5cc340b9564cb9a13226e0feefd38b66af10d36cb284212c2718af5aa98ccd55

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Size 1.0MB
Sample260529-2d2bqabs3t
SHA256 5cc340b9564cb9a13226e0feefd38b66af10d36cb284212c2718af5aa98ccd55
MD5 37450fcff885966c8179a9f88a82a2de
SHA1 b7508330888a5756c971b76736ace35bde81c03b
SHA512 129f953e8bf1d76ebec272200010cbab9f9537186d7d3270e417a9a8368922128b34d66c630d7ca87cab7cca362044af1ff05650c70f2b77bf9b1b7dbe1c60ed
SSDEEP 12288:j+AqPQYEvZbD3OTJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:aAqo7VO107hSdBzYCgDrDdSUftDVUE
TLSH
T11C35DF5633A448F1D427817D8A538A06E7B278145761D7CB02A8F3BE2F376D16E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
3388	alg.exe
2188	elevation_service.exe
3764	elevation_service.exe
940	maintenanceservice.exe
4908	OSE.EXE
4360	DiagnosticsHub.StandardCollector.Service.exe
2016	fxssvc.exe
3928	msdtc.exe
3180	PerceptionSimulationService.exe
4648	perfhost.exe
4160	locator.exe
4012	SensorDataService.exe
4920	snmptrap.exe
3208	spectrum.exe
2228	ssh-agent.exe
4988	TieringEngineService.exe
2424	AgentService.exe
3344	vds.exe
2196	vssvc.exe
2884	wbengine.exe
3672	WmiApSrv.exe
4260	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b1b15bd0fe8d2f74.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038aa9e55c3efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a511ea56c3efdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c499c55c3efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aab92d56c3efdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008409284fc3efdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036221c57c3efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a1cf255c3efdc01	SearchProtocolHost.exe

Modifies registry class 41 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\HELPDIR	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHDCPSvc.EXE	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Programmable	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\AppID = "{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\FLAGS	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\FLAGS\ = "0"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\TypeLib	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Version	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\ = "IntelCpLSPCONSvcLib"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0\win64	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\LaunchPermission = 010014806400000074000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000014000b000000010100000000000100000000000018000b000000010200000000000f02000000010000000102000000000005200000002002000001020000000000052000000020020000	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ = "ILSPCONSvcCOMChannel"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\Version = "1.0"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHDCPSvc.EXE\AppID = "{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\Version\ = "1.0"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\LocalService = "cplspcon"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\ = "CLSPCONSvcCOMChannel Class"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\TypeLib\ = "{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7C2047A4-47F1-4EEF-BAF5-082E4AAB8B38}\1.0\0	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\TypeLib\Version = "1.0"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{84081F6F-8B2D-4FFE-AF7F-E72D488FABEB}\ = "IntelCpHDCPSvc"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7637B024-FD72-43E4-BF24-DEEE8953A32D}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe\""	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB454D7-0207-4B21-84E9-847B52B8EED3}\ = "ILSPCONSvcCOMChannel"	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe
2188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4284	2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3388	alg.exe
Token: SeDebugPrivilege	3388	alg.exe
Token: SeDebugPrivilege	3388	alg.exe
Token: SeTakeOwnershipPrivilege	2188	elevation_service.exe
Token: SeAuditPrivilege	2016	fxssvc.exe
Token: SeRestorePrivilege	4988	TieringEngineService.exe
Token: SeManageVolumePrivilege	4988	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2424	AgentService.exe
Token: SeBackupPrivilege	2196	vssvc.exe
Token: SeRestorePrivilege	2196	vssvc.exe
Token: SeAuditPrivilege	2196	vssvc.exe
Token: SeBackupPrivilege	2884	wbengine.exe
Token: SeRestorePrivilege	2884	wbengine.exe
Token: SeSecurityPrivilege	2884	wbengine.exe
Token: 33	4260	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4260	SearchIndexer.exe
Token: SeDebugPrivilege	2188	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5288	4260	SearchIndexer.exe	119
PID 4260 wrote to memory of 5472	4260	SearchIndexer.exe	120
PID 4260 wrote to memory of 5624	4260	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_37450fcff885966c8179a9f88a82a2de_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4660

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:356

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5288
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2892 2888 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2920 2916 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c7fde59fa4a6ee53b0b3773c7a155dabf9852ef119c94799a73fe72fc310d48a
MD5 3e60fffbee236a9dd79559b40c71e95c
SHA1 e0d8bc1c9f641a3a51a3ea7f8f960c61e55c0ec7
SHA512 68c4968b7be68e9f3f0b9b6f9a8ed3b61458a07205adc3627fefb8881d573f488d4c91b1dd6b017677f66f2beb3d9277f05083776927487a4d58cda108356eba
SSDEEP 49152:Wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnAFSdBYnDdSU:I3q6sjBNAB0dS
TLSH
T1F3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 356927cf62e21d450163513854f6ad82fedf76eda78c293f4056176bb0e29a9c
MD5 3ec122af503563b19fa1d87364aca493
SHA1 61969e6dadac59ec22263ea86795fe8c251e423d
SHA512 5afdac90e159521497d605130107f639442ee3353f9345b9eb8a7ff3a48c834421ea790420cebf32d2876e914db269c2c356625615552d0b02fbf43361363a92
SSDEEP 24576:RXYfDtczAq07hSdBzYCgDrDdSUftDVUE:0tciFSdBYnDdSU
TLSH
T15905F12833E104F9ED67827DC8A28512EA73BC914760E7CB03E499661F376D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4062b7ce4f1ad719106ffed40953fc7e9b3ac46b9d3a376061d1bba4643823fc
MD5 7efd58ec2ead2811102601238535e4e2
SHA1 ac26c7a29e8c69ce0a344922a285622eca7c540b
SHA512 545761faf12510de561009c8167cc22913882f1f1b3eb519f3579f458bd2ac93d7e23f64da6471c36ff1bc0a5cf06a739e50a42105557a97f5f7b9450090bb84
SSDEEP 24576:P0Le5ji0hmxxrMr07hSdBzYCgDrDdSUftDVUE:PPji0AjJFSdBYnDdSU
TLSH
T117359E16F6748335D073C0B9C5D2A68EED7130865B308ACB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2bbd5bb0b9980f9af09b43b55a55da15d0b9fa7566f81ef6cf62dd2d44a3e2f6
MD5 2bd88b802d322c4c8faf6a95f9b8cc69
SHA1 bd47264e0aa9625741e529ca79f9d9d8181c0758
SHA512 47a77e77baad18897cd9fbd46d44d7010d3831135b5768190a6b629a4fc5c3bcdbecb1d99b5f02281d95fb92517441c03f10f92f8085393493bd3d66ac45d217
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyul07hSdBzYCgDrDdSUftDVUE:w/ezSC6vUzPveHjyNFSdBYnDdSU
TLSH
T100755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 132a67bea960670ce745d815d4089a2eed03359a24f64b522dfd35582eda44f1
MD5 032197e7eb48c92aa455648dcd4eb23b
SHA1 839fd23e3a267bff9005f020da2b014d87bfb7f4
SHA512 4a106852036cd9751480bd3d6b07c21ba862a91e3e961194a0a3746abd89e593c2af852448c469549f5761e5a4aac715e666116c9b111a3542d6358ce8d5cb01
SSDEEP 24576:/VbqPb88hv/l+Y207hSdBzYCgDrDdSUftDVUE:/VO88hXl+aFSdBYnDdSU
TLSH
T110559E66F5748331D073C0BAC5D3AA9AEE3234425B31CACB0246D76C2E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 796a6767772d9397a8fa608d1c6f8219678b214998e3131648bd641461caa53b
MD5 d989dfcbaeae5a8638b6a0d6e51ed9bc
SHA1 696c726ab5e3652ee324cc1f4e2e07ae528bf8b9
SHA512 72bee0c072970e55335ee6a96f47d515a898ad70576d9bbb55e0e24774dc4fe3d7acf2f051bed2f6481ac1028e289ea95a62fd5d6274c2615fed1d99341ea112
SSDEEP 12288:6L1Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:6L307hSdBzYCgDrDdSUftDVUE
TLSH
T123C4238132F32086FA33877F24E37A971885BCE5C614D251869579BA4BFC871ACBA705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9e90f941edec9846abe24001684ccefb8340a188874773a907a48242df04aa9d
MD5 06f3fcc45818832ae61cb64a8acf14cf
SHA1 1dc548a09fa48a30a25d0fb556ea55fc341ade95
SHA512 f0a8bba63b47df454797fa9cfcb15c8a746098474c2a5cfc15a2073d16c95ea472bc79928088d69d11de27ffcc28fa73445b038f774d2ca21af06f6af61f95e2
SSDEEP 12288:beBNUbTVO86UcJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:bJIUe07hSdBzYCgDrDdSUftDVUE
TLSH
T11A05DF3BAE38FCD2C27A8DB95A918740D76278704F21A3CBD175820EDE235E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2f948bc00087d406c5495d9142b280a70f656c44c4b62e56dea5df8148fd3b51
MD5 0cfc6f9359167ad1e42200d74a4fa090
SHA1 cc64dfcfd10ad8ac20b83f7701ccccd5240a2b18
SHA512 7a6dab35226f6c843cc63f1834b6402c2f262e9c59fb78bcfef8f82a4a47f7905d0ad2114762eabc417b50d783319e0ad1eeb8fc065c071b18ba2db9b1cbdf97
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:dQvGAdlCEL8c/DRNw5CEAB0dS
TLSH
T1B2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3b873eb24d140b57541ebf9fdb3987849af5f5bd970df0d315d5b47dbca4555e
MD5 d51f13a3f769da3a44d67027e5b941f0
SHA1 96e3c8d00c80723dd87fc58c87d77021108ed7f3
SHA512 c896f84829109dea83d9399335cba05efe919786560b7dfa72b82ea2c6bc5b119f4d709c0388cd47f0869c73dcb7ffbd0b6274d5ffb8710d4f5d514dbf0a64a8
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAjuJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyy:i0ewsAjY07hSdBzYCgDrDdSUftDVUE
TLSH
T11C15E031FA71E032C27B0DB61B36D716186CB9604B611AC3E3E89E9E4A741D22776F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4b96359a8c5cb2efd2a9ad5b5d7212ce037f407724708e8a5d3a76ddd74c70b6
MD5 539bcea9932127e266edce88f4b31739
SHA1 1c0d6da123364fbf8ce1de6672a7094d3cd11e41
SHA512 6bf6523238e6dbb7d2f7ab244684d8b100fef339a7bc485132d7f999b2cde604ff8ce687c18447a41c18cd35877acb2ca80770e2ac7c948cb54e6a0818bafea5
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTAAS:6UEtQevvqc2W1cpV2tI32TS
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b45d3f8eb22006b24b2d2a622b1eaa10ca69c6c91508e8e64fa5657e51bf18b5
MD5 6f7d622b153e877abb2d6f994ecd35dc
SHA1 a5789c63f43ff6e40d59d54d4b07aa8a5f90c2bd
SHA512 17ade9fe8ed9f17f3a0edbd8ec7296f58f2cd306fe7c162252ae7f99cd2191171933908464ee8942de2ca6cf9de67a1b80045a1d41384755b6faf6c985c85d2c
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zZFSdBYnDdSU:woquVjnmQAB0dS
TLSH
T189D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4288beec8df2b258b81611f96cb9f926693afecc14c9ca27bc180b18976b268a
MD5 422c5745ca62a98587251a7f67feca8f
SHA1 042986c7239e33b89ba9b6ede06ad572bab2c352
SHA512 9682fcd0b40ad2d4d151f57c0e224d195603687c20b112e93744ec1834500fa83e22b53891d451eba64c17f54427d429765a9f3baeb0439cfa195c3ee08a41a1
SSDEEP 24576:pAhGL3IFoiwtA5l7S53507hSdBzYCgDrDdSUftDVUE:pAMUFoiq52FSdBYnDdSU
TLSH
T1D7359D81E7F951D4F5B3AAB899B69171EA76BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 aa0ec771eb81a2e3bcb8c7607f0ce6a14f4eaa9f2bcdcba75717cb25aae49495
MD5 77301b9376502d4848082da28502ae69
SHA1 56d18fad8376b81ca2a6a995c78b3d1c3f4bf983
SHA512 8d229869fea4b02ae8e00840998135574d96853387d612ac5e60717bed202268f25739286874490a5f0a3be9a0de6207e2e22e034e4f1791711b86ea9760bf45
SSDEEP 12288:Omw5HEjsChNVBFgl0WDm+CjJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3Uep:Hwu4OWM07hSdBzYCgDrDdSUftDVUE
TLSH
T1A605F14632E51CF9E96782398593C536F7F2BC522A21D71B07A0C65B5F37221BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 db59c3a0ded062ea5412b0d32515a5aaf09a1b4bbb4faef880fc3d6d291a0891
MD5 39bd56b566deac621cda6496bd0600ef
SHA1 e6c20131b75da1b30380c2e25d86d0d22fd656e6
SHA512 0fef693ea0e60854e38dd34dc659ba6c23830ce45ca8e281da92f4238dd40c2a4937a0566f52cd4942a8320e2fe0b0e20774f9f4b0471f05885cc7c5cca5e64a
SSDEEP 12288:seZ1Iy+Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:1ZuT07hSdBzYCgDrDdSUftDVUE
TLSH
T180E4128633E130F9E163833D88F25A46D7A27CA2573183CF066456AA1F77DD26D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 40b2155c25d04f623c41147c32bf1a9aa6793e5ae25077f0fdb3f5a7f1b2e16e
MD5 84cda7b16471ecd0da6e992fb2bb6ecd
SHA1 92fc85695a6f623730eea6045ab28d3e73cb87ea
SHA512 2218000fa68e51e04fbdad764d3696b3aed14f0c1c20577a56eee5ab31fc1c19233ebd77b4cbd200ad4187432c373bc9f499b2c5dc75ed38e52e75275883e8dc
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:VQRQyi36YOcPbLvw2gAf+PN3RAB0dS
TLSH
T162667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 32ea599619f906f2647c9b8d2c9b6a76627b8b317003ffb98219e70c435260af
MD5 39597ca1172218852a53ff6aec17f142
SHA1 9848e56e8cfbde2235d712e6028109d54e46fa0c
SHA512 816dac5efaf3846a716dc5e096c927f10e3542dcf7f6e18972f6d7781f9d6542156a0fb67718dfa3c0e1cac374c6601ffbaea8265708e1f639bba5df69c43fac
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:yQRQyi36YOcPbLvw2gAf+PN3RAB0dS
TLSH
T1C6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2fd707d103e3c3876366d8cdb620387c71f6484468ad98959aba0333d6feb7bc
MD5 39a6414b0a795654e6413a4a9fae0df3
SHA1 171d9af86d07a968f52ce3fdf251a91b97d270d0
SHA512 24dd92acaaf8bc7e3b0ec54c46c62b170bee03a8db8ddfc6b3f7b6e50d4089d60b7af0cb2dbc5c973980c6503cc92eea8282036de525ad2ea75c9e7c332f9381
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0D07hSdBzYCgDrD5:168Qg55nhceWu7PNU3/JFSdBYnDdSU
TLSH
T127B55933B2F200A9C44DE1769F46972196D27C75CFE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 baaf5becb5d1c5c43c9a5d4dd835f11d8f1aa10dcb59e59c2db7c59501af5721
MD5 727f551a95711abcd3701836b7ccd592
SHA1 da37bfd2391cb0ee19aa26d6a159b6f3ba2cf33d
SHA512 e9a93feb86817b11557fb54c349a8f96f546be976d7cd819bd99aa904a32273289223e43a976cc40f729e93977312bd546ba97a98e225e217e3d019b06f366a1
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk999:Jy5112gYy5azzVvt69nLKnhZSAB0dS
TLSH
T116167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 16c4028d7e1b208f697ebd76b8349920bbad112a870a8f3b2af53ee7a4711a67
MD5 00476abef537fe1150e9a13f62ba175f
SHA1 55cc11aed8927c92ce90c137ef2c9ba2d316d600
SHA512 ca51eb33a460a8cd6946b9bed540b8f680696fd84e433bb950ea4a0f91d0cf5acea40af36d83c6d33d2e5c8021a98e935a8bab689a5adc023b9c182176c3169e
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gljFSdBYnDdSU:Iu6Jmdxd2dZAB0dS
TLSH
T1CDD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 079d65f6fcd900a5c4ecf99ffb13be138953a8318f9ed1b96590206b6607898c
MD5 662cf40918289ab386548ae68095324d
SHA1 4904ac432bc4bd17f3e1fbbafb791b0855e4d55d
SHA512 b892cf6aa9aedb2377dad2f226d092c06b20912c8abbf8dfd6d31628e990cbdee82152c691944517fde24d1fe1c681807d06b00da0a266251a9f0f11231b987f
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4xnFSdBYnDdSU:AmifPWRQAB0dS
TLSH
T129B5AE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 307abd8c5070b1ac111d234d4d7e0bf9ff41fd913409463cf401981ca1391638
MD5 1df778e1e08fac35fb30a9fccb342870
SHA1 e777afabba388a1bf59ad813088b86c9384ad8d0
SHA512 c2080b5aac0f9b7bfc2c2c9f2027937c330b2c586f88e7c39d174a02ba69e5fa3493861f4acf94201e53b64c4990e8ebc3bf18ea69f4de7ab71c3a55bd381665
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqwFSdBYnDdSU:H5dKii61GAB0dS
TLSH
T127C5BF03F2E940E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a5b80cf2cee6f31eb0a39264e0e2db940e92ff04bce560f656aafeb4724c1cb4
MD5 e505d19b3d12d6fbc2f536cf14eb228c
SHA1 44059bce00382c8d60d6ab9994c2c7d06b07b495
SHA512 27e96a037bd6e52338532e08a7b54daffc7ede1be02e3f8ff100f5cac6ed7445a5ab4f0d497d35b88b209f0ed829fc658eb46699fc7cac7decfb6f5741d8f1f6
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5wTFSdBYnDdSU:vX2imph8AB0dS
TLSH
T17F95BE13F2D900E8D06ED179C7568632E962BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 79a6651c0e1aa0a123b4e2c5f45b8a2ca99265fc14bb2f38bbd3c237b84e38a1
MD5 f1007179cde86804ae802e0777debe40
SHA1 ffd93da6b3670113e9c2ef9aff46a32b6d3e26b1
SHA512 421d3a2557b497f2eafe8070e12a3651fd6e5b633951ae047d64aae8fe1b756b4a64e089ffaf3539fa841a694f82c1ea5be4a528bd3af9e31a26924742544de0
SSDEEP 12288:ptJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:pf07hSdBzYCgDrDdSUftDVUE
TLSH
T14AC4238131F320C6F52287BF15E36A8758887CE6D6219292879978764BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8d90f1dddf01a44ff78897caa359a298beb681305c391423c71b8a3a6a997d74
MD5 c7bfee70f5d331f6e243e651ef9237d4
SHA1 28dd05019b9f646b10f1c6bde4daee9fef4f93b3
SHA512 04930d3844bc4754cfb6519d9d019b0975adef220a6f0a365cf15091f3b1e1481aaff38e5e2cf2f26e45e01dd3b18cec1bb6920916e392b5dd193799faf68cf8
SSDEEP 12288:+KJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:+k07hSdBzYCgDrDdSUftDVUE
TLSH
T17DC4238131F31086F522877F15E36A8758887CE6D621929287D978B64BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3896c96c7538b8dafaa319237d7e33f257aaf8d96d87401062f71a2b37155308
MD5 09875e4921d2977a2516d4417f7318fa
SHA1 4bc1e4d47794d48446e4a5100ee810385771b311
SHA512 2bd6a8d8931659e39e0c78a25c3cafb8fbfb8ac4da76c57765991f88d21e16e68cd4c88a86251fab8417e78ec310d2886050799f176774e0bc4412bf46792b35
SSDEEP 12288:20Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:2m07hSdBzYCgDrDdSUftDVUE
TLSH
T19BC4238131F32086F522877F15E36A8758887CE6D62192928BD978764BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cdd9a794d69cb0ad304096f07bd71cd2847ef41de2665a584a56d07390d12b45
MD5 f07e389a409947cf36de2e559d6818e1
SHA1 d5bdcbc4faf15bc1fac5e70e2e09df737160a567
SHA512 2ae47c0536fe90c1151789d28a228bcf05d207de1f03b26199b309923a36e92b749d0b26af8a607b5588a62b503619d30fbf473a168611ff983740ee2489dab4
SSDEEP 12288:oV3Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:m07hSdBzYCgDrDdSUftDVUE
TLSH
T12ED4238132F310C6E822C37E89E36696A5D5BCE5D7319397879038AA0FB99617C79F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fea9d8acda4e0e050f34597150b55c52a2bac0958e5eb981a93d6b88dbc4635a
MD5 47c3b4587bca5e476b8e24905d48e059
SHA1 7ad541c26521eb72a5d0ba85440db9a622747d4f
SHA512 27c9588cf892e087404160bf4bda67615ed121dd20f5d08c688661f0d9747d954bed9c82746797a99c65437a5c6b3098a837bfc5a6124ab99a6de51f1e970d64
SSDEEP 12288:BfJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:BR07hSdBzYCgDrDdSUftDVUE
TLSH
T1A4C4238131F32086F522877F15E36AC758887CE6D62192928BD978760BFD8753CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 345005a7f5d430d3b7c2fb00047534c4434327ec8ccf9eef6a88818e9dbdc91d
MD5 0507050085922ee81f4ac28f994aa936
SHA1 df59f07b120cf68c91c31161333e31190ef9a535
SHA512 e9d5174f991238d7821926b7f0c29d895e56e7f37e135aa2aa9f27dda672e1515b0c1e5be993d5704734ed3d3d5265e6c35ddd31e2d0996966339ae8d3563632
SSDEEP 12288:DmJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:DA07hSdBzYCgDrDdSUftDVUE
TLSH
T17EC4238131F32086F522C77F15E36A8758887CE6D62192928B9978764BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ca82bd46186da4a3e0fbe6c5f87a6f8c4eab5748b4de00dad8f101191b4d2784
MD5 9b5213f44318e37b1650b065f604bd74
SHA1 1ff806c0fba60c2727526fccee6d08db15534817
SHA512 d803899a89a12d3bf288008d054cfc985a2a2b899228169da09d621091abf42ec9a6ad2d215bc75517532b59146b9543544c61de2b19ba8680582977a546936d
SSDEEP 12288:9SJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:9807hSdBzYCgDrDdSUftDVUE
TLSH
T1E9C4238131F31086F522C77F15E36A9658887CE6D624D2928B9978B61BFDC313CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 219abdd741ba8e91c46beeedcc491940dec21efc9a7d2b96acb0079fe054e7ab
MD5 03c78462f4dbdf95113bee77e07f6b72
SHA1 51dbfe4834c8e39ef9736517a6022e2af6ecc7c5
SHA512 7cbbe70a8e8dc591081ed3765442d9f43d8c68c658369f478a6a03ea03af2eacbc555b07645fa73b2f4d3eb786d7a0815c27ff0fe95ac2deb30844e5a440a793
SSDEEP 24576:PZMRzFVSOE07hSdBzYCgDrDdSUftDVUE:PZMRzfBFSdBYnDdSU
TLSH
T14405019573A118F8EC63823EC9629906D6B27C6A4B70C61F03E436671F773A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e294632fd6fd50074f74733feee69b538a8cf01320535ef2b34a4a59f6e4ec9c
MD5 9d9d6ce8c2d745745c823ce470aadcbb
SHA1 3cf5b9e0b19a8326b883bf5a33b2f44d7a01d3c6
SHA512 6f6b4e4c57bb9efeb617433edbe53df385808645e60da5d1d62ba62add5ac0555ab21e3b32fa54f74a859544e929592b507b651e75231c0e0b0ac3e9f7b474be
SSDEEP 12288:ixJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:ij07hSdBzYCgDrDdSUftDVUE
TLSH
T113C4238131F32086F522877F15E36A8658887CE6D62192928BD978760BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6f8262354f14a9062882ef926ea10da001382952ba30e887c3c429ee4a545d30
MD5 70190626e19eef2439bd946f1d3b2595
SHA1 c0c0d7bad711ceef9c7cd6f0fa65dec6cc500c89
SHA512 6132ca5386c0f437173f5fc865057623a55e87cb053752ce807b30023b8965b61cdd4506fb220759127b3df4815a7d29f1e067a15f48c39061d21cec6d08baa1
SSDEEP 12288:EFJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:EH07hSdBzYCgDrDdSUftDVUE
TLSH
T113C4238131F310C6F522877F15E36A8758887CE6D61192928B9978B65BFCC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 972eca8cc40e268428dbef0313f94df45c69919e815639148cb19312deb44146
MD5 0355444904e83ace8a18ab0d0cc3816d
SHA1 545ac6d4b1ef02abe3769d26797172af0e2d7599
SHA512 de90ab2e4927f2cdc59644a0869bfa1118052bda704ec1bbbf74a374d53b8736f5b763281cc0f0310463b7ef8754f3556ad70ea2b1f55efbd0fdf701933e638a
SSDEEP 12288:OyPz5L8+Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:Tzyo07hSdBzYCgDrDdSUftDVUE
TLSH
T1FEF4024733A230F9D137823988A31A42F775BC7647208BAF47A416761F776A16D7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0e878092b1b5b9a8377d18913ce90041adbce296ec331ed0453e0812df9baf01
MD5 21d3fdc7bb645d7a40ab9227ad3af119
SHA1 81d85136c3d0771b53f5c8ca27797d96bad24931
SHA512 3a0f1dbf0680ceafb6519da4e47bc508946d520a714cfa66fb6c37302869966b9ca8f301fb9331d878d5a70ace3e465d934c8a706cd6a8064f3dd8c0d0999ce9
SSDEEP 12288:ZxJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:Zj07hSdBzYCgDrDdSUftDVUE
TLSH
T1D5C4238131F32086F522877F15E36AC658887CE6D61192928BD978B64BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7cb8a2d023bef383e05d86617b6a6c1b8d7a716ffe63cdb5909c251e3c2361d3
MD5 5ad481cc9b337c9317aff86d2d7ccb81
SHA1 2458b2a49b993c0e590a670e24199815ec773e08
SHA512 a566282ccb8ac17b32d5db7a4bd9046aec98cf764f8cf7241e297e51798374ac5e8fbe7f34c2d23513a87613071e6c1ca1d434bf37162798d9f7e4132d8a2497
SSDEEP 12288:txJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:tj07hSdBzYCgDrDdSUftDVUE
TLSH
T157C4238131F32086F522877F15E36A8658887CE6D61192928BD978B60BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3d512f425301d6ba618fbf2bf00b293ff6e9053b3793388d130bbc295b152d79
MD5 48a9b5039f140faa7546e0f71972c960
SHA1 ba0f6f53f98e042cc1ff2980ee8708f15db9feda
SHA512 312e3c86d5ea0ec8d82cd7be0e6d71a4d82876c71f7a52654ce6825c84e5aa10d8220bc8f67008c0512c03885ca0c9ec15a0e64e8c9dddc2b75958ad2d2c5c2f
SSDEEP 12288:8yPz5L8+Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:lzyo07hSdBzYCgDrDdSUftDVUE
TLSH
T1A4F4024733A230F9D137823988A31A42F775BC7647208BAF47A416761F776A16D7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 4589d39b15de799afc76f971aac474b55ef683306c00346c0ee424b037c1aba9
MD5 96c61668163a8702c2b2f811d9493fa4
SHA1 57600543fc674a19072d04b0f9cabbc0e5df8cee
SHA512 004feed8d54b9b37e3c9883455890b0ec2255098a16e320adf56d9c9e5c0dc31c327556a8664307a9e4077c23f1c1f0e16721dfc5ff561bb3b8759d318d2fc98
SSDEEP 24576:jTDaLl3z0zDW07hSdBzYCgDrDdSUftDVUE:jTuLljSFSdBYnDdSU
TLSH
T1AD05019573A118F8EC67823EC8628906D6B27C6A4730C65F03E8366B5F773A11C3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 20f46021113f0f253456eea88daf20f384bfa97f6ad5a412ce3a02c4bca51d30
MD5 be7820035c9314d4e943cb2a43225399
SHA1 c48109e4cddf5a4f27211b62d25a2f678d3654aa
SHA512 38a8ceeb33188c4c1c6da1c156f233ac9dd5e25edfc44eeddf07bc554d3038c7fd5d3f561f02e2e3be79ba04871bc5422ceb9013215a440f6177ad7938c4717a
SSDEEP 24576:q3vd9CHKy7GZS07hSdBzYCgDrDdSUftDVUE:Mvd9CHKyaBFSdBYnDdSU
TLSH
T13425CF90B3E410E8F0B7CA358D725512DAB67C9A5B31DE8F03A4255A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5b6b24b7b0496b9859e4cdf582ffd8226c5a338c255c00aa577d511082c58eb5
MD5 5c43e8981a8cf2c5b54e49ad469c99f6
SHA1 dc085b880bc50b659bcf180be678831515f7a9a6
SHA512 d61fbab26ab05b40c7f1661c99d9b689f5ed3adf4821b95a82813df92060de638d358294027390df68dd253411b795e0852dac272b8e13426010995a03de7f61
SSDEEP 12288:1UJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:1G07hSdBzYCgDrDdSUftDVUE
TLSH
T146C4238131F32086F522877F15E36A8758887CE6D61192928BD978B64BFDC713CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 d75c81737a12925169094c761b4e9f758d1d1746548649802f752461b8d345f5
MD5 549f22f2ee374b6aa265fd0964ebf8c2
SHA1 a659bb6f2034772077cf06368864f6aebd901edb
SHA512 0c187252b06c7a219f7da572fdee795e0aa0e447c614569a79c84295400218f779c4abaa7481c9fb61ccc392b66b56334182f6988bcdb2b0b75499917acc9f08
SSDEEP 12288:qeJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:qI07hSdBzYCgDrDdSUftDVUE
TLSH
T138C4238131F320C6F52287BF15E36A8758887CE6D621929287D978760BFDC713CBAB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 59a4b15c7f353ed2ed3004e89587a5edc10c9025305c213ce52a1a63ce40be4e
MD5 351f954b4176a4f55a06fc3cba4a229b
SHA1 e07c7995d4042a2b07562a0f8418347c5139d11e
SHA512 c4cd87357d8d90ec9b3ceb45a50c245b67de4fa0c48016d4c3e06f76f9ec7e26609514dabed1ba91d8233da9af682ea5a522ac0541873fc5dd22a459d6268c8d
SSDEEP 12288:drJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:d907hSdBzYCgDrDdSUftDVUE
TLSH
T117C4238131F32086F522877F15E36AC758887CE6D61192928BD978A60BFDC753CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 85a7a788f4f4cc942fc0d0a379a1e22b23166076d4410984bacbf057757463de
MD5 95025cd92d8b97a13306fb57ae8bab19
SHA1 d198a4ad71864b802bf84e23ad645096a722405f
SHA512 e29e438dc28c4e64710afa211580a92277311a77df0fcfe52d97d32a2701aa649ee89f75d611226711f36c3f6571a6c5c399d2dc4a44b15fd02870fd8c3ee126
SSDEEP 12288:RxJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:Rj07hSdBzYCgDrDdSUftDVUE
TLSH
T16BC4238131F32086F522877F15E36A8758887CE6D62192928BD978760BFDC753CBEB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 40b0e622d6498d617ff80781756c6f5ca67f3b0e0e6a82e9d15bd97a8301703f
MD5 638ab60844966386fe2059079d1d3a54
SHA1 cdffa4decc4bc6191647ade61e7894f4b211ad11
SHA512 c0fecbecec14e05555bfa9467854fa0808a8aa3172ba4f889691e207d3dfb4dbcf0007ccb35bf238750e20c55c369814ac8d12086ff82f674eac50e402f5a09d
SSDEEP 12288:fbsfhJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:yT07hSdBzYCgDrDdSUftDVUE
TLSH
T123E40149E2A511D8D02E927AC7925A41B3637CA583E1D3CB53D0F47E0F7A5A06DFAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 011069c46f559f175cdaa01ddfde171e184ab0732749e78296c7a53221e7ac92
MD5 fc802601a9943444d0dfd4b0f0f58078
SHA1 7b48990221ac3af38906eff42b0b9d1451150175
SHA512 b697c54896dd1193bc9ee47fe3a594be5105fb6fc09cd7c943a64ecc551968aac5c9498a62ec00ee42bb28a4d2610c49b1f5c4768359a5228f85533191cdd19f
SSDEEP 12288:CcJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:Ce07hSdBzYCgDrDdSUftDVUE
TLSH
T11AD4238132E72086F536877A14E3A666244DBCF5CB10D2C3DA8475AA5BBCCF17CB9B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 886af534fa03b574733ee00cfcfe439f228b919036591b50b4e4137fb2c4ebe8
MD5 fed84a2abe52f366caee31a71d24b3e8
SHA1 a4fe573283492b8ca09d321c7dc6312be25e93c3
SHA512 8ec0b27d03a0cde0d06fa58ac35f878a700bf1a0e667840c7b7f1c2d4cdd4350c24eefccfdd0b3c6a64a45961fc06c427385edba346bf8960a21266cb8a29570
SSDEEP 24576:w8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCU07hSdBzYCgDrDdSUftDVUE:xRZwQCyiHiQEaiPnMEFSdBYnDdSU
TLSH
T1A385AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 a18e3adcf826f85aa37f4b9511012d551520ed44e1105dcc6f4204edf65a988c
MD5 2b241bf5c9e20a7883b2e5cefaca798f
SHA1 75a3161723fb9541d804a563f77f252c8f1b3839
SHA512 919857cb634d0ea1191ca185bae9c274a33bf2665932eaa4007535ed457be711348b0ecb54bb81f4d680597b89add4bd6bba24f74469382df688c631b7bf1758
SSDEEP 12288:jbxA1U7KMJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:jbxA1UGO07hSdBzYCgDrDdSUftDVUE
TLSH
T12AE4015E22ED20E5F136D63E89E28206D771BC66572093DF11D1927A0F3AEE46C3AF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 79ee0d7dc5d800aafae60ad1f3680951f3dd544ebc0c4fb32e326c905965dfcd
MD5 a13db37e556a8f4eb2d577e88143d854
SHA1 33502b5b288ce985f31ad0de4621f98424b59899
SHA512 ca10fd5174d8327169c76f6d710c5c0b79553dbde260c3f17dcd0ddd42e01544a5930fb5c32fe9b371e6bcf1412e59a26583dbbe62e9fcc40e917e68fdc4b84a
SSDEEP 24576:VjsmP0yHaqrVqHra44KDzMsrnR07hSdBzYCgDrDdSUftDVUE:VjRP0yHfVqzlAsrnuFSdBYnDdSU
TLSH
T14E45AF2EF2B910F9D4AAC236454107B5BB71782D1F209AC70170C635AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 b70ae388dbecc6480666450fd63647d49c9bec25d26fbdb658fd32e971cb12d8
MD5 071af8dd8399f1864130b9f9f049d853
SHA1 b6662926a6032f638033cf0b982eeec9f4cace33
SHA512 8bd5a61a99274349e25e6eff64a69b8de55edea7346f005232fccd74ee1e8533b45c5b009707f272132b8938e80aefddd2a13eb8490590786045268d7fbf9b54
SSDEEP 12288:+yJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:+c07hSdBzYCgDrDdSUftDVUE
TLSH
T13DD4238131E320C6F922877F15E36A9624847CE5C72593D38A9574B60BFDCF66CBAB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 190b90f0ce87cb4aeac1e8d8fedc4c6973d983246925b4b561b81a5dc949f436
MD5 a9ae9e185ad52010b6fcd153efc7ecfd
SHA1 3758361a6d1f7444c892fdeae458f107a58fddd6
SHA512 88e5eadb8a81a04feb74f636ee3f38d372197f8d4cbeaa140b83c7fc28d350934a5febc83f85aa215fd705f72a904bc67704fd709c30c983310d934b2b104cb4
SSDEEP 12288:rObfA4LWO+vAYFTgJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:0bLBUTC07hSdBzYCgDrDdSUftDVUE
TLSH
T16E25F145F3E500F9E937C23D89A39A16D672B89D0724E7DB03A84A651F736E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 5090c013e5b848fcfe897209834eef2eedc5d7217800708e8c3cb9ebe27abd21
MD5 701e9ae9c69e4af6349c51e9d2e29152
SHA1 956708854d70b27e729e027f079d28c64b22479d
SHA512 3bee509dc7175d375a92680b283027c32d77286ed6d671f2c798099353d5655476d5903068e942b0e28df3ba5a55410d834cfba2b951004fbd2ceb8fbddaa3f2
SSDEEP 12288:h70Vm9IYNvUyBpJJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:+pYNH107hSdBzYCgDrDdSUftDVUE
TLSH
T1CB05F11E62AD18E5E53B917E8AC38609F17278A6171193CF05F0827A0F27EE97C3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a87a963967a75416ea299d56804ca13cd7429a98dff38da1facdf9e2bd6cccbe
MD5 4f192fb6bd5e2d27b807c48c1d6958ba
SHA1 f1cad5016d18570222e04895d016e5280191611d
SHA512 9181f64dba9ce21fe9339be8ae02612b31dc51fb5b1fa2c37f8955ec8a8d03e71b7d170fe776b42c2142e1a20443856b7df40b35f1861bfc238db11dbcd61ef5
SSDEEP 24576:XnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKj:XnXoJJYH84VVS6AmEOJas+cHBjSSKHP1
TLSH
T1FB65BE9EA2BC04E8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2dad40f86cee80e7b516d0789ac50b15cec058e8ee9b38f8452d79afe85f003a
MD5 961d334259af17a452baf0b1722abc56
SHA1 a0f47991606affc1b26bbf1b6523544ac68f6f74
SHA512 9084cb259fd527c402a0b45abe6a9dddc1a6c24629a9f77b886567bd2b8fd25a541b3a6de8d83ffdade760b3e38c95f11541314e99a8bf9bbb54d41d7875db97
SSDEEP 24576:/v7Xbxd9Tuycf8M/TYlSuxrr2PCz07hSdBzYCgDrDdSUftDVUE:/DLL9TuJ0M/TYj2P9FSdBYnDdSU
TLSH
T108858D5EA2EC42D8E07BD6BD85B79146FAB2B895173081CF0291856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c063210e4c8f9cf05fe4df35f0b7f60f0f6f43f76d2614012b12e60ddce4327c
MD5 655e0d8b1bcea3bafcc31528cc97f3b0
SHA1 45ee75a1d5377fc937d6f6561bab44c113d66321
SHA512 ecf912b0f85ef1ca25c09cb8c7717936767a03b6c0c1a97b52581fe19f807b17774230e654489fb7b805403b97a8404a21b19cadade97dbd3d901d57853faba8
SSDEEP 24576:0egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wC07hSdBzYCgDrDdSUftDVUE:0ngOJOmPOHzbFSdBYnDdSU
TLSH
T17D55BF2FB7BC15D5E03EC17D8A938916F6B1786603255ACB0560827E5F2BEF42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 5e3a06c7a03781901429313450af3398d3f81f7662d695ae28cf7ede8c64b88a
MD5 eb763890626b546e648b18ab76500afb
SHA1 81f04f4004aef877e888327736349e9a8c98375e
SHA512 7dc70625823a151367f0fb5b4febcc794af40c69d49837fac946993ee11931748d37174da37f82f3fb129b41399393dd48537ea3b47ed46676d49111f71be337
SSDEEP 24576:1LJnJiTk3R3waE4JrO807hSdBzYCgDrDdSUftDVUE:1LJnJK8R304leFSdBYnDdSU
TLSH
T1B415D02CD2A910E8E477C2B481562B56FF71387D2B2169C759B4D4353F22FE0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0aaf5132b605843771ccff315d16acc9cc5613edd5ea85020078989dd76c85c4
MD5 d64596c49b903e581ac32cf3b81b4138
SHA1 4da1b757022c9ad7616df52b2c5b87303c383cce
SHA512 ef59a041868f61382d2682c9224ecdf727bdead38b9a95c1e574c806e589527e346c02a1bd8c8b87ce1fbeaf4e9fdb80a98d0808bc00427d064f15e752eb0209
SSDEEP 49152:G9mqCzDScAZmlvTcFg8Ph65FSdBYnDdSU:IkAB0dS
TLSH
T18F955D05F7EB5298E8B3CAF1C96294159B327C409B34F7DF4A80C96A1E32BD1D939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 4b4633d5d436148e01b4f9c0da30bba4fa357bea5c1df8bd933fc0485ae4691a
MD5 01d02e41a77fbbd7ff099805af361665
SHA1 7f30dbeca05ff091fe3120c9357a7e803d482aae
SHA512 7c5e2dc71f59ad31f9aa819923c6763bc7a6ef4302164fc9a3986015d92abe7f73328b1e8775abe4975fb8ca62184b1306b91379427e0a02dae5a609f55e36ba
SSDEEP 12288:ClYJeXm5nkEUuEPJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:ClYJeXm5jUuEB07hSdBzYCgDrDdSUftn
TLSH
T1A5E4128D32A930E5E12A827E55E34A45E3B1B8B1531153EF42E0D1BA4FBADE52D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 e1088fed6aaacf9d46e79828b8410852fa8c3d44571426827c8bdd4ee60fa21f
MD5 080997f4ff2e1b3502ae653a4c6b1336
SHA1 fffb71b356b506b238ce41fa28d910d6777d8a78
SHA512 9447c7cc9508703887b99a33aa7b94ed7ef0bc4f545a02ae4d0d5de0d960ff504adc51b1faf993c084c3602e8cbe4619cb03e0bb778d76e69113db5a45c93b40
SSDEEP 12288:7mu6ky/Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:77tyx07hSdBzYCgDrDdSUftDVUE
TLSH
T15DF4124132E160D9EA76473D99A342959E65BCA08B2083DF46D0F63F1F7AAE0BC75F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 9323cb1190a92a72bbcdf6238500b2d4803e1f2b0dbf3a599d5d11acbf9e28ed
MD5 3482baca9a3e6ea6c9824f84021ecbbd
SHA1 41a225888c80eb9ddbefda5af213fe94beecb322
SHA512 352f5074392a29551aafe6f37e0f1618b49dbfd05db69b7d53b05a12a5600973ab0aeb59268225cc58315584ff93d23b49ce64f862e92bd0712f8bb8e36f226f
SSDEEP 12288:TPgJn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:rC07hSdBzYCgDrDdSUftDVUE
TLSH
T18ED4238532F330C5E922877E14A36A9614997CF59720A2E346D4B4B54FFD8A26CBAF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9c58bf7f7882f2cbefa7a0f11c3bc4b15c5d127603f871d799a94d39c925bba1
MD5 f90387242ac0d04e96252e0370785e8f
SHA1 3300430551f97bdbf4fb2eb61d6887ecfc87a65e
SHA512 46aa54d54dc996acfb5cdfcf291a0128f5978bae8fe013a97c8b0131a4eabe20df82eca0e451b3313a33852eb6738ab970446a6c5a42dbdb167718266540b04b
SSDEEP 24576:SC+TyQIu93VAumZr7jm/07hSdBzYCgDrDdSUftDVUE:S/TfIq+Y8FSdBYnDdSU
TLSH
T1ED558D1DA7F919CAE276C675C8A34493E933B872137186CF2044C07D4A9EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 177f0a09f1b205cb71785ba216aafe7ce868ef73f05bb4194f706b8f3d07bd6c
MD5 f54df02fc1a33d5aa7e516edf0fd70cb
SHA1 8485443d7e81e9887f5ac259e036045af9742da4
SHA512 4fef9935d4a3fe10e8e67fbab07fdc7b9aa430b1995d5e69758f4368a7a9fb65302eb6a89ded768b7dbd853cba825b5822ad6ebaa5f7a5afe2ea55cd8943bf9f
SSDEEP 12288:NcyrWOstaa3kcs0Jn07XRSfVB6e6h5z6pEDDr3zdypAbfdXDVyHU3UeW6:oLQikZm07hSdBzYCgDrDdSUftDVUE
TLSH
T1EFF4F10E73AB1095E067C23C88924252F6B378755712A3DB46A0C77A4FBB5EA7D38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 06fe7dc37b2c140e46468de49d1fbb0fc6a49d628a05d5b956e9ed7cc4ad79b1
MD5 dfea078212d874c12d8c8e7a992a298e
SHA1 0295d38b17e0fa6c2228cbb3d679dd6edc1469dd
SHA512 f8cfaf4fb2d7b75ec686896fa2c5ab721e4a81c20d5f3feff157ee9c3d5ce206ee023f555be34edc18f1cfc7e5d464545e4e5f546cae957d3607220053fa7f8b
SSDEEP 49152:NpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPOFSdBYnDdh:OpC7b4+80GTkzAB0dS
TLSH
T17FA57C3DE2F810ADD86AC37685461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/940-65-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/940-63-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/940-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/940-58-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2016-253-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2016-246-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2016-269-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2016-247-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2016-259-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2188-30-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2188-38-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2188-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2188-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2196-396-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2196-518-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2196-393-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2228-514-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2228-338-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2228-337-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2228-344-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2424-373-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2424-370-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2424-360-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2424-369-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2424-366-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2884-399-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2884-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2884-520-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2884-405-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3180-273-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3180-281-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3180-279-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3180-395-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3208-332-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3208-330-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3208-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3208-510-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3344-375-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3344-517-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3344-381-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3344-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3388-23-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3388-15-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3388-24-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3388-195-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3672-417-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3672-521-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3672-420-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3764-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3764-41-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3764-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3764-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3928-258-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3928-261-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3928-383-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3928-267-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4012-432-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4012-513-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4012-307-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4012-511-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4012-309-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4012-301-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4160-296-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4160-298-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4160-419-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4160-290-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4260-515-0x000000000B300000-0x000000000B3B0000-memory.dmp

Download

memory/4260-430-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4260-505-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4260-473-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4260-489-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4260-433-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4260-522-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4260-424-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4284-8-0x0000000140000000-0x0000000140109000-memory.dmp

Download

memory/4284-25-0x0000000140000000-0x0000000140109000-memory.dmp

Download

memory/4284-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4284-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4284-12-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4360-235-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4360-242-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4360-236-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4360-356-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4648-407-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4648-284-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4908-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4908-68-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4908-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4908-228-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4920-507-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4920-313-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4920-321-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4920-319-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4988-348-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4988-357-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4988-516-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4988-354-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5288-526-0x0000027500AD0000-0x0000027500B0B000-memory.dmp

Download

memory/5288-519-0x0000027500AD0000-0x0000027500B0B000-memory.dmp

Download

memory/5472-530-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-534-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-529-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-532-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-531-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-527-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-533-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-528-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-535-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-537-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-540-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-539-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-538-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download

memory/5472-536-0x000001EC8A950000-0x000001EC8A960000-memory.dmp

Download