80105fcce213af7c09255acb4b367e0b1ff5fd3a5efa7f7138bc54ad4e0a1c6a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Size 2.3MB
Sample260504-velt4afy51
SHA256 80105fcce213af7c09255acb4b367e0b1ff5fd3a5efa7f7138bc54ad4e0a1c6a
MD5 1148dacd94ddfee400d5b7c4a4ed9c41
SHA1 a567297bf0a19a3d34062c2113b63320155e9f3d
SHA512 ddd0756069a4989123b1a137dddfeb3e713c5922721ca36128727a178ab702cc98090828133229750525d37217b67cb9cd87159bb12d5e22e19b3eb072f88050
SSDEEP 49152:7fYP1JsEDkSR7Xgo4TiRPnLWvJPYPKEnSG:zYPBR7Xn4TiRCvJPYPKES
TLSH
T145B5F10676D045E4D077F239DA5B8B56EA7238065BE0A72F03A8565B1F37360BF2A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3456	alg.exe
376	DiagnosticsHub.StandardCollector.Service.exe
1744	fxssvc.exe
1984	elevation_service.exe
1324	elevation_service.exe
4188	maintenanceservice.exe
4460	msdtc.exe
3280	OSE.EXE
956	PerceptionSimulationService.exe
1624	perfhost.exe
4524	locator.exe
4692	SensorDataService.exe
3332	snmptrap.exe
4060	spectrum.exe
4756	ssh-agent.exe
1396	TieringEngineService.exe
3980	AgentService.exe
4428	vds.exe
2472	vssvc.exe
3284	wbengine.exe
4032	WmiApSrv.exe
1708	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e88214a4cd1bad80.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007aec11b2e6dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6c067b2e6dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef97bdb2e6dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005922f1abe6dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018876cb2e6dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058bea5b2e6dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016743ab2e6dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
376	DiagnosticsHub.StandardCollector.Service.exe
376	DiagnosticsHub.StandardCollector.Service.exe
376	DiagnosticsHub.StandardCollector.Service.exe
376	DiagnosticsHub.StandardCollector.Service.exe
376	DiagnosticsHub.StandardCollector.Service.exe
376	DiagnosticsHub.StandardCollector.Service.exe
376	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	1744	fxssvc.exe
Token: SeRestorePrivilege	1396	TieringEngineService.exe
Token: SeManageVolumePrivilege	1396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3980	AgentService.exe
Token: SeBackupPrivilege	2472	vssvc.exe
Token: SeRestorePrivilege	2472	vssvc.exe
Token: SeAuditPrivilege	2472	vssvc.exe
Token: SeBackupPrivilege	3284	wbengine.exe
Token: SeRestorePrivilege	3284	wbengine.exe
Token: SeSecurityPrivilege	3284	wbengine.exe
Token: 33	1708	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1708	SearchIndexer.exe
Token: SeDebugPrivilege	2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2956	2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	376	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 760	1708	SearchIndexer.exe	105
PID 1708 wrote to memory of 4760	1708	SearchIndexer.exe	106
PID 1708 wrote to memory of 916	1708	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_1148dacd94ddfee400d5b7c4a4ed9c41_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3456

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2184

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4188

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4460

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3332

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:760
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2832 2844 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2860 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 25111972a082272d7b54fe56a1fe495f093688edb6e8397aeebeba9d650041d2
MD5 58028b903b08a726ee63631b1b2528b8
SHA1 508ad05f36467ddeab82ba0a387f454d4e3aac31
SHA512 8c1ba0af555b79a53cbf3c1065d3609248729306408389a43dbe6985f9d86adfb9447eebb18506f6e03eacb4cfc094f818de7a46d1d6b31426e56a848fd7a640
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWYPKEnSG:Z3q6HjB3YPKES
TLSH
T1F8D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6d8b643f1e4e826a8dd287a06d91d6d96b63e180c7f1a92766996a1e7eb670cc
MD5 6882a48a7cfab5df52814f66f43813c3
SHA1 1016ef3efc329a36182c5ce6ecc0d2df028f8fa9
SHA512 3b1217ed867de890a6e8d47c3344be6b45fa5078f4bd1532f5ed5b66399b842b02cc28c2112a105ae4eb6301a884723d5db310b50175919df9867a0bab087dbd
SSDEEP 12288:D1XLsswWkxy2lRq2czAI45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkv:ZXYfDtczAjYz7KEMdX6keYnAcerC
TLSH
T15F85012867E508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 1ab7b288c1ca04af29b6f63d69f82de521aebeeea3f0e69ce8e933f231dfbc12
MD5 6b31b5872fe665ebf7b0ca8b43f09d43
SHA1 3615762368e3ed04a9097d620975047aa408ec3d
SHA512 6b942ea46f4eeedbcff00585cdc97773c6c03d436d2c763208221e9352b3244b0d73c5a391b88ed8a4b6a7cd1dd819e66224ebde2268064697dbd3bc70443349
SSDEEP 24576:c0Le5ji0hmx3rMuYz7KEMdX6keYnAcerM:cPji0AZ9YPKEnSG
TLSH
T186A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c560f6f5631e76fe87347584d97086123c78b8314130452fd811467185cfff14
MD5 d47ba51395600f7ca70887fc2f7288f5
SHA1 b6987183d181eb3a00da9df75875d6beba41279b
SHA512 5ad4fd642a87db38062935fe739ebb7ac20e0778f33b1666980f961f9450f55567e8ff00e693560ab8308d1404291d784f1c0f4d6f4a7d3d721eda397e66e506
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuEYz7KEMdX6keYnAcerh:R/ezSC6vUzPvxHjyZYPKEnSG
TLSH
T1FF756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a9981c0137b5539d5e3994e91f5085d80ef252c1c1c2fe382289a373bfb70fc8
MD5 5ac76c6b916b4f14b4be0b176af0f7cd
SHA1 ff9834ef5a235dee2b4f732c96f22b22c87cf9bb
SHA512 a07723685564e54bde707943f6c8d0ac21784b7444dc7075154367eca3decea165bdbecf5808a015da1bfd83c410b3830e33eaab8141c8db6f8f552b8c379e93
SSDEEP 24576:hVbqPb88hv/l+6nYz7KEMdX6keYnAcerM:hVO88hXl+qYPKEnSG
TLSH
T192559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 d3435d5304a9589e4052a9c833506be7dcc00c29eba41fc689c4d822ba5ef4db
MD5 18fab7526e5b29ea1e3ecd02a1d0fa71
SHA1 5037ce0c86b040329be6795d76b661e05839c244
SHA512 018a92a59d1abfd811042919941e2c332e5347fee5ad521ffb11fd6a55476d791da26b3c060d7a47884ee1d6add8c3d11cb70e842e8d24078af90bf130ffb860
SSDEEP 12288:EXt45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:EXyYz7KEMdX6keYnAcerS
TLSH
T17F6523048B1A99D2F85F067BFFF5894089375DC62E8C9761C94CFA4293BE222C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2be0565a4056dcd044aac16b80aac3b8ac849ec542daf24656b804788b245bc7
MD5 79401d23fd3059bdb54a9f7ccd1585d4
SHA1 0ae9af43c6540ff89fdddc421f5acbc948184506
SHA512 55e8baa374b46070521af50995801e36065e504f34c3982cfd0295bfcfb28330b43ffd5fb3cc452c2d1acfff8f1db6a58f818c5e86b8c9615cd70d1133c7f087
SSDEEP 12288:2eBNUbTVO86U845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:2JIU/Yz7KEMdX6keYnAcerZ
TLSH
T13985CF3BEE28FCD2C27E8DB96B918600D77278704B51A3CBD164820EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 285a206c97f91382864017f5309619cd59fc8e67618436960276641830d0d945
MD5 880d6f50e6626af9f7e131f07ebdd561
SHA1 98e0d4886303d959d4a82895e8370dd34d40bec2
SHA512 3bff72477cf9e5a1c9c3d8e3ae4745cc23dc70219768b1f984b4f708f5e37ea80259074b2bf56eb288f92c3e79ded03ab1a5544bd2682a9907c1a1228886ce6e
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:KQvGAdlCEL8c/yRNw5C0YPKES
TLSH
T1C4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 29cc626a30b8656e1b0389a12267671e1d3f2329edf377c285168c5fa8df7680
MD5 15808e453dc3f7a08f3397d6acdfba28
SHA1 f96b69cef149eadcea660591bc222350c4af29c9
SHA512 25e5278c939597ec4ba4529fe0da4d109a76b1df3eef60ec3e641514d2f9b62452cdf585012fe712d5e95edfcd1145315992a61957f42092c398750c8c31416e
SSDEEP 12288:yAwSfxL/2Dc3BDLLmt0LDQewsAje45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:3kewsAjtYz7KEMdX6keYnAcerT
TLSH
T1F195E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 59674bbbd4a3fada0fe5f794f3f957a9b97d55b35563eb24fad3af9e1d6fa65b
MD5 c7c2489033c997a4cee86c5e51eb70cb
SHA1 5bdde0a1b92f773d2537073a573d24fe3bc234e9
SHA512 73ca18e3f6a91b2330f831103a74c6a84faccaea76126a91bf0fd6723331f0ebd44c85b14323c8f2619dfe1a1743142ffd8a5f9bcf4c63dba24c5913dd5d5753
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1cKZ:qUEtQevvqc2W1cpV2EI321n
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9197ee335eb28deece9f8780191c9b4c17cbc9ffdfeadf5d575d24e43824a9db
MD5 20fd0503276f185a477e34be810ee6c8
SHA1 c31618133c5d40c1fdab15073f296e34d96547e9
SHA512 7434f7888a12203054505ea1482f9450582caa8b8d932ab45a22f9c9ff9aab1d33211cd07d88633e788eca43cd9f13e88cca95c664ce480b8a9b806335c2609e
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zNYPKEnSG:KoqtVjnmgYPKES
TLSH
T14DD58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 24bbb3c765d519ac92729cca4260f5439ff0eebf96c3d714881bee0a9ac2fc62
MD5 4400506dcc9a94f0e47d81c93b4a6199
SHA1 f054bd0dea475a08f343371c722509f98fc67045
SHA512 05a3277e548e92b161e4b26d94c1fdaaaf8ef194458ab5ff5b32ed921c90c7c49b4988e2bc735f51f4e10efaea135d7ce529b35725c06be8a02f1def4c48c198
SSDEEP 24576:eAhGLJIFoiwtA5l7S53AYz7KEMdX6keYnAcerY:eAMyFoiq5QYPKEnSG
TLSH
T150359D80EBF955D4F5B3AA78A9B68570EA76BCA65E31C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 88d8e7dc6b4a2b7014766dd1d9e836bb68b0746779def8e5c185e8d9cd554a0a
MD5 ef3d6ebb1c18be8d0ae8fad9ee4d6210
SHA1 15ae523a1a6f447a455d81651b1bc62aec144f7b
SHA512 188d887de02d41823f0eedffe930d72f56b89490d324ffb50adbfbd71185d6108ff899b54f87dbaae610ff41665d5df8cd187db627de7a5286ffcef52cdf75d2
SSDEEP 12288:Xmw5HEjsChNzBFgl0WDm+C745Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:2wuSOW5Yz7KEMdX6keYnAcerc
TLSH
T12E85F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4fea1a47bfd9aff2d2fc72ed8de8646b773e1bb24b54fc4b4daf4b8ea07e8e95
MD5 c724192f21b091cb4cacb1d4ec7af7dc
SHA1 fa98d09d9cb1b43a375e756f00d08d8f23d6887f
SHA512 635ae9635ca765995517c78ba9690685cbb3d05e4bb5e41918beca26c755072a5cfea664e6517cf7f70dad4913b80fa899dafffa30c2f42542c86a41557c89af
SSDEEP 12288:9jZ1IyO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkP:5ZuGYz7KEMdX6keYnAcer6
TLSH
T1FD75124927A821F2F0A7423EEEF14601D7727893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e568c5ec00f2c8782867e0d0fc63f99007959c7758b9325e6916a3cf763ec109
MD5 62fcc14fd87d05a5d058397abf196e35
SHA1 28a2ae4efba72b856c212dc2b717d9f50c2c9a7b
SHA512 744b66f3162dfd7df5bb0a94e1e6b949cd9b65f553f914ebbbf1fe04fb2fcf084523036cefc3049e906694ca041b1e4792cfc42a2624af884a9dfe28f4d5a154
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:KQRQyi36YOcPQLvw2gAf+PN37YPKES
TLSH
T112667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 31c2fe6d3df7c8887438cdce300c3bb94fd5723468df7ba21f6c39bcc895f6ed
MD5 d28a38dbe02f0074116d0ea3f2330ce8
SHA1 4bc43b16abdd6da6387697578b7ad8efe9bbaa59
SHA512 3ee5b64f7f34b0129cd2bbc98c3e26d39ffaf2ec59b7041b9645c97fd190a2ee1872740175bb328a1c5d1509bff725e3ea9930335f662e75e863c5093b65e617
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:bQRQyi36YOcPQLvw2gAf+PN37YPKES
TLSH
T16D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d9dc4c12df3ac4579021e562ed4bee27edc12dc9201e4d3369d523c04d56c072
MD5 c4a9d763a36c6b601f80c9badd8e7dee
SHA1 ba6ac52a63b5af9cec8da42eea4664e6bd901e07
SHA512 0921ba283d8843095a1551aa04f2a69b919e578a1d07cee3f7b68eead95f3e05d1ab646a201e3111c499d85a924afb795fa7447fd207d0651fec6d0c25e18a80
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WYz7KEMdX6keYnQ:368Qg55nhheWu7PNU3/9YPKEnSG
TLSH
T1F7B55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 71eb8ab7e8bc7f60316a724c9c4b0a848d9d0abe97c4eefcd415d0d9b35af52d
MD5 d4227bb838cd7608d53e390bcdc42d44
SHA1 0443f5f20bad9ed5d369053be8f28efd8bac0ec7
SHA512 52eeac627c974ba25e0d5cc876825a880b7a17cd9b4acc129ec6aa77652c12519138afb6084664a5573a3274297b0ee67ea015474fab5df14ec3ec75f994a024
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:zy5112gYy5azzVvL69nLKnhZyYPKES
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a138929c6c719dc24dce313009aec432e8aeb42e1499564502325c90fe5764e6
MD5 6723fcc7703b697f52e202974b345f8e
SHA1 d5097e9945c4938fcfb69bbb1ba72e13f5bcb88a
SHA512 02c265f4ea626296a1c8884231bfdca1a412eb11c22ea587a73c7ed181c2a8a0c450d7a6953e1d1186d2eb647bdfc6a758b4285c35b53ea7d681d512011063f0
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzYPKEnSG:9u6JmVxd2dzYPKES
TLSH
T1D9D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 460bf99ebeb546204e66d21b70c8fbf9dbf2a79339cdd95bb0ba0661dab08114
MD5 1aa9f6e33126468ccc3f16af9e2443ce
SHA1 e1fced83efd93411116adc81f76f31ec3b0b3170
SHA512 5978a35302c3a1b8897ff5df82c155df3a497835e8f487cddf8497fd979eb7d14521bff2fc6f443738eaf55ff678777b1ae98061b471f03fdf400af27cb5b04b
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xfYPKEnSG:XmifPbRgYPKES
TLSH
T149B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b2f5229c6e20831c819d9f6f03c118c8a36343e1ce91aa7d9d2129bd83988cf4
MD5 24e5f5c12e249fa1ca3ffce134273125
SHA1 cc63bd820b528ce80cb0db4b0c8da31891c2b2d3
SHA512 47c824a471f925afb08d159f937f0730c6799ca4b3c9460817af2cfd00a60a8f75e95f9ef48e8e55a55bcfe4cbd2be4462a813d312e8e27cf3d9aef821d9d393
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqGYPKEnSG:G5dKTi61GYPKES
TLSH
T138C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d8a7842c707e7610a3ab6c93df45ff8c062c8c12e5de4bc0536ba03fbd77588
MD5 affc6eec962a5ac2bc1c4a953045db16
SHA1 a8d68780bcde6eec0b81bdb9884125fe9b4d1ee5
SHA512 6a467361a7d34b0439a09d3c2a3c682f81021955e9de7eb725bb5d359aae80096c95e3a022a379eecdbca6aa78c4d570de6701bdd1cf0357a957c4a45c85ad71
SSDEEP 49152:chtSn8EApI0figngiDn0AP5wjYPKEnSG:dX2iyph8YPKES
TLSH
T1E495BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 349c462a5d740ecf81809accf7b42d103cb060e008c8dfb5ad0097d3777c1fa9
MD5 f17ef2b25988553ca7d1486a862891de
SHA1 de732179f95353f2f99f4f135dec0751f5b1959f
SHA512 2fbdbc39282fffe21ac00654fd9913237491d37bf8685edf6f2cc3e4f4d10a4b78744a8d232aac74d0947ca95dcbe81a91281a3536a481de6f539d9c4898beca
SSDEEP 12288:lF45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkY:lqYz7KEMdX6keYnAcerN
TLSH
T1B76523048E5B8AD2F84A467BFBB14540C93A2ECB3B8C53A1DE4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 8e11132bde686e2aaf27ab85d059f10f879057d143516e3e93823391f808b778
MD5 71a7424e830aa9469ff8b92cad2e03fe
SHA1 156482c01ed5fb8c5ab1fb317cc74735b656df29
SHA512 4cd306471507e29d05d537afc0ddba769b38a977e972b142a7b8f23f7a0ab50c265374524eb86285964cdebaeb598ede5bbcdaf1ec302bd163b60433131fe143
SSDEEP 12288:i645Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:iBYz7KEMdX6keYnAcerG
TLSH
T1706523048E1B8AD2F84A467BFBB14540C93A6ECB3B8C93A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 2af01cfdb87f1cc9289c1f4ac4e9b54276392b390c62aa210b521bf5280a306b
MD5 5ca32bb7dbec44c7b70ef94fb36d0893
SHA1 46ece11416a7eadcdacda9ea5b1e4bb1b99131bf
SHA512 61e72c2b5e21177953eb9ba04259df90ea34ebad92038601434e47080db330e91818845fc977b361abe8dab46ea3ebf3d396d050f5aa5c9bb29c9a2ad04210b3
SSDEEP 12288:R045Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:R3Yz7KEMdX6keYnAcerG
TLSH
T1406523048E1B8AD2F84A467BFBA14540C93A6ECB3B8C93A5DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0cc9ceb16a915c2e5d3952577d6c62bbe17f37384a95b2a91d41f1e31791f6b2
MD5 e53e3785f38b94569f660bb3919b5de2
SHA1 bac4504a4f7cf8188e1dfa75f2998d8a21a6d7e9
SHA512 83cfba2cf0c6c907b750477762c4e744b345ce223d16549b915e940234d3177034a72813009abb6b68bce4086606663224eb4496e015edfae0e5347bf45c7e6e
SSDEEP 12288:6VP45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkQ:BYz7KEMdX6keYnAcer9
TLSH
T1067523044B5B45C2F85AC27BFEB18500D6767DC73B6893EFCE08A5424BBE3615824B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1bed9f34d952d315fea3aac4b505967329cf3fe830bfd4b0fb1ad064a1d33623
MD5 e1c740b74a128df9ff324e56d317b10a
SHA1 d15206c4b01fae5541551848a74b72fb80e32184
SHA512 49d7fb58574dbe01100435e317e4f1894e0469d631be29859a585d6af22fdc70998ecee08b1bef996dcee73f08900e3296683ce94221bef594bee9656e56c452
SSDEEP 12288:J345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:JIYz7KEMdX6keYnAcerk
TLSH
T17A6523048D1B8AD2F84A467BFBA14540C93A6ECB3B8C93A5DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 a7504bc9e721dc250c99edafbec6ada4ee36405ee1e265edf55854d7ff06056e
MD5 dd0331c8be40a3b18c1006bffca6e50f
SHA1 73a73c385a6b40fe5b9a2922258db9ac93699fb6
SHA512 a2e5255663349ed991002aa086a6a175d4693dba1067e6eb4573340a7b11b2c362f9d745eab7c6ed4705d34e9909316beee6c4bdfdf9889a72a302be12f77a3d
SSDEEP 12288:OW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:OlYz7KEMdX6keYnAcerD
TLSH
T1C26523048E1B8AD2F84A467BFBB14540C93A6ECB3B8C93A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 4d48c74021ff3afb4149e47b094ba6f4f2c4981bf43131d87e73cf7807f20277
MD5 5be9b5b54ad1e51bb48fd146b00b841f
SHA1 510b579a04c0be49635bbd737737380599fb9200
SHA512 0c5d93430fd75e3b71b013d860b276d432340902810e334c2dbe116fbbfba5e75af1d59a4ac6d169f4573b58cb330d50437aab6d1dc18b3fecea5de231fa0a79
SSDEEP 12288:eC45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkW:eJYz7KEMdX6keYnAcerL
TLSH
T1766523048D5B8AD2F84A427BFBA04540C93A6ECB3F8C93A5DD4DF54293FE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 28d96bf709a5ae3fb241b41056ba018e7bc825d043a10f4588c2db82d030f4cf
MD5 abf337e2de0f5cfff6b6bbba22414fd4
SHA1 5a1cf97d87dcb87e75623208bdec84b771e820ef
SHA512 6de124954ca4143844c6a6019af4114830e9d2341103a23412ca3db38f919fc9f6c676eb036d30a5542b37558612664d9ee65c0b5964152aad455511a9d9192c
SSDEEP 12288:iiZwbHzzFEoS2cPvya45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:FZMTzFVSOhYz7KEMdX6keYnAcerJ
TLSH
T136850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 bbca06adc0fcabdd97dd91f51c5e7772186c4b0f040617f4db992974210a7621
MD5 51069f6ef8c19f2c77779ccd5fa29877
SHA1 49cf5eb5c5292a74cebe21560aafcbc417f639ab
SHA512 98316982cd3d3e003c27df45ba730c80f6da379f6e7e253d2c0138af36950dfe3896bfe319b7c64ab183bb1e5dfb078bbcdd474e7ed551e39c641692416c9aee
SSDEEP 12288:Ep45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:E2Yz7KEMdX6keYnAceri
TLSH
T1F96523048D1B8AD2F84A467BFBA14540C93A6ECB3B8C93A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 c0c6edd1cfd1408798ffc15718672cfe9352cbd57a04a0106131c0fa99a0d182
MD5 488ed75f6c50806d1c29edb234fbcca7
SHA1 db70dcbdcba60c1ae7c569d6d90be7af07985a4b
SHA512 fa3b2dab5d334ab6b7c5f90ac683fab30bb6da4f7831054118cff779a393488f44fee1c4442452fe51a3fcbbf7cb851f27140c513abc9c551fe5de6520f74848
SSDEEP 12288:fd45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:fiYz7KEMdX6keYnAceri
TLSH
T1576523048D5B8AD2F84A427BFBA14540C93A6ECB3B8C93E5DD4DF50293FE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3d60d80cfb8faadcc049a1b5de758e0c0e112986d2ad4db810dbede7e4d0471a
MD5 421e24fd739009f14f969939727133d5
SHA1 48e1f149f5f85a6c1d076a9b18fd119f7587aa79
SHA512 0d218b75f824ed00c8887d3e5d631aed7a2bf28dcf77071958db61d8ab3f2f014bfa11642b3e258a53fd90b6c8f578a2266ba3ba3de71c5a99f77ce699eb4bc5
SSDEEP 12288:5yPz5L8O45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:4zydYz7KEMdX6keYnAcerV
TLSH
T1CF75120767A630F5E0678239D9A10A01F77278761B248BAF575447732F3B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 90bc3e01e17d554778911d4802cad651cac1ecdfcc6f95be9ff92c062a90bd20
MD5 e76d7165fd29f0fb2a11d43f296c6910
SHA1 5ec11053b7234d2b9a72a3d47b8442f6a712140a
SHA512 eb64b272edb922db50140a1dca12a746372f939889745140eaf8cdb10c1649c4d24d458dd80f30bed663c92fa3a923968432903649b9907106f49784142900bd
SSDEEP 12288:Np45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkU:N2Yz7KEMdX6keYnAcer1
TLSH
T1F36523088D1B8AD2F84A467BFBA14540C93A6ECB3B8C93E5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 00a75ec3bdd7a645b20f603e76cb50ab5514ddec812d74970cd2f273506e20b8
MD5 75143c2923b5a952f8ba15dd2eff8b83
SHA1 602db3ab2d9a2b26d25acc6d7100f1459683503c
SHA512 4e43415ca603fa013803a254e983c60d78c0fdc1b9c72ec69987c33d92e7ddd69ba12632c239cbf6e9865d1fefeeaaad69b6badde27b0d7f154ab6ae3a65747b
SSDEEP 12288:9p45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:92Yz7KEMdX6keYnAcery
TLSH
T1CE6523048E1B8AD2F84A467BFBA14540C93A6ECB3B8C93E5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bf4ebb1c71b789ce667f01b27fb1fa2217cfde7c2ff0c8a1e6005ee5fa183685
MD5 d52c342115b8ae80132d379a36ab863b
SHA1 b7881b008fb679371e849f823aa316b5375cf3ee
SHA512 332b5694cc5a51345661aa372a7e6884b23c4a1816a49ebf99058d8c73bab596a5fd013ff4536d11e9a2e53be708604b024b7644a97a30303b6ab449671a5715
SSDEEP 24576:UCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvALYz7KEMdX6keYnAcerC:UCUxPTY+8Wg2lIL8lrIUJLWwIYPKEnSG
TLSH
T16F65BE1DA3DC0896D4BB81358A518A06EB32782E1B32D6CF2160C37D6F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e3b3da2624f0f4a78cdbcb41d59f95a2238c0b476409692ae2d9b332f26b3915
MD5 45b50139248f85b1458743231e278461
SHA1 fc618ad4b28023b30e48d233a0bfc2f205383505
SHA512 aac3abc8ab7c5eee4bdf6316225ca6246f3aa1730a05e579bdba68a0aed1b669599d497753741a4c200064fdb4e1f439387484c2026d08534aab5f19366d600f
SSDEEP 12288:Tzsf545Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRka:uGYz7KEMdX6keYnAcerz
TLSH
T1C8750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9a268dc57e7c933207eb04e28ccad0bb99e5a74aca5e60b675b3e1eaf3867f77
MD5 c48b0fc3aa060d666f7952b4142d458c
SHA1 28b085f511431cfe93fe128b9a5c550dc61b3480
SHA512 32a3b9203d1519995d06039cde9a509f31f80cb6bec60d88c6bca9f1039008741ec9f464537dfa43587f6a6f46fa320fe2381a60761620ef1f9d26b99126dce3
SSDEEP 12288:+U45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:+XYz7KEMdX6keYnAcer9
TLSH
T1367523048B5E89C2F86E4777BAB58520953E7DCA2F4882D3E80CB242937E6E14D3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ea37889e8f52247d2cd12697f01ee43a9d3a82ecf81974c72fbbebb1d22db6e3
MD5 731d8ae789fcd7923fcc791520b6625c
SHA1 d858f9c92a5e37fefc7d1361e83bdbac363de1fb
SHA512 f72522a910c2ec89551b257b4b86910675e5d12da0b0c0b30c19e667ae84597abf4645136285c68198465948c797104bc8bd718d9fb3e9cdb3b69e9d26471561
SSDEEP 24576:Z8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCNYz7KEMdX6keYnAcerZ:GRZwQCyiHiQEaaPnMOYPKEnSG
TLSH
T12785AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 155cf8a1f379cb0ad188f23e6e714f83978c0ed054ca3d6155718229c0fddbab
MD5 433f3eed379f7ad8850251571087d346
SHA1 ad8a89e39a7bed995dd266d5275cbd7fbed2cac8
SHA512 2ad6eebc89d034a82ad3185c2d2f5fd37bf28d80e67e340a1036b95921863494ed2c6c02e4ce8cfe5d3ef16ca91e1b746ef2db425ead0b2786aa0578a44539b2
SSDEEP 12288:DbxA1U7KE45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:DbxA1UGHYz7KEMdX6keYnAcera
TLSH
T19675122E56AD18E1F47A923EEAE18101C3327C56272493EF5484C27A4F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6d1fbf456abeddd6200896950348a6d23617c3af0cfa7bb406c61278958859c8
MD5 3284066faf8137268010084a8c5d18ba
SHA1 2a3d06a193091997ad5108c79cc023d3b7df05d7
SHA512 336ad9f4846848a5a28108705b8322f6a99896eef3c136a1de512bfb4f08a9bab184f1d3a6dda2c901fc3622e29a5b4b58f24cb402a8b266a526ba9e3d4135e1
SSDEEP 24576:XjsmP0yHaqrVqHra44KDzMsrnQYz7KEMdX6keYnAcerO:XjRP0yHfVqzlAsrnQYPKEnSG
TLSH
T19945AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 e50b4b5d6396cb732d7bdc06c27fc71fddd16dd6391fb37b138a88f7b9ce0380
MD5 3d6801d12823c6b1576cd3d9f7f2feec
SHA1 c62ae53944e2f15acf280fbb25023d70dcdd5f84
SHA512 019ecd1313272ea9434251745f959bdf964197ddd8249fc90aa0e5cdad6704f3d9252c97a5261fc61b596690d95024341e227db7d330e9a1453c76897d9bd872
SSDEEP 12288:m245Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:mFYz7KEMdX6keYnAcerq
TLSH
T1C67523088A0B8AC2F85A467BFBA5450085366EC63B5C53E3DC4CF54293BE6F3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 55bf183a79744f8bb1d7afa622d0dd0305b18224b17d606a2e68ec31aa9a0c8e
MD5 816f3ba72ab50043764296dea8a6e8ec
SHA1 465d43963f482d1cb63b4356a30285afc53c08fa
SHA512 ef03aaad94fea9a5a3c2abf89ddf04e89d9abfbd84d63c82345ba2930ce5553af9981046b4d7b9bf68348628d2b75b1842351934c1cb427db279a55eed2e9f2f
SSDEEP 12288:5ObMA4LWO+vAYFTI45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:uMLBUTjYz7KEMdX6keYnAcero
TLSH
T14C950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 cba592f1c1679798a109919e5d3fe5630773e0f83f97a0f1a5ac95ca6b8d9b47
MD5 96b8d9c891358928363a806d270b44ea
SHA1 9db5bccdbe57586ae5cfaa9c73662a197f6a5fe8
SHA512 b63daf0875a4cb9435aa8156e0679d608ee0e516bd4511846bdf55d06ee71b1b0e130e1f2962af40956d6352f46f5bc7b002dc37fe727e743f600612fd2c136b
SSDEEP 12288:070VmKIYNvUyBpV45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRks:BGYNHsYz7KEMdX6keYnAcerJ
TLSH
T16F85F11E52AD0CE1E57B917ECAC28209F2737896171193DF05A0C27A1F27EE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4405f136b9dbd28438a2c8e75efdb96d9c15e5f0335ece00bc2294a1dd7973e
MD5 b8b05a5d5247a656cbaffcd924ee1dde
SHA1 d78ec44ff1cca2f927cc10c2fda90a3c8c6d289d
SHA512 93d54576b42f6168e65b3df80f7407281402a3f2dbecb20b0507cdbbe5d01baf98cc6b80f4dc5d588168402aac269bf3e20fe87a0861e7bb61155426738a18df
SSDEEP 24576:bnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKr:bnXoJJYH84VVS6AmEcJas+cHBjSSKHPU
TLSH
T1B165BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e3a6067975e19bf5b48865ef87a381e796ceeed4f1b41ba983710f89c681f172
MD5 cad6073b63e1d9fc02a5a1325359698c
SHA1 4930ca52e7fb69f76fbb29257462c14dc7afd211
SHA512 1486c62de9eb3c32c2e0b639e414fb79e4ca0cfe795aaba457ea3a6a15bce364fcba069b25ff0583e7ff267e7d25d62234dffe6b444541c5a1796aa611052d64
SSDEEP 24576:Kv7Xbxd9Tuycf8M/TYlSuxwr2PCSYz7KEMdX6keYnAcerj:KDLL9TuJ0M/TYW2PlYPKEnSG
TLSH
T1B0858D5EA2EC42D4E47BD6BD85B79046FAB2B895273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 750a97f3a934e0847bb1981e0b3b8ae20ddbaf63c50e0a1979e0c72d3e765a0a
MD5 e82d39408a94aff143e3e87ae4e8c071
SHA1 c8d3b48c3b36df1d93a36abbc9801e0ba6803edd
SHA512 9ab6b50bf19c2511b364070b53f49f7a7eace356fa8bba005c06fd8265f80867bd60ed8af99bb0f001ab924d9d15fa239668494cf01c62c6b73a7ddd176e3367
SSDEEP 24576:vegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wjYz7KEMdX6keYnAcerr:vngOJOmPOHhjYPKEnSG
TLSH
T17B55CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 7747be2520a8aeb1cea5df019ce175a0ce746c636994babce1d438d6d42848cb
MD5 76e52a34dc43827f2c7dbade4a1e56d2
SHA1 d9c064e3b86757bc699fcc36fe14526ab30ad4e6
SHA512 ab2ff80c96051fa815d8f465c74a01c3d3f9f9d45eb6508ee4352429ecfe7058649a67f00dad89f4d1d503f90a14356dfe74c372ad141ad16201b7be37d5984d
SSDEEP 24576:XLJnJiTk3R3waE4JrOlYz7KEMdX6keYnAcerv:XLJnJK8R304lgYPKEnSG
TLSH
T17B85E02CD2A810E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 13ae1ae5f0409c3ad343920ea2ba16587c90f4528756d8e844426def4efdbe6a
MD5 5d8034b3a3146e410b0fe48954473106
SHA1 26cf63ead271ed55cf3b749bf121f101f3c324df
SHA512 4fd12c7b34d0f7aea57d38ee6547bd676b34af9b335b42e9ba7b5d26e986df1690879ab756e2f4a1335e8748200b68ebfe38b17cc799c2539068adb4fb334b94
SSDEEP 24576:MA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p7Yz7KEMdX6keYnAcer1:r9GqCzDScAZmlvTcFg8Ph6JYPKEnSG
TLSH
T1C0955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 0d2189568f0b0c0ee3f13c51e326cc1bca35c5fe9b797543dd7d36efc4b09d34
MD5 ba10c6d04c60df8e68ae44e75bde836b
SHA1 b38f90a5c21b7b06d1b722c632b8bb01f6705aab
SHA512 5881f3d8344d55e86cd471899ae6e6217a504a6a2972602fc80239bd13b11a15d2545b637328818a1ae04933afd922e59c411df09d194b80e133fd4c4981628b
SSDEEP 12288:NlYJeXm5nkEUuE445Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkJ:NlYJeXm5jUuETYz7KEMdX6keYnAcerY
TLSH
T12575120C669D70E1F02E817EEAA14900D372B4A6274553FF85D4D2768F7BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 63eaf371e7f17d059f3472cc2695c048740e6fe004aecab7d38e6de9a9ef633b
MD5 a6384db0469bea5a13e57ebf5504c932
SHA1 10e6679852f796898a1e06169da415154daf8c70
SHA512 bee7756b5c98bc32a26340b238c1bdebc46ff5710f0ae7572ea6c285b3e1d4c7fb190d1629f4dc058337b7bc52da7f67468e5414e894fc8f5e3084deefd2684f
SSDEEP 12288:fCu6kyf45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkf:fHtywYz7KEMdX6keYnAcerm
TLSH
T186751204579555D1F8BA0639EEB28150CE36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 ea714ef7370fe1037df3b3a51dd6553091dd5170f28394eb58853bf72c797a46
MD5 b5665c2f1941275ae981c89781b4373b
SHA1 6adbe569116944d10f7cf6273350a9a11d9516d4
SHA512 512a52f95dd96447411aab389cd1d24df01faac6a10e71dfe8172bdf3af0743dba71b640b4edd46bf2f401dc0929fdabd32448565934eeb06657f6b33362e9f2
SSDEEP 12288:CPI45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:OjYz7KEMdX6keYnAcerZ
TLSH
T1FF75230C461B55D2F80A467BFAB14540C53A7ED63B5862FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 67c4eef3381190f6f0d680e2f735628b58c80b94bee8f5320272dd51e8e9221e
MD5 e03f66d6cf6d45e4655d216d4dc98e66
SHA1 2b5ff02a28694f997caba2d81cb75970d69c0396
SHA512 12652a8faa095fac663098717717dcadba1759b8ad9b958dede4bda06443f50f2caf7e40f5bb94b154f62919aee180171d1ded65729ea2abc5267f29601f3f21
SSDEEP 24576:uC+TyQIu93VAumZr7jmmYz7KEMdX6keYnAcerZ:u/TfIq+YmYPKEnSG
TLSH
T162558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 b7a4f61a5632149c1f0b40e8bd591ded65c4d1947409f7a521e0e093c6d0996d
MD5 23ae3ab29310560de0155b7276212a57
SHA1 a4bb452872e861fb77d339224512691db1289b56
SHA512 22f1f6d53400734ebd244e53b3b8e68750d58d56d98f4b08ce1e1f238af16d47a1883ac2aaf1f8e34e73b6f702745825e9c74610692419a5ed95d5718d713554
SSDEEP 12288:ucyrWOstaa3kcsM45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:3LQikZPYz7KEMdX6keYnAcerY
TLSH
T18A85F10EB7AF00A1E4ABC23DC8954111F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 48a0577fd4ad940a566bf3cccf6860e4647c65ad08b4b162bba05f5f1d6ba52b
MD5 c0d66a7d244648a1862af2d87f8f0499
SHA1 0589e94ddd30d15013664a835770feb202f4f7dd
SHA512 eb084a13393927967b81f4a7ad7e35d0e127b931d5c4e9910c9917586d79ca60e64e7aabc35144105fc1f91f0ea0725914b8eba9a3909b8f523d1d32b62db1a9
SSDEEP 49152:ppJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPwYPKEnSG:6pC7b4+80GTkxYPKES
TLSH
T155A57D3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0e244199bb5a902fa4a08b0610244933d8103a74fe1f66de0470499cb84cfb76
MD5 8bc6c8ae0c70cab0348d77b5fe7e5858
SHA1 ff36a24a2e5b5465e4aaf47496557e16951fd2d0
SHA512 c66b97b27c6cf0776f6c30b483caa69e6a020abbe783be4079f183b8752d80628c84bb95ccd7bf1904880262bcff90717cb208073840e9606a8d69faac3fd764
SSDEEP 24576:xSAwJPE1IDAo+4Kt+l44135UQoYz7KEMdX6keYnAcerZ:xqPCIo4Kol4/QoYPKEnSG
TLSH
T1FD55AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 aab97dd081a8431ee0fad2e2cc0167952be0a93a1d796f916b21e07480499830
MD5 1986ee8be4edb18689ca158c11bbafe0
SHA1 af6eeca78c33ea1531dc98e72c666f13dfbe6ef6
SHA512 2a7b91e0d28c702896d58da538006ef361592d85749662f49ec06ad2b043f46373a698985f5bcd256889ea4e072693c0ae4787c76239486959d6786b223cce9d
SSDEEP 12288:JSsyLCFBoPLCRyg6NQ4tH45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:JyLXPLcL94tYYz7KEMdX6keYnAcerM
TLSH
T1F095E03ED66D08E0E47AC27DD6A38906F67238AD033166CB19A491751F6BFF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 583f9422cd3f92ccc8ee7768c996d8459758204e7bc37e9a842e52e61be72587
MD5 1ad032984ba64df60d5d0e2e7fadd70d
SHA1 f7643a998ea1562209806181395b7943571ea910
SHA512 2a6655d115604ee04bd7354c8b5a8107bdaf7313711574fa63963e79e446f1e4519b3748f70616d6c35adf978b1bbead5ab42109fdf377e3882348f0b1e8359a
SSDEEP 12288:29lyvj3IkxjbBzc45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:2Wv8qjpfYz7KEMdX6keYnAceru
TLSH
T19D85120D46A464D0F47A4234FA728121C172BCB72768A6FFB4C8E5B74B3AAD1853EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-27-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/376-17-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/376-26-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/760-369-0x00000195E6FF0000-0x00000195E779E000-memory.dmp

Download

memory/956-89-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/956-83-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/956-166-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/1324-365-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1324-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1324-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1324-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1396-173-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/1624-363-0x00000000009F0000-0x0000000000A6B000-memory.dmp

Download

memory/1624-96-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/1624-167-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1624-101-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/1708-182-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1708-198-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1708-393-0x000000000C1D0000-0x000000000C1D8000-memory.dmp

Download

memory/1708-214-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1708-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1708-155-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1708-149-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1708-366-0x000000000B800000-0x000000000BFAE000-memory.dmp

Download

memory/1708-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1744-69-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1744-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1744-67-0x0000000001180000-0x000000000126A000-memory.dmp

Download

memory/1984-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1984-361-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1984-39-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1984-33-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2472-367-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2472-175-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2956-8-0x0000000140000000-0x0000000140249000-memory.dmp

Download

memory/2956-179-0x0000000140000000-0x0000000140249000-memory.dmp

Download

memory/2956-9-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/2956-360-0x0000000000990000-0x0000000000A7A000-memory.dmp

Download

memory/2956-0-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/3280-180-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3280-73-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3280-79-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3284-176-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3332-170-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/3456-316-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3456-15-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3980-137-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4032-177-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4060-171-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4060-364-0x00000000017C0000-0x00000000018AA000-memory.dmp

Download

memory/4060-112-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4060-118-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4188-165-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4188-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4188-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4188-55-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4428-174-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4460-181-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4524-168-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4692-169-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4692-362-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4756-172-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4756-130-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4756-124-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4760-397-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-376-0x000001DC0D670000-0x000001DC0D75A000-memory.dmp

Download

memory/4760-384-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-388-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-390-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-392-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-391-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-389-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-386-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-385-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-383-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-380-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-381-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-382-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-379-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-377-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-378-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-387-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-395-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-396-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-398-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-400-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-401-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-402-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-405-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-407-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-409-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-410-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-408-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-406-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-404-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-403-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download

memory/4760-399-0x000001DC0DEB0000-0x000001DC0DEC0000-memory.dmp

Download