880e6aa155d089bd680cdc9670cfd0cdf71eff2c014000b96b57d73c2ef2f51f458c33a487b523737f670671f7dfe3c
SSDEEP 12288:JcyrWOstaa3kcsvI/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:MLQikZvUPXlDSRS6/IHMaY5QNg5G
TLSH
T1F865F00F73AE00A6D5ABC27C88954145F6737439172267CF01E0C7794BAB6E6BE38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a4b3db087f454635af38029dfea3c87a254ecb314ee3ac82b7d32cf0ae2d2b0d
MD5 1fb199ac0e83fe8b9ac10da7b7b6ef71
SHA1 ed2414afa61b7af7d47b0e07eac199abdbc4956d
SHA512 76c35e52a7a61077c8f5bdd3b7cc17f9b6129133bfa60604bbe287edb048f1cb7bf6b7b6707c9db1bce03d2eaea64228b532617703f8f2d22be6b4bd9c9cbf35
SSDEEP 49152:OpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPeUvlDSRSQW:7pC7b4+80GTkuv9lYD
TLSH
T15BA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB00B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2b18a65bb9417422def877bde7a83bdc2cab140dee23807d6df23d78ae5779c4
MD5 a88670872777481fb69f47e3601ee5c1
SHA1 dc4370af23a399591fc7fff97876e3bee1f7475a
SHA512 2a9d8a2c4bee076f927705feecbc1412c17694c1115163ad309122352f02f2f373ffc7d5489031b023bf1bfac3a377e77e2931a2bf914e398b9bb31eb692b977
SSDEEP 24576:iSAwJPE1IDAo+4Kt+l4413AUQGUPXlDSRS6/IHMaY5QNg5G:iqPCIo4Kol4KQGUvlDSRSQIHMaYDG
TLSH
T18A55B02AA7F946E5E17AC7B4D663C601FB727822133163CF5290817E0F169E85E3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 10e61e78ec8f82902a905511165deff52b6358670af7e52863fea184e24cda06
MD5 b02408294afdd12f7017e7dd10f7941c
SHA1 250bc6a7b6ed97c9642bd2b9c2509bdaa6408d37
SHA512 232ab03078f371203876ba5049f5707a9b23cfe5cb0ead862666a68724a538472a07c2272eb9baab5fd62119a905fb6fa60e8649377a0d9c67fc1bae51ed7720
SSDEEP 24576:LyLXPLc694t2UPXlDSRS6/IHMaY5QNg5G:Ly7Pott2UvlDSRSQIHMaYDG
TLSH
T19A75E03EE76D05E5E57AC27CC6A38506F67238AD033166CB15E090791F6BFE0693AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 29658dcce7453c8cdabc9955a7a59213ad7ae4e1f69697793fff9525d2110320
MD5 5ea17eb8ffb047b80a4c7e89bf54ac61
SHA1 b13cb6e5f5e313be187b8bda6e970419b9a1acd9
SHA512 defe3a1f5dc748a34d8c41fd03c4085366bd7ba00aec54b3830eb87a40e61dce7a30c2f5b6cb9b8840988a1c6d9c84e8f42644eb8240690d744c04a555731a3d
SSDEEP 12288:c9lyvj3IkxjbBz/I/S7dkXprDp8RSuIO/Ivel4ecBM+7jY5eZz08jg57KS:cWv8qjp/UPXlDSRS6/IHMaY5QNg5G
TLSH
T14465124E23A825D5E93A83B4D5358198D0717C7A17747EEF30E4E57A8B38AC0963BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/388-372-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/388-116-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/484-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/484-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/484-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/484-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/932-373-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/932-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1188-105-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/1188-100-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/1188-165-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1188-109-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1772-191-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1772-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-223-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1772-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1772-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1772-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1772-207-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1900-306-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1900-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1900-121-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1900-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2440-70-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/2440-151-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/2608-67-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2608-65-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2608-54-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2608-60-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2608-63-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2716-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2716-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2940-398-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-388-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-383-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-381-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-380-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-382-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-387-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-386-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-385-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-391-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-395-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-394-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-393-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-397-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-401-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-400-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-404-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-411-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-410-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-413-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-417-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-418-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-416-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-415-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-414-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-412-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-409-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-408-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-407-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-406-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-405-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-403-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-402-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-399-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-384-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-396-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-392-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-390-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/2940-389-0x0000016B228D0000-0x0000016B228E0000-memory.dmp

Download

memory/3392-170-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3392-112-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3896-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3896-72-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3972-142-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3972-135-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3972-358-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3972-143-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4168-84-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4168-157-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4168-75-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4168-81-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4184-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4184-93-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4184-86-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4184-87-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4240-24-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4240-26-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4240-16-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4400-162-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4400-374-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4408-12-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4408-99-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4588-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4588-375-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4660-376-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/4660-171-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5316-148-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/5316-371-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/5508-119-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5508-243-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5840-31-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5840-37-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5840-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5840-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5904-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5904-69-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5904-8-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5904-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download