55ef9c97d9cb337fe0ad7d20b06f3f81447e014441eac737caa85797211a40af

Analysis

max time kernel
148s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Size 747KB
Sample260511-m6abdaf171
SHA256 55ef9c97d9cb337fe0ad7d20b06f3f81447e014441eac737caa85797211a40af
MD5 ecd7a675f9f6b5bbdd760c1230b69d6b
SHA1 2c1578066e217dd4ad95439aea32d6e1c916192e
SHA512 9d9080a9c64b0b952c9f90e858fe2bd1df5febe1c1edb0a1a7e9b1cb4a13d0e304ef0970ccb6d6d5c3962f9173d4795309af2fc1d65cef5f9bad3bbf058046e4
SSDEEP 12288:+iEhwdbT8iSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:eKdH8bTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T104F4F146729020DAD5637275A81FC32FA7B17C6B4730A63B135C7F5A1F36290AE19B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1668	alg.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
2016	fxssvc.exe
3000	elevation_service.exe
4536	elevation_service.exe
1216	maintenanceservice.exe
2640	msdtc.exe
3052	OSE.EXE
4260	PerceptionSimulationService.exe
1872	perfhost.exe
240	locator.exe
4456	SensorDataService.exe
464	snmptrap.exe
2420	spectrum.exe
1428	ssh-agent.exe
4000	TieringEngineService.exe
1736	AgentService.exe
4828	vds.exe
2468	vssvc.exe
4624	wbengine.exe
748	WmiApSrv.exe
4008	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bc1849b714bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a0a88f335e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee292af435e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7062eed35e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db1a22ed35e1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5ef77ed35e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f36aa9f335e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	2016	fxssvc.exe
Token: SeRestorePrivilege	4000	TieringEngineService.exe
Token: SeManageVolumePrivilege	4000	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1736	AgentService.exe
Token: SeBackupPrivilege	2468	vssvc.exe
Token: SeRestorePrivilege	2468	vssvc.exe
Token: SeAuditPrivilege	2468	vssvc.exe
Token: SeBackupPrivilege	4624	wbengine.exe
Token: SeRestorePrivilege	4624	wbengine.exe
Token: SeSecurityPrivilege	4624	wbengine.exe
Token: 33	4008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeDebugPrivilege	4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4684	2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1668	alg.exe
Token: SeDebugPrivilege	1668	alg.exe
Token: SeDebugPrivilege	1668	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1304	4008	SearchIndexer.exe	105
PID 4008 wrote to memory of 3548	4008	SearchIndexer.exe	106
PID 4008 wrote to memory of 2532	4008	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ecd7a675f9f6b5bbdd760c1230b69d6b_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2148

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1428

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1304
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2820 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3548
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2812 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 19ee21dddeb7a8de3aad868762ff21832bdcf0afea7a9b38104662466bb1f155
MD5 19a1d5d9ec0e22b221e1cd2c626dc020
SHA1 a62b87ac39d00908f4f08ee82fee707881afb06f
SHA512 c1ab032a5dd53857719de30b65b06371cad1bd7ec123e6159122b902322a082f129e79de8d5611acfe2abe3ecb26d1cce5e48a0a6cf80494cd56bbe4e361ee77
SSDEEP 49152:kb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnJbuIddjKclOOjh/+:e3q6tjBuyIddjKiOmp+
TLSH
T11BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 24ab258f3b96844ae0be18cfa718c81a293b0c27eb9979a74697888fd1b3b3bc
MD5 480bc94940269cdb0eb724a56a2df394
SHA1 9cef11f3874d61ed8c25b2549a78ba0c41774a98
SHA512 4831131522dbc9487ab244e7dfef51f855d55234f4f5951d0b9395c0a3f1273a9cb70fcb48844521bd67c34436c12df8552f87c8beb5e093da2590e021da8fb7
SSDEEP 24576:TXYfDtczAKbTqFUhd0II8KclDaHm6Wjh/+t:2tcHbuIddjKclOOjh/+
TLSH
T13405012873D409F9EDA7827DDCB18501EA727C5143A0E7DB03E4956A1F332D86A3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a086a89d6433abc0e4b54a3e24f77196c08a2985a98bcf4cccc5930742be436c
MD5 1be9bd7668229a1ff6a5012b0ea6f252
SHA1 a22ffa6048a242f178421783689c7d3a9ed7366a
SHA512 59c28939bdccbc6bcef83844df86a26e65a888089c2510ba10ffe3262dc42b33958f3c0888009a982a20db0404f509f89e8620546c943adc49100fabe5722424
SSDEEP 24576:e0Le5ji0hmxnrMRbTqFUhd0II8KclDaHm6Wjh/+t:ePji0AxcbuIddjKclOOjh/+
TLSH
T1E8359D16F6748335D073C0B9C5D2A68EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4888de70f3ea7ef7cb6c996d106be8e9317dbf2bbf7d94dc42ad432b2137b1b6
MD5 3656e6b3fb77150c716112f69f4a69f3
SHA1 b2be3b5b248aa497113e9c816c740c74a013c88b
SHA512 14ef78f5655e3763d94ac5aac3504c98b6ae7348a09f09e0d2f72a99f03f14baf4a75257c86c0724c19450031a9b338fc962eb78604fbc03ffd0958eb81919d8
SSDEEP 24576:Xa7/ezSC6vUyDZaqgrvWx6q8wyuXbTqFUhd0II8KclDaHm6Wjh/+t:a/ezSC6vURPvMHjy4buIddjKclOOjh/+
TLSH
T1CC756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b202c0621bfe4e59198bcc7c24905794ff93c4199247467da99d013242facac5
MD5 74b7d526471a22a3f6d852e281380015
SHA1 c065c8ee8c1c01adc66bd4610e42552f57a91b9e
SHA512 dc9f90cb9e3a73e731fe091953dea5090db97cc72c2d0844ebcca93564f0e2eb16e362d7da6187c0b8bce6a9a8e87cb739071ae1843450eeed2eefd7b1e725c0
SSDEEP 24576:pVbqPb88hv/lV7+bTqFUhd0II8KclDaHm6Wjh/+t:pVO88hXlVCbuIddjKclOOjh/+
TLSH
T16B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 af0de5cf583d42fd8d5b3699d4bc179081783cba36010406351a1aa95db0f663
MD5 a248f3b29813ddd4dc80fafdbb2aea36
SHA1 dbdf3adc8b43a9be8eaa5a1c1b04d6f7587eef31
SHA512 ee187c92669a2bd915f5318d91a54f2f484f9056c792d8326ef54c6326025670d3b3561ecc34c8a608e83656dcbbccba663c326d8e497f6af3c3c28d85a68685
SSDEEP 12288:qGViSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:qGVbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T19AC423526798A2CFDFE743B638B951D418A07C90D5E888E5735131EE563C0A8F3CA31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 747b7703ae5acad14c89f68d64adce502e012bf3eccad64fbf793132500d1a92
MD5 54ffabaa79cc8d8021d201c7a2011df9
SHA1 dfe8ab4ea62a2f8fa67f79a18ac1f99fb1e3c234
SHA512 79d4ddae21f5a48bc2eedca73ca3351327201402f07dbe19fd2851386f022899335e830bc48484ab16aede193d3c1c427ea06f77df86466d83651d75d7431778
SSDEEP 12288:veBNUbTVO86UGiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:vJIUGbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1D805D03BEE28FCD2C67A8DB96A918340D77278704B6193CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1aec16cc62b7bdb9e27a291b06a54a06c0dbaeebb32adc86dfc1ae893a2460a
MD5 eececd76b28dc2bc87777c955dc83d01
SHA1 a8ff0174780cc456771181f031d20fdb1ef46f01
SHA512 bd3228504e202349d87a9ae8de923cc39951b8a55415060690cc26f8c6cb9b6e3235be437ff01eab8a4af88f9a70d288d90a8402c2a6d77cceebb9aa13e093b2
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THj:8QvGAdlCEL8c/pRNw5CnyIddjKiOmp+
TLSH
T13A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5af7384b89cd739b7e2a32bd238ad4295352f734ecb78df4c9fc2431c7c8e717
MD5 31e60276c647bb099c429d282496370f
SHA1 96b046cdac5b5cf20e16754635e16ee27bf44b7e
SHA512 db3a9071b85fdb5d0ae680af80825cea23f5960d8c94888f8593497e069af48585992f652671273584b8019f234c4cb1c54d78f78be79915a8c7529050cce46f
SSDEEP 24576:uwewsAjsbTqFUhd0II8KclDaHm6Wjh/+t:XljsbuIddjKclOOjh/+
TLSH
T19315E031FE74E036C7BB0DB62B36C716187C7D204BA119C3E3A85A9E59342D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3f237f0dbb36285062b32301d34e1f7af63a89330aae1cad4f20d8493c3262c7
MD5 c6c011befdcacacd26625e745f127973
SHA1 94c05306a8e17981d9f8cd0a7a725c145d9f5f9e
SHA512 ea5256f5966afd6671c488e0dd2926262bc0d16ad7dc1e3964afa0ef545012ebbc32695ab50b1f9dbed9f2cf0c76a6ed40495cb247a74d7c9182869573c8b554
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHkyIddjKiv+:bUEtQevvqc2W1cpV29I32CveO+
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2e11976b353cbb9db96fb1bd566a62117f3557e26a6d0e8d53bbce4109ed43d1
MD5 5ecb411b112f2b81b1ebae09aa219665
SHA1 67715bbe215f54b782d1d7530bbca21fb5e4cee8
SHA512 9005588fe63f91dc5fdeeaec6c4cf857a92b2aba48fd8ce77a81d6f8d4a1b529e4d3e0fd9ab58ea23d5d290fb1bdcfe2f05f8d93d09de93461361c9f14fa4e6e
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/zMbuIddjKclOOjh/+:uoqHVjnmjyIddjKiOmp+
TLSH
T19BD58D0976B8C2E4D1F6C37896A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a1e62c9ac0cfdb7c87c21e324d6aca915a2f830a76a1984df88b436d632bcf82
MD5 0a25e9ae833e91d8f98bce1032ebf555
SHA1 c5f1938edf821a0ae506c1f8213fee054ed83f59
SHA512 c4a79fd9266fb7d7ebd7bc6f21c9f9b32e1e4b73dd129a42ad6b5046179a0841217c110f4bda45435b6f0b0f5a13b00608725f13eabfdc8630b81bea4d91083d
SSDEEP 24576:mAhGLmIFoiwtA5l7S53DbTqFUhd0II8KclDaHm6Wjh/+t:mAM1Foiq5zbuIddjKclOOjh/+
TLSH
T1FC359D81E7F955D4F5F3AAB8A9B68170EA76BCA65E31C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f8a0ffb070bb128494ab0ca97c24f92c106f7c7f665f1f493d96b371e9f47f94
MD5 0d6db406e54dd3f7dceedf158e60c180
SHA1 04c814584706c4138e2db35dc449baa210700773
SHA512 e2a153f1d3640e7662220f67bb7248b4eb350b833e2c23f7c56ea5c027c715b785b7d3ad429169eb11991d5c195396bc3913b238ee5d8b45780c0501821e6312
SSDEEP 24576:xwuXOWYbTqFUhd0II8KclDaHm6Wjh/+t:xwQO/buIddjKclOOjh/+
TLSH
T1E705F14677A41CF9EAA7823985978135F7F2BC012A25C71F1360C65B6F37261BE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 0dd9f6a16274cd0915648d1879584fe08342616a690d22211722303c0d35f0dc
MD5 4c25a6ee3aada65dcf73335055b9b7f2
SHA1 c721a64c36e6bf9e07c472b9f92af6b272714575
SHA512 b4db3e73faab81be31fc1a00d1d112f79e49137ca89a3766ccf9a3b4d5eedfa0aff664d082b697f909e7830a0811bbb787618076f3bc47eb066a02017897581c
SSDEEP 12288:XbZ1Iy8iSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:rZuZbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T150E4124633E461FAD6E3437DA8F54644D7B17C62637543CF222012AA2F36AD56E3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 afd2b9cd6de129de6e6da2ad3de8173fb605b784752610447b1eec1283ab2f72
MD5 44c69828799c92169ab363188b81a41a
SHA1 b849620fea04b4c6cbb007ebe8d604a2f189a9d2
SHA512 a36b8aa94202e2afb1ecef823159010024bb37632a82c49dfe7e37c5a98cecdc0db05a3dd901615606ac5aba8a8d5db85ae62d8d1d14383029285508cd46cb0b
SSDEEP 98304:mQRQyi36YOcPuLvw2gAf+PN3yyIddjKiOmp+:NQyiKakX+PNiyIddjKiv+
TLSH
T165667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 300020cd8c1cecf312ab71c64a0afcbd5907e9e470ed6093739048ed0f4b7b1b
MD5 2c3f190e5bf81c83f9c4173aa746b05f
SHA1 91a1316e2e178ae83d26950e8e7b36270a18b6b6
SHA512 828e6097cac0920a41aba9a51e334ca5b60ef4d464663ed06f1227c7f248c160612ab3bdd735efc97e50f7ceab4a01c20102f8d99e71c46778ccccc11d8e90e6
SSDEEP 98304:WQRQyi36YOcPuLvw2gAf+PN3yyIddjKiOmp+:dQyiKakX+PNiyIddjKiv+
TLSH
T1F3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0d670dc46ac61f814e7ca0fa72606b0fed288e42913c314d38f0b263fd7e7559
MD5 517adcd15370e4bbbd1d0784ca781f78
SHA1 b9d15acaf38871042e3a3309c6e21e8f60991c9a
SHA512 2e667cef5387de47e58f5bf16f85d81d3310a8600e895b3ec9eb348ca2f779859be8ad013ba6e37b4bb71df481704a27740c931ae546b7ebdbfcc00f2a373c69
SSDEEP 49152:r68Qg55nhxeWu7PNU3/cbuIddjKclOOjh/+:1thGRc/cyIddjKiOmp+
TLSH
T1AFB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e4c459cb308a5a9ff95323ae738011d2d79d7a6549ee83fedf240f530f04cbd0
MD5 1dd48688d9de1a649ef10632192e0b4a
SHA1 1555ff4c21a658adbcbad7a7d46fc44f6039123c
SHA512 f5af3436252a24f86ecd7d565af345758427b29b3850dadd222567178912f618293c55220d277275fe819296e2b74ee88847c685dad0eeadc10c041f8d9ac262
SSDEEP 98304:xy5112gYy5azzVvD69nLKnhZVyIddjKiOmp+:MLIH+WhbyIddjKiv+
TLSH
T14F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a25ca2fd38493ccc10c0185e93b562531b7cbe32a07d50ee18711cc74b5f9ba2
MD5 8a0b023e04d298363c4189dea854df72
SHA1 8817ff9c9beeb9d5e704573d101caf8d50586c1d
SHA512 346a3d9d0dea051440830e362b4fee1df446510aa030a0a9966a99a0cdc6979211addd60991c6cb9661e1e6f5a6342265cb23c672c46ef1a099c609e90db2ad0
SSDEEP 49152:EB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6buIddjKclOOjh/+:eu6JmQxd2d6yIddjKiOmp+
TLSH
T15ED59D13F1DA01E8D06ED178974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 139e02b5f597020e081ce6fdb25757522825a646fb8f1808b9e58eefbeecc5e5
MD5 c48bd2761d791d8e4ee34919402c6a72
SHA1 3449c1f9b97b88f8b7472391e95fa7af36e803f0
SHA512 1345aaa8962c34346cba53cb4c8427a14bde97d0da383f33433cd0b227073d80fdefd279f591e6288188d0a2f89b8aa75c2437ba6c0be8dde779efd34dd87bd3
SSDEEP 49152:h1hpsNoJpF1A6yU44CwH7R4xmbuIddjKclOOjh/+:hmifPVRjyIddjKiOmp+
TLSH
T158B5BE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4f94f2a6d7f8d28823f11c3dbbf86e5643de353f97e67747865cf27c14b30b0a
MD5 2a3c788776d601e4de886e30f8f2b6e8
SHA1 b7350474f425a97eed8d01933712060ee5c17171
SHA512 b3dbfed79a320aa66ad5ff949b4e052339442c3d1a0e605b0ff30ffeb09a598b0d84e8eeb4c6d048dddfcc02cb056db7c990b0ca56112901860076c823cc962b
SSDEEP 49152:hSuZQIY0Be2KIRVtOnks6NMHqZbuIddjKclOOjh/+:v5dKOi61ZyIddjKiOmp+
TLSH
T1F5C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 60822b710c722a09878f12e990ce701ddbdf0962538f50817ff30ca0bee4dba4
MD5 3c6c92a9c12229653ea712ae6c6e97e4
SHA1 060d1f5ff3aa91aeb3d00f8809540f7a06ddc3eb
SHA512 0a2d5568ffe543247b0b431aceac65bdfb2d1590b532666c851e8114955096072b5d12c5f2440d361f9337b20eb334c5448b0f89d2b80b234740478422162230
SSDEEP 49152:thtSn8EApI0figGgiDn0AP5wKbuIddjKclOOjh/+:8X2i/phfyIddjKiOmp+
TLSH
T16395BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4417b378284b5ad71f3595856811cff8fcae471f52d36c4e27e46bbf48dd16d1
MD5 46c884fd78b296c36e3483c13c091220
SHA1 3863519c7c14f8a07f7bc6846a78fe26f8186caf
SHA512 ed18fdced5f5c04dc38e2ac858358878f7916823ae3f2c4910243655f28731d95d3a3ca79ef593578a9b228863b1f3cb039b9f917d88a854f45abaddece26243
SSDEEP 12288:odiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:odbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T13EC42342669992CFDBD243F678B902C858A47C95E5E940EA7345306F673C1A8B3CA31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d95384f7f828fb48a8b1b9ba10e2599a33157484db07ea93517db57587e09052
MD5 409f6c1324d44d647c9b64497c655b34
SHA1 8c639c6e56410999af730982f6acbbb8e9543bc2
SHA512 4dd84c0a8fc478948c6e07296a1877de09d5004358b2a6ef0e9279b9508243530324e7f57d6128b73a65d61e0e00470a98cca9b4aa841cff86f031517b18ec3e
SSDEEP 12288:CQiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:CQbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1C1C42342769992CFDBD243B638B802C858A47D95E1E940EA7345306F673C1E8B3CA71F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1b4a1bbfdd325df1cdfb1c73109fa1d02294f4de4234ce594339ebad11f100f4
MD5 f1fc917b94bb88004cb7773c60afd3ed
SHA1 38fb5491df8fe0026c2ff48d25d90b5bb65309fe
SHA512 f35f13bb085e2aaedaba01c01ae54b4534a3c1d40430fbe1e1f862233b9bfc99cd793e72678d8e356e578d794a9dcb26926ea299ed1d8859dc5f6b747fcaa66d
SSDEEP 12288:TuiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:TubTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T175C42342769992CFDBD243F638B902C85CA47C95E5E940EA7345306E673C1A8B3CA35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8017081bd117d13f78f190f1441610a2ee4b65185fcabcded5c305a641bfab42
MD5 2276582b22ac0e884c80594355d0ebf7
SHA1 726adacc0bb104f2c082f7fba2f885198cc199bc
SHA512 aebdc6c567d76bca7130861f9fa89c9290043fe7a09789f2892d3798b6e672c3bab9d0cd8354ce5e2af337279e9018052d9b20aa3821f933bad95a417a8c6d46
SSDEEP 12288:YVjiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:ebTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1F4D4230237A951CBDEE2C3B9B8B5419495F07C94E37546EF6701309E1F382E4B3A9B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d1bfbf4660d0f358b55eb82cac9d3e6cf1005ce4cc77d424e55df35fbf5f694f
MD5 b82643d8150d81f68873d197b6dfd777
SHA1 fc2ef1a3bcf40445fe6030b0ec014e421507f4f5
SHA512 c803af6752c483e187fd7daa4b8b74ce855a3e01b5117174d9af7021c91dc8f67aac41cff99d0cc1c1fb5b6bd43b8bbe56e7db1c42efe50786194495a0429448
SSDEEP 12288:Z7iSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:Z7bTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1C1C43342769992CFDBD243F638B902C85CA43C95E5E940EA7345306E673C1A8B3CA75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 75f111460220924100ad9a7cb8a1eb75ea102f09020a294c528b54210214044d
MD5 d5f9050edb67f247d2dc1f7f97329985
SHA1 a81d239a0c630c919d5f930aa5b75c88a2205dec
SHA512 855fcf5774e7dc14fea507eaba62ff11df6337f88680f94bb4dd93269e6e35ee431269a5da7da8ab014aa64cc2f414c09eadff2438b7fd62108f1aec37b96c1c
SSDEEP 12288:t0iSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:t0bTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1B3C42342769992CFDBD243B638B802C858A47D95E5E940EA7345306F673C1A8B3CA71F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 65f62e8269733b080bd2ed8cc2290944841df13b4b7d9d68e75f841f31ff2e25
MD5 86978e8345773c2e6f2c9d39d2365ceb
SHA1 fd97cf27dea7ac397973974c751bb1108530339a
SHA512 f473860356e6e04cd54e983b849d2f7f5564a8a6ff04e15f7c499673dc1c99d3c94e6824ad9f91122e904c6b9924a36523ec39e8e4101a75d6d5bafc0c188026
SSDEEP 12288:7IiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:7IbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1FFC42342B69952CFDBD243F638B802D848A47D95E5E940EA7305306F673C1A8B3CA71F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 665245f8c8c5ed5749db38843db18a4dd73839cd72dd11fb089a34c4af5e74b9
MD5 aad381b56a6ff584f07dac14b8d31d9e
SHA1 d221bbb79958ca23b7fc0474e993cb004ce8b93e
SHA512 0cc6ab45bc5ff06587221d058de589e94eb8c64cb6fa03c8f07887b39d4339763e2c835492a6b0ab3f18bc333a7ff4d3a583b4d09cea6b953b83f008a32b415b
SSDEEP 24576:/ZMJzFVSOwbTqFUhd0II8KclDaHm6Wjh/+t:/ZMJzfEbuIddjKclOOjh/+
TLSH
T122050295B39018F9EDA3823ECC658905D6B27C5947B0C65F13A4326B1F333A1193EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e7902d73137e060171165121f19f559e917291ec880f197f7f9ebcb2af816176
MD5 26aa86b8e61df12861c65a50249db134
SHA1 48cdec59f9df0222cbdad318a4ef2ac148575089
SHA512 c7b78fc08ec51258c302619cce99808e4aaf8844d8cbab5d356bab1152a4854d5c61ac9599b225d4302d231729d6a2c17d89ed83a43c0ad12d4c044d68c64fa0
SSDEEP 12288:YpiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:YpbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T11BC42346769952CFDFD243B638B902C84CA47D95E1E944EA7346306E673C1A8B3CA31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c42fc9756b24a7dd1adc08152402eb538876d17e9d2b320a025b96e1bcc5e593
MD5 168c7952e2a943113a1b2e64be3a4ffd
SHA1 2ce697519abad485aac5ed46c4bfd374bcc983ce
SHA512 c8d8c29b0c8d4d9b5382404699dd36f75939ff323ef49f5267f0480d4a656db3a48ccfc37448977bc22aec496282a2bcb9e52ba15afabd7a53dc3e25fc80ac17
SSDEEP 12288:DliSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:DlbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1ACC42346769952CFDBD243B638B802C84CA47D95E1E940EA7315316F673C1A8B3CA72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0416f73649fe7ff970f900e56cf53f05f2b6a7374d932fe10330311b2c9d228f
MD5 5c43f004072173cfea128595845e66b9
SHA1 541be0f54a8e0492618df6326d6c0275b23073e8
SHA512 70dee7fbba9707923db52684c4fab8fe3b6445c7934f0b215a8afeb3eb5e3ae0a73b48d54ad51b3bf9b93c0427172611fadb3a2f69e0846e1dba49ab74c0df72
SSDEEP 12288:GyPz5L88iSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:7zy8bTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1BCF4020773A531FDD676837998A11A41F7717C3147648AAF2360127A2F372E0AE7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 39727961b2153ee03df3935e665a526d8057a11faf25ead705d58cf3416c1520
MD5 329912f2e76675ced1773700a16929b7
SHA1 937c16961756e24105b36eb525af4e113b1ef354
SHA512 30b68ae60e62b23268acf3c10f64f0f3691863cf0209531a04fe48ec983203ab361bd35851d31f8673498b1857cf83855d8858436f0286039d14121b94706639
SSDEEP 12288:npiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:npbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1B0C42346769952CFDFD243B678B902C84CA47D95E1E940EA7346306E673C1A8B3CA31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7b1aa89f931bc324ed179a198eea1165e9d202e42854c926e900bdd7411bcefb
MD5 b16e83abb07576df576b36757b60ebd6
SHA1 66c2e4dc94fee63518effb37d870fc9cc9bdaf0d
SHA512 c72d0ec8d4378546987e5f3740ce38676a52c34f45fc8fe3d90682014ef122307e85cb306f1e64384317dece121b8ab1f0b45fafc1c6029a6293316ad4f56585
SSDEEP 12288:QpiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:QpbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T144C42346769952CFDBD243F638B902C84CA47D95E1E940EA7346306E673C1A8B3CA35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f794f06c5ee18216c497b7200d0e606859d255aa54ec8ce951c7ac7b5d6e22bd
MD5 67f51b23a04d6cf3dbc6585f44453465
SHA1 fdb205244b4396cbf3b21c5813d9dc71543356c2
SHA512 aaafaf3ef2c41ae8f642533207f50f8d1ca64fcb60455c0c28e258c6ca201aa65406b536754cb98234a00fb75219070a269a6d8814843212294284ceca34ea6b
SSDEEP 24576:nCUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAibTqFUhd0II8KclDaHm6WjhU:nCUMPTY+8Wg2lIL8lrIUJLWw7buIddj0
TLSH
T14265AE1EA3DC089AD4BB823589518A06EB727C2E1B31D6CF2160C37D6F27AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1c633199aec45573e3be586ceff653efe9e0d5727cca44253edb2f5195b20d33
MD5 1ed3dd565805b13834354cd67ce0499a
SHA1 13426c6fc06ad179ec3ea0cad8cbc25138e8c7df
SHA512 aec05b4531fa2cd28f3713f999685ed10d71f64bc8050ae2c56281a1243030b6e5d3e4dfa943c89b2815decb095c96e6a16389fdf703a7411849898d77b109b6
SSDEEP 12288:sksfZiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:mZbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1CFE4010AD29802D9C1AE5279DB654680B7737C6593E1D3CB63C0F57E1F39290AEEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d3fdb9affca61c2d2cfce17823c46f2485093ffee314f6a146dfc372c6cc1740
MD5 16014fcab5089ccae0048b89ba58460c
SHA1 f4d33c34d9dcf279d4565fec54b32bc30d887ec2
SHA512 f837577be8759895403c66d187333bbd4db8e5fb5fce51b22cac86d99db7920a8d8059a0cd6fc8c83353fd5dbe17bf80235e7a826c6ad694c3b87699a14baae2
SSDEEP 12288:lOiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:lObTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T166D42312A39C928FDBF643B538BD42A414687DA4DBA484D7B20131AE663C1E4F3B571F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f5a1f0d571199c3a55d50c9084ef6034b296f9de423dc0122c11874df189dc36
MD5 1907ad2b2577d0926388dbbaef129f38
SHA1 7dbec2862149f16c5f845d3c6b97b31cc502ad5f
SHA512 52d92b4c09ed3043fe6fe63097eed53dfeb4b1e156033a9aab03aab12783fca5a43d96ef1e5096435d573e82006726af15203aea62b4dff1e09db20a60e2481b
SSDEEP 49152:qRZwQCyiHiQEaiPnMxbuIddjKclOOjh/+:o9xPPAyIddjKiOmp+
TLSH
T1B085AF1E62DC42A5E0BAD278CDA74407E6B27816573197CF1290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 0d3d54584ad8ab93f41066355375282dec811013da8dd068d76a98ea36a77793
MD5 73c608d935ac726827240361556a43e8
SHA1 da9b5c4a92e201b05cdcf43af51fdbfc4473f5dd
SHA512 20a797ecd1f13f8f0b584c0f03e97f8865d5178278ddce38c270147f6f5a7891158e923c08a8521f6c68399a288bdb3ccdd28d1f14d96d69e308ec6aa4033a83
SSDEEP 12288:mbxA1U7KeiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:mbxA1UGebTqFUhd0II8KclDaHm6Wjh/8
TLSH
T1C1E4122E66EC20E5E6B6927D68E58105D7317C25533093EF2181927E0F3BEE4AD36F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 18e75eb539baafb077e091f824360827943309e20695118e89f3b5bb6452caff
MD5 bdc3c6a1ff068215d154aab7fee4a559
SHA1 3e24c6d3cd7c11068ea8af89e21c0b209f0a9840
SHA512 e634bc1882d746fc9b1d1b606ee94f2b1bac094bd114dec153079db1a5deccf1e4b6ac5cc6c2ea2d843f9e338ef82e6380dee342b32b3b8ccff1e13b485006d0
SSDEEP 24576:GjsmP0yHaqrVqHra44KDzMsrnzbTqFUhd0II8KclDaHm6Wjh/+t:GjRP0yHfVqzlAsrnzbuIddjKclOOjh/+
TLSH
T12945AF2EF2B910F9D4AAD236454107B5AB71782D1F209AC70170C235AF1AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 b897a76b3e3ed21008493caa5d9386235da97ddb4682001e7075207c6d6ba012
MD5 cc9d7dd43512cb9e79baae803d034a3f
SHA1 cf99a267ffded581607b8d289f9e0d6aaaaf65ca
SHA512 3e09ec57d67baad1bcb6fb423243185b5c8743e77fd09a6929f478c50a050fbba347b88ed74c3d98b7d20cee343787f72f86c7c25acf6fb2d40cf583fa1e87cd
SSDEEP 12288:uUiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:uUbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1A5D42346639992CFDFE283B538B802D418A47D6097B941E7724131AE573C1E9B3BA31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 abea8d173871c0c18c839b1e25ca689a2450d965ac3b21d2bf3252d6dabee6a0
MD5 82660c016465ed8dbcd86097da43791a
SHA1 1165b0ca9a89788d96177a22a6a4629ea31175ad
SHA512 be30b6ea2ca07ff81fc58b62886c495c84a697dcfc356c42fea4e8f8b4cde8e66580820aeadbb3316c227fd7dc7ac91d8333d0df37ca3dc59536918b0dfc0957
SSDEEP 24576:wtLBUTKbTqFUhd0II8KclDaHm6Wjh/+t:wtLBUGbuIddjKclOOjh/+
TLSH
T19425F155F7A400F9E9A7C23CC8B68616D6B2785D0364E7DF03A84A6A1F237E14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 a580db9a7287f364719bb132c48d75a184dfcbaf99d40f29b5c8d478e2f49954
MD5 8c007831825c0a282ce90839fa7c5175
SHA1 15e51f3166c6e2a36044e342a58503b28cb469da
SHA512 750d2f5c30720831232a0fb8d924549ba207d1f4bd7486c713dd5da8bec616f7a291a1fd876574d8a2a08894be77cb7d3c6d9bece3ef08945f8a5f4e730b3edc
SSDEEP 12288:E70Vm6IYNvUyBpNiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+ti:xWYNHvbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T19B05F21F62AD09E5D67B927D99C28209F2727C66135192CF01B0827E1F27EE8BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2ea36e6cdd96bc18491705e86f2b60e323901bec2c4eac945e853fcfd3c6d78c
MD5 7d025dd5cae9066ad16aaee9f357add2
SHA1 995badccb7b510222c62b7bcb75d962742eaace5
SHA512 170cdcb581a98c2c3a671aafc5a303bb558be116608c7c6c5c97ce21a067820971afc4320a9aa8a17cf13371d3eb18ba212d1e06efc7d499d28b8efaa9d85ff4
SSDEEP 24576:dnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKP:dnXoJJYH84VVS6AmEvJas+cHBjSSKHPN
TLSH
T13265BF6EA2BC04E8D5BBD17DC5C24506F5B178611331C6CF026182BA7F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a089590356c17f5f63a3135de8de500281a1a8bec294c1288a60123f2109445a
MD5 86ef1bace75ad006ddcdd96028c0710d
SHA1 957ad7dcc9db009b8d22c2c659b750d800117812
SHA512 c4d4520b6e648efbf36d9b631aede4b5a8b81964fbf2c034277e9e4abd85389f3dd8a3a05b650939955fd34b8987f2b1c5f6edaffbc70f7ac008938c0d3afef5
SSDEEP 49152:cDLL9TuJ0M/TYj2P0buIddjKclOOjh/+:/AyIddjKiOmp+
TLSH
T1A3859D5EA3EC42D8E0BBD6BD85B79046FAB2B855173081CF1251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 e4b69bec7cd8a43b6f403c8c1d6f21f7c5dc90ceebe0ec7bfc570d822b2a2a81
MD5 42fcf1d176d8748ce3c627b3ad91fc66
SHA1 4977dc31b1a378dba359634507db0c7067d4c846
SHA512 6ea3b4acc47aa14f44a975885b543a05790f2dc62ef905b80ad0005bd30e6e268581c2b60f6994346c3c4b8ba367afb31ab2b41df91586a44f9a878dc83a1a68
SSDEEP 24576:aegJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wKbTqFUhd0II8KclDaHm6Wjh/+t:angOJOmPOHEKbuIddjKclOOjh/+
TLSH
T1BA55CF3FB7BC15D5D07EC17D8A968916F6B0782603255ACF0160827E5F2BEE46E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 036f1ba2da4fc18f1ac09336d64e1b9f42d26b297622f38c59a7424ca60bf8aa
MD5 952771f8e0181535e4dd2c07ef40d1f2
SHA1 d440b2334de834a412be256bae87f45a2484e845
SHA512 38d8573a9d9efd69b230dc1dbe09d06fcb76c5cf79573464bdbfbb1b5cbcf44443285078f6ce1f55692ff8f023a47ab9d73aee9223c476419ed2004c1d0c4ac5
SSDEEP 24576:vLJnJiTk3R3waE4JrO0bTqFUhd0II8KclDaHm6Wjh/+t:vLJnJK8R304ljbuIddjKclOOjh/+
TLSH
T10315E02DD2A810E8D4B7C2B4815A1796FF31387C2B2169CB29B4D5353F12FE0A679F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c0615ef0a2ff37474eeeb125c4b4cbf495ce0ed1da529e297a31d70aac2eae70
MD5 df0180470a69a42e42539cc493b9aed3
SHA1 ea673d8d720f3d5b7944edfb9a73ff6049d06315
SHA512 82959076c94af06e51f86215168e91a2b859819b2e3d3b1b8cf779812b53f1565c6f1a3850f76603dd5976e6162ad9c007dc9b3b0f6d39b7bff921a5d3804d05
SSDEEP 49152:X9mqCzDScAZmlvTcFg8Ph6IbuIddjKclOOjh/+:LPyIddjKiOmp+
TLSH
T1CE955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 943e1d2fa075910bede30126626db84378af3fc716aede9a9e2652a7d99fdf7c
MD5 05006d1128825e7624a12217015d8564
SHA1 cc1f8a36976797b32546f6a306826116a7b7690c
SHA512 e9e82bca99788b0211596fafd27dfbe1f390de6f15d37a0a044d099624971770aeea8ae80d35408fe772575f38bffcb4252a0ca19f42085347945d4ef7430fe9
SSDEEP 12288:AlYJeXm5nkEUuEaiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+ti:AlYJeXm5jUuEabTqFUhd0II8KclDaHmQ
TLSH
T1ACE4125D369C30E9D2AA8279A8A14644D3B0B8B1535113FF62E0D1BE4F3A9E53F39F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 bc44f2b3ba0adff797e27c96c26377f5c111f72a4f451d62e5da461a32aa59b7
MD5 1dc7c0f685dd63e88d877b073cd8bbbb
SHA1 1f9309eba7402fed1539e8f441679f97437dd2c8
SHA512 f9172a30238aebe6e52d9172ee6dfb8950faee4af888d7b5cdb149e3c74b10f212a55e79ea3eefce0f38dc66f2ff263486c6ca22d89a750e0fa005d2bf012616
SSDEEP 12288:Umu6kyTiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:U7tyTbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T1E4F4120563D461D9EBF64378BDB242949E74BC209B2082EF6190B23F2F397D4B275B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 73c02882ff266c784fc83492fb0b4d068262df1a905804a4400e2247c99bfd37
MD5 69d891612dcc159f66812788b1bdd7c3
SHA1 f79aeb333ec313605c55678d15120da8cd5e6b1a
SHA512 df827c1133c0e21b7197b00120dfa6596fdd193913e2a465a1f8194bdd34a3d3484f1ab929e0b41b6e914c6280e5a64d27beb9f65e55b3d4472970bc1be9926c
SSDEEP 12288:nPKiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+tGr:PKbTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T16BD4235923A962CEDFE243B5387902C454B47D7097A454FF329070BA9B3C1E5B3A6B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 99896a2968b3ab2930e39f176ef2a427b1a8e19a1dad12e32b540afbd380e483
MD5 af5f97e165a9d1c95e3100a120564d93
SHA1 3ffcb954ac81523e5f29391b231cccf693a494dd
SHA512 87f403a69189f668ae13db850d03bfd83f7422b9265135c7c3ac3286ea0a1c1961d4528f7766873ba1d38c2052ef7b280b14c5cebaf26b08f31596a3d390f05f
SSDEEP 24576:PC+TyQIu93VAumZr7jm5bTqFUhd0II8KclDaHm6Wjh/+t:P/TfIq+Y5buIddjKclOOjh/+
TLSH
T1B7558D1DA7E91DCAE2B6C675C8A34493E533B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 6b156677a81701dd55e9add98c509911995a1003c3730e17e4e12d942499ed71
MD5 688196b658ee872c3371726ef0c1f9ba
SHA1 82c8d342d1e8c8c026822665101a28b2031f7519
SHA512 a75c9bb96b1cb1e7631de0968ca03a4955e6dbaf515243814312601ff96764dc26180850e022875b6cbc2623c03a88f0fad0251417b424fe281b28653d31549a
SSDEEP 12288:ScyrWOstaa3kcs2iSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+ti:jLQikZ2bTqFUhd0II8KclDaHm6Wjh/+t
TLSH
T10BF4F10FB3AA0096D5A7C23C88954155F6B37870576263DF12A0C77E0B7B5E9BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e1bf8b7210c9d5e5428548d11cc91f3ecb750cc5c8cb33c28502f1b4764fbe22
MD5 337370b5e6e398ea593c848095381961
SHA1 14f85a822fe0f4c28fc862b15c8c6a6ed25a7616
SHA512 7d8c9c438ed092752674bcb69b3dfdb01d0401cc5d4fa29bb5cf17630b78622f8fee275cc043ff231855ede8588b4aa39fd350fed511f132b09a6f7a234701af
SSDEEP 49152:UpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPTbuIddjKcU:VpC7b4+80GTkgyIddjKiOmp+
TLSH
T113A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d75ef7f194f8a341051c4eb046b0046f5454a7de44cf8c5c381ed44ffbfea4f8
MD5 21b16ab49209d49fb921c6ff18ff7b14
SHA1 589ba3a9add5c01ec5bd12f4f2136817606c89dd
SHA512 1cd39ce1a322eed9d9b8f0eb0e72639230c4f8fdc64caf1030d9655ab5a0c15f28c5bea1577e75da026ec22b12b40f4c8579b0e7b60ac1b736aaa87debbeaf55
SSDEEP 24576:eSAwJPE1IDAo+4Kt+l4413kUQbbTqFUhd0II8KclDaHm6Wjh/+t:eqPCIo4Kol4WQbbuIddjKclOOjh/+
TLSH
T19E55B01AA7F956E5E1BAC7B4D663C601FB723822133163CF5290813E0F269E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 78af467b444f0da4dbc067bffd9fb64c1e0bb7ac62678bf87306ba5240661a3f
MD5 1ede2eb408b5616c5f0274f27176ccab
SHA1 7270da9527442d384971d59c2dfd8f3c6ee2af89
SHA512 ca80acdac6c6e06ef630a369e21937f16ec11f31e82cb94a74ebc4c23d9cda877dcc4e451eeb453666d8094f73f391b8520ed73ca9888706e13a2b398faa6c61
SSDEEP 24576:uyLXPLcq94trbTqFUhd0II8KclDaHm6Wjh/+t:uy7PodtrbuIddjKclOOjh/+
TLSH
T1CA25E03EE76C04E5E57AC27CD6A38506F6713CAD037166CB15A0917A1F2BEF4A939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 6b6ea1bed792fd2c99823df67f49348a67e2dc5acab23487f028892711f68f31
MD5 b7967b530e19f6f01604f9703ebc7b57
SHA1 5eef10bfcd435b7bacf1bdcad0cff9e581e4c48a
SHA512 45306fef19032142fdefec3e106bd3a3bab5bca5a2b144ca6613c7dc0b1208628da51df10a43362b3a68adb750180ff073d6825e1e9c345b115da4af9ce1efc9
SSDEEP 12288:U9lyvj3IkxjbBzmiSTq5PrwqlY29w7YD+1FvjmR8Kclr+mazj/+oImfujU0Qq+ti:UWv8qjpmbTqFUhd0II8KclDaHm6Wjh/8
TLSH
T11DF4125E66D460D9E5BA4374B876826480B07C7213B499FF71C4A5BB4B386D0E23FF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-141-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/240-273-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/240-147-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/240-150-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/464-173-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/464-331-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/464-170-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/748-491-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/748-492-0x00000000012C0000-0x0000000001638000-memory.dmp

Download

memory/748-274-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/748-271-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1216-84-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1216-77-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1216-78-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1216-89-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1216-92-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1216-91-0x00000000016E0000-0x0000000001A58000-memory.dmp

Download

memory/1304-495-0x000001D6C97C0000-0x000001D6C995A000-memory.dmp

Download

memory/1428-461-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1428-189-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1428-195-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1428-199-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1668-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1668-122-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1668-479-0x0000000001340000-0x00000000016B8000-memory.dmp

Download

memory/1668-13-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1668-22-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1736-218-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/1736-224-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/1736-212-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/1736-222-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1736-226-0x0000000000680000-0x00000000009F8000-memory.dmp

Download

memory/1736-227-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1872-137-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/1872-253-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1872-483-0x0000000000D80000-0x0000000000E7E000-memory.dmp

Download

memory/1872-131-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1872-132-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/2016-62-0x0000000000750000-0x0000000000AC8000-memory.dmp

Download

memory/2016-46-0x00000000011A0000-0x0000000001200000-memory.dmp

Download

memory/2016-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2016-63-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2016-40-0x00000000011A0000-0x0000000001200000-memory.dmp

Download

memory/2016-59-0x00000000011A0000-0x0000000001200000-memory.dmp

Download

memory/2420-175-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2420-181-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2420-375-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2420-184-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2468-251-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2468-247-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2468-489-0x0000000001160000-0x00000000014D8000-memory.dmp

Download

memory/2468-480-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2532-509-0x00000226B9470000-0x00000226B960A000-memory.dmp

Download

memory/2640-221-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2640-93-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2640-100-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2640-94-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3000-51-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3000-57-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3000-481-0x0000000000740000-0x00000000008DA000-memory.dmp

Download

memory/3000-183-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3000-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3052-106-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3052-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3052-238-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3052-112-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3548-508-0x0000018C8CC50000-0x0000018C8CDEA000-memory.dmp

Download

memory/4000-210-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4000-207-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4000-476-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4000-201-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4008-494-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4008-312-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/4008-493-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/4008-510-0x000000000C010000-0x000000000C018000-memory.dmp

Download

memory/4008-284-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4008-296-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/4008-287-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4008-328-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/4008-278-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4260-124-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4260-116-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4260-123-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4260-250-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4456-152-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4456-485-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4456-487-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4456-162-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4456-158-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4456-286-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4536-482-0x00000000013F0000-0x000000000158A000-memory.dmp

Download

memory/4536-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4536-73-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-198-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-71-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4624-263-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4624-490-0x0000000000660000-0x00000000009D8000-memory.dmp

Download

memory/4624-260-0x0000000000A20000-0x0000000000A80000-memory.dmp

Download

memory/4624-254-0x0000000000A20000-0x0000000000A80000-memory.dmp

Download

memory/4624-484-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4684-478-0x00000000008B0000-0x0000000000C28000-memory.dmp

Download

memory/4684-9-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4684-8-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4684-0-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4684-76-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4828-488-0x0000000000670000-0x00000000009E8000-memory.dmp

Download

memory/4828-229-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/4828-239-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4828-235-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/4828-477-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5044-27-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5044-36-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5044-37-0x0000000000740000-0x00000000007A0000-memory.dmp

Download