a29f31ca48510729a10068f63256c00c070a90f5d9a3f58b0f5f9db79dcd0fee

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Size 2.5MB
Sample260630-pybkksfv21
SHA256 a29f31ca48510729a10068f63256c00c070a90f5d9a3f58b0f5f9db79dcd0fee
MD5 144fb41dc7a4f805f623b6635a9a8ff0
SHA1 f97ef57a42a541eca14943752293ff18504f3b1b
SHA512 0a655840ee17986600a4404907b6be2b40e19aaa9389989ae449b1af0a0c82d4a907dc4a0d3eec62b57d15bebee8035dcb99823d22463e3516184686d8494721
SSDEEP 49152:8BL2RFRBrrtegmc/YckjsVc2ot4+Ej2ED+l3eFqEfQthymR/9ecDmg27RnWGj:LBrV7/YckjsVc2ot4+Ej2ED+l3eFqEfp
TLSH
T17DC5BF16B29C02D9E17BE17C49868B06E7B6F40A03749ACF11D105E92F1BBE54D3EBE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4492	alg.exe
2940	DiagnosticsHub.StandardCollector.Service.exe
1748	fxssvc.exe
1628	elevation_service.exe
1588	elevation_service.exe
2772	maintenanceservice.exe
2384	msdtc.exe
3796	OSE.EXE
812	PerceptionSimulationService.exe
3844	perfhost.exe
2684	locator.exe
4596	SensorDataService.exe
5032	snmptrap.exe
3868	spectrum.exe
3420	ssh-agent.exe
4452	TieringEngineService.exe
2064	AgentService.exe
5008	vds.exe
564	vssvc.exe
3480	wbengine.exe
3036	WmiApSrv.exe
1104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b7a5e2bd3a3ba122.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006178eff4c208dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa87b9f3c208dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ee0a5f9c208dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6bc30f4c208dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080dcd2f4c208dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e4d9ff3c208dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cf14df6c208dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeAuditPrivilege	1748	fxssvc.exe
Token: SeRestorePrivilege	4452	TieringEngineService.exe
Token: SeManageVolumePrivilege	4452	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2064	AgentService.exe
Token: SeBackupPrivilege	564	vssvc.exe
Token: SeRestorePrivilege	564	vssvc.exe
Token: SeAuditPrivilege	564	vssvc.exe
Token: SeBackupPrivilege	3480	wbengine.exe
Token: SeRestorePrivilege	3480	wbengine.exe
Token: SeSecurityPrivilege	3480	wbengine.exe
Token: 33	1104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1104	SearchIndexer.exe
Token: SeDebugPrivilege	3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3660	2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4492	alg.exe
Token: SeDebugPrivilege	4492	alg.exe
Token: SeDebugPrivilege	4492	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1280	1104	SearchIndexer.exe	114
PID 1104 wrote to memory of 3240	1104	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_144fb41dc7a4f805f623b6635a9a8ff0_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5068

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1556

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1280
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3830238e1a9d4e51c11d72e740edba4b058130ecab40a98334806e6f2c1c7339
MD5 07bc1ff063c9beba2dde172c6755f95b
SHA1 6ad3569936f6259d6a42f5ecaf430e1d723b9267
SHA512 1bd2d063717d2e733a5c79eb2f9c4c060eca98b5ff900250166590221d326f957364ae14ddce88b06a221beaf7fe9bcf6bc25aea44bd746f6e6e12c6de0a536e
SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnCNDmg27RnWGj:d3q6sjBDD527BWG
TLSH
T12CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 760c8bd2111676808260200d7aed83fe1403ab66b05cc8241bbbe287b44b38b3
MD5 b0143f0b57bf22074bcf336c986767c0
SHA1 c54cfa5d5be2b2c573a90ac02b93b29c3d982e63
SHA512 20e5c6387f46ff71b8abd27e841cf21d2774079668000cee0c5426b780434a1359c66865d887912d0e9cd2353e184ce735764c97352fe21b7a346f4b2a91cc29
SSDEEP 24576:wXYfDtczAZJsqjnhMgeiCl7G0nehbGZpbD:HtcENDmg27RnWGj
TLSH
T171650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 91985efe38035d93313bfdc88f785777dc1f4b9629c3ca8fe1758ee07f5e8333
MD5 785b333ad1ae93ba4c1c8e900f33995f
SHA1 895a8cab79f1245d7d30d40df1afec08ef48f647
SHA512 dea851e68ebe02f097233841fbc7f731c47284e61a5c5616664385a9018a8d0817da817f9dc494234e9525a3f0284b94c38b1dc0269ad255809341fc01850c89
SSDEEP 24576:e0Le5ji0hmxxrMaJsqjnhMgeiCl7G0nehbGZpbD:ePji0AjvNDmg27RnWGj
TLSH
T1D4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a0e3ba4a08078ab8ee027ffb33233e5f052038575cc972b6e5b0a949466eeb80
MD5 c876ce5e766badd13969e7730161fe23
SHA1 3a62e62c90bc9c7d1258c9c5245119c98b7b2219
SHA512 e723e3d7976574c1246d1955c7031f9d575c1536add80439c62f08bd52baf5015af2b123754ebb356181e2174a016aa5c8e65c7a2b974688d1370df805efaeb1
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyuUJsqjnhMgeiCl7G0nehbGZpbD:z/ezSC6vUzPveHjyDNDmg27RnWGj
TLSH
T1A2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 32bdbed3db3dc61886e936c0192037f9f9e1ab224ff02f1212fba46c0b1bd749
MD5 0092c4a202f5437c836d8189092ca65b
SHA1 5c31e47d90973ba2b0e7510a8dca010d05b48460
SHA512 c806ac8cbd927c16d57748be822e857fbfaae8ae9be26dfe982c00c73d41cc40680621980b2462be7d20abda4d1c7bef9d2804a2147e70720e7b27fe79c397f5
SSDEEP 24576:bVbqPb88hv/l+YFJsqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+cNDmg27RnWGj
TLSH
T1C4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f14b9032faede1c9a448034529959d2a9b135eff2048db6d9325f2908f3d27c9
MD5 8e49c34a68c7dd575923c6bfc3c821f3
SHA1 53f4d47509c78c64eb0b9f223aa9ec6fc6dc3883
SHA512 3b3299e1e87559c18e076a60bd76f94abd41a95806cc39bfb1266744e475312261f401cd14bb37ab22b00bfc9cb0218065cd4084732d1580ed975a61e607c1b0
SSDEEP 12288:OLWJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OLWJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF865C50CAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 92e3c2d7af573a72d51ecbd5fb08df71a869ac120102fc7a9679c7037ff8cc08
MD5 ec39b1374eabf3bdd8b75a118d9c3a49
SHA1 3befc016d38fdd22afcec8580e96f7caf04d819d
SHA512 0772eba3345c55a38d3d78cc684e17bef0e3f782e0ad15d24564c9c9a69485bab7d9341c390e4b625f0228c23f34b413f858f3fc19960e115a936a76e9518f38
SSDEEP 12288:OeBNUbTVO86UdJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:OJIUdJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6708bd1ca58056c72fbdce5255794f1843ab4defcc93c59a8fa904ba0547f860
MD5 b91dcc5c1a46f5bd9a705206fc6c8c61
SHA1 d5b0e24fa1002d234d96dd76367c7d05ac16d4ae
SHA512 889a08321dffce950ebc86c71c3e6f6dbd5dece6f5344a9c70b5183fadc72bd3205b8908d8c29014721e027d801fe7a6c46cf0567be4ff36a851269d5481ba4c
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:BQvGAdlCEL8c/DRNw5CmD527BWG
TLSH
T13A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 134ff734f8b8ca89f37f213a09b28cc50d81ac160e2fd192897dc9bb42673a95
MD5 1808df9432356918e7de8206b3f66ddb
SHA1 704a196dc7e0c5d0fba35ac23aeb39376fac372c
SHA512 e5edf5e4ff53bf00712aceb19d8ac7467394938defd046aee666bd05e6662ff714a4acd8abd64ceac7f6ac8d3967ac9d693dcc0594edadee895b1e4d6393139d
SSDEEP 24576:e0ewsAj/JsqjnhMgeiCl7G0nehbGZpbD:flj/NDmg27RnWGj
TLSH
T13D75E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48402e47289d5423eaa2819ccc6bd50f57aa90ac38e090ef4c70c155c318c069
MD5 324415fa6e0befd90644c149431ecd08
SHA1 f495b3804e21fca51d41bc3b8d438c09ee853f72
SHA512 044fa51c7645ef6c64fd60e1377466661ae5be6a36e66f128915ce954389fd735f4ed536431644f81b22e19d745bb5930a33d082a604f123899bb2d09ea025c9
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHNVQBWG:CUEtQevvqc2W1cpV2tI32YB
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 755b98b232292a6928b175009eccd1cc9cb73c074c41bd47e19743bd8aafb847
MD5 8f4c2ff2065f4bee0cd83feb919a6793
SHA1 14560dc025564b358c45875fb928d9dee0c20a22
SHA512 6bb2f77e180de7dd44dfb01b6f43d0f1a7bc025706ab69cd2d9ab7d6794cbe17cb68eb92a7e10fd6954c8ba8c794647e1c850a5d1107e4a8230d08fbaaa971ef
SSDEEP 49152:1CbRquA/m2yL5zTfFiV+XenmE3/zfNDmg27RnWGj:ioquVjnm6D527BWG
TLSH
T182D58D1976B8C1E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6c5dad88eb5722279df427d8229f5b808a3a06188abfb75821f07e1b2e67f8e0
MD5 b2554d65a9475a694ff035c8f573d19d
SHA1 214e1d61abe4876be1144ddc02f9d2b40142d744
SHA512 e7f0e2bed15c092a2dd1ca12c0fc0d986ce7ca988224a2b99f527d50e34e94ab51b36d0c5b933905f2f226c5b69827fca05edcd0dbc31c7224f7abd520d9aa81
SSDEEP 24576:HAhGL3IFoiwtA5l7S53YJsqjnhMgeiCl7G0nehbGZpbD:HAMUFoiq5INDmg27RnWGj
TLSH
T116359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 80f04a2786af291a11cc7314bf5faf94944530f3bfc5cb2d2a3d183e3e641708
MD5 34e0ab346f6e6505c8920329d472ac0a
SHA1 9b7c6f8f658edaed8558546e76a35b58e53946c8
SHA512 71aad751acce123794c6ebb433a80f395b59b31d5b57c7a27566a1c3f80a9e5d1609c7238ca6ddb1baaa17a780a6245bbe8d38b9f3f5ec0bfe73d03ebe8c2c91
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+C0JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Nwu4OWjJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18065F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 17b2120c838b39337753fa88f13dc9d49143bad72b7db0309f18f01844a8835d
MD5 7df6661b69a18754481e981524c51d23
SHA1 4319a8728dc43103574971a6d86f7cd39ba7ca92
SHA512 67c3c299fb7766f4c754696e2cce77e11c3770603d4dfc55b9011d8ba668831dcb203ade9bcfa6db2fe4570331e119bbb4e61da442f79986708b980a57d1dfb3
SSDEEP 12288:2eZ1IyPJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rZuSJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B55512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 da4147e865e0f0bed9435fac2862322aec03f8e0bc6df19736b683b85e0e3800
MD5 4c7adc0f2fc0e3961196cc6298781926
SHA1 317219d39b61c9e313a16f3dbb4adcb951c5c81a
SHA512 df27c674f17f8a454c49e939ef2bb9f8126496648f8a2b71be8327acc0a5718b5ca73785897616d2d2f661117d531fedea3a2a63decb3b365948054073c0e01f
SSDEEP 98304:tQRQyi36YOcPbLvw2gAf+PN3PD527BWG:EQyiKa/X+PN/VQBWG
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6da698b051ceed24db657b4d18a729b5552b0f34877ddc4acd3cf97274d44965
MD5 1eef8ae0db1ed85414e1e4296afebd2a
SHA1 8409615b1ca7bbefb93bf9b0ec8c457d736d9256
SHA512 13ed21f26d94134e9519f5b7a0991933f1b05166efcffb4366606e97a943a89968cbae7a5e1516732e49c3fd50d8edf2f38d3fa631f5efce313fb0384cbee59d
SSDEEP 98304:oQRQyi36YOcPbLvw2gAf+PN3PD527BWG:/QyiKa/X+PN/VQBWG
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 010e83ddfb2bf47958df97398bcef21bb2c2b7ec9495aa17a878e0bfda69930d
MD5 cd7bf16dcfb2f5b323abcc0cea6f6b38
SHA1 94967d519c7bd7d51f3386e3b6d15d14ae589fca
SHA512 a1d0b2112d3e5a090a668c5249dacf99e36f860ea5d79fdf7113f112006b2e0e6af17429669f69029728bf1ad6367e82e019048fbc0f38adfcb7cb44833aecdb
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0CJsqjnhMgeiCl7j:668Qg55nhceWu7PNU3/vNDmg27RnWGj
TLSH
T127B55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 562c6f2ed8cda28097efa3fe8a3457d3f7e4e0104948b6f9b07048fb687d4f99
MD5 a1656adf34bb5260aad180a83c9e7d98
SHA1 19843cee75e45e12656f9c357c4e8565e6665f45
SHA512 75d5a50ec3f59b6183449c0deac52e3b51e5688098dd6b0fcfa83c5832206fa406eb61a63c852a5b86aff208d7952789be951a032edb52a67935e515b80d27df
SSDEEP 98304:Gy5112gYy5azzVvt69nLKnhZID527BWG:3LIHEWhCVQBWG
TLSH
T10E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a83b063cfd657e86b1ad1b7591c0dc278bf7222f30972731dd57fade0867fc01
MD5 4790e49486cdaa03d58c161cbb604afa
SHA1 3a6b1692d00384d7cedfbf6ea6bbe2021408cd02
SHA512 028ac2918424993c5e35f4b554f9f9e1a47e5a529534178c1ea164912c1e7f6a5a58baa0a2afb288cecd12772fc0be0e2bb7344e5fb1bf46f47a995184b89dd1
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJNDmg27RnWGj:Wu6Jmdxd2dHD527BWG
TLSH
T1AFD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1f3ecde5b10f2edf3266f5faa48578552e87780603c66331c5313de8baaf9b0a
MD5 60519b01804d64f43d674af583fa85b1
SHA1 067c87bb112d7b0ccf48ff50ad81dcbdb4546d18
SHA512 07f36938d0a02efd43ddda190d1caa0bb6c1272332fbb49ef81811a21f6b12df0d592922d2180a24432a6f20842e0d7d770c6c83da5765c72e241dc8fb779de0
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4x9NDmg27RnWGj:hmifPWR6D527BWG
TLSH
T175B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1a8701c0139cd370a5583ce04b5bc1148b1cc3e52ccc87585cf7f731af5b00ea
MD5 4253110a364f2a9f574204ae9d7aac58
SHA1 e00aed7280544c0307481c7e2f09d4ec95ba4478
SHA512 641ca1013d66956a6685a6d0ff0eaf9d12eb0a4b5f3d6c664ea002e78a5d2f4995f89d1565ce62fd2218ead16202738d592f0a7196eefedf4eda6bc2ce0250c9
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqSNDmg27RnWGj:k5dKii61kD527BWG
TLSH
T1F3C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 661c4553f124edf683ac627668a0581cce7bd04c5149f069e07f9342ef0f3158
MD5 7e94763730b5d7a719bfffbc90435fa2
SHA1 6ee1624ff90880fe3b703352159c60a455f156f9
SHA512 b5e5b329489bffacd8ab5d69a342663e7acc2da252b0fb7820d954cd08dbdc523ed8dd3d01b8e33172dd6a420a5920a90181a7ee765110d80330899390e1fb70
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5wZNDmg27RnWGj:rX2imphuD527BWG
TLSH
T1E995BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8202c0a63e2116723021bade4af5cf2e035d3235d64d10e64275375a4a79bd7a
MD5 0b5cf60fff64ce7b0b7a1d91f8370b49
SHA1 e4c96ef81d69f0d17c004e4a2ab70e56066b4c21
SHA512 e91b6b3380449649e6f91b7014ac673dc475229dbe534aeccd85053c53b31fbd39293e78c9f5f55f095193ba0051a62b073028e08e46a70daeb2b5e57b44e6b3
SSDEEP 12288:uOJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uOJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A577CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 096f0a00280e569dbcc7a34dfe3619a8912fc092baedc43047640648a0c4a0f5
MD5 52ce015c0118ec86e2d1381a22a3a50d
SHA1 c4cde2bf07d957481552c92ee7d5cb1136563567
SHA512 14a578daa57c8b568837e843d950802ef0e725dea8dfcff5b5a927bc1258b55ed3640490b1f5a04cbfd847c4e6c1af099a0fe3089ddb48691dd4b1bafe1f794f
SSDEEP 12288:QrJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QrJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 980f070143d2fd15dd3ab6a674fb66ede6da9bc45d012d3092a776b4f8a403fc
MD5 452438c80ed1f8eec6f735446fa3c5af
SHA1 2dd14cf39557f999e05eac6a00707bf2f7f74f02
SHA512 2a18fd55d4eb1e92bf418ddc7e185e5603e92e7f4f90acf8d213fd9674f197950276b1b3213b55167731829f812474fed3779f063a1187ec355613c4bd26fe30
SSDEEP 12288:f1JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f1JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BF965C41CBE52648B5C3E5F10DAC073E5BE9200483BA977CB9FBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6bcb287223786e5a09748f6041bd7133c1e2cb5d896d98136d98c3b81e4f0f20
MD5 e3bec4e05880f73c007d1b2812d7a4bb
SHA1 1297f646ac85b1cee60943ee3ffc900e8b0b2dd8
SHA512 a047e013713131ef918b210de02d98ec98f971a50b8cfb78115c9487389e6772e6dbdf856d3ac91f4b8de74296a32810cf2628f45053592dcba79b77e6fa516b
SSDEEP 12288:uV4JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F45236B675C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 79de30aa4cc034d17587b30b753bdb96b67a45dd5130ffa2ad59afab9c6473f9
MD5 e36fe4540ed2a08c2a19e9971e199690
SHA1 6c87d2fa3f23644c091a0dfa384ce7e5e8a91536
SHA512 147c7c7ee97e5c07b4b8977ad96516581149d76ac7d939e91c5e3fc121428e99b5d897759a514324695806d963435f7264915f1b3c033c1857dbb03a088fbd77
SSDEEP 12288:GAJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GAJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BF965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ad32fd01ae969d14a8f2af37c5cdea3c5eef242159d03a21437aaa8e399e6b3e
MD5 74f1e65b1b1dc31a608fc42d734273f9
SHA1 d186a9319eba7bdbea353efff631b24aa715c37f
SHA512 13ef3a06fc33f3a478e752d3bf1711061e1b144a305d0bf42723ba841b3331b06b8eb9696f5e545a302d3d73771613859c72526dc6567cfbbd45c86f1be4aa8e
SSDEEP 12288:i3JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i3JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e07ceffece368b1cca8fae1f02caee89bb2a16b4624762edd15904d6565cb199
MD5 e9e7dccbf22c630f98078f1dc4688112
SHA1 7f638c1a4719f20c945a36904e700086e388712c
SHA512 51e3b6e1390be04f1519998f86fc60daa3cc00aff211698d93ef4fc5e2637500699f02c198357705aa3baea789b918622f5736ba66096af7ac7c514cab4f5126
SSDEEP 12288:eTJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eTJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BF965C41CAE52644B5C3E5F11DAC073E5BE9200483BA6BBCBAF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d526d7c87bfa0366029af0e733e9c2a4e553e8d2859384731df222cb4f3e71d5
MD5 64c80fcf30ce9460a79552cac830e3f3
SHA1 4c42ddd92b2e685b4d5475160379757469eb7bf7
SHA512 fde0889c9c1f45d6ec757737ce3a1ef57e7f80a62b9a8690d30b7a6a3f11b072fc05e77b392c084860f376485402841c8f1259f87ccbc4ac7e8c68a25ee4f24d
SSDEEP 24576:9ZMRzFVSOLJsqjnhMgeiCl7G0nehbGZpbD:9ZMRzfHNDmg27RnWGj
TLSH
T10B6501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 335b5f75b12e76d2d3e88d4f49809d00634e3726cf0ce9229c2a2b2199040dd9
MD5 d962e0bcd2c3044b0a115aa55656b8f7
SHA1 99b584244247ec845bee5767dc89bdae7ad97e56
SHA512 831616705e699a130a6435ca5215265666ee223197d4c7fdd447e53b2c3455b5ade7992d50f4bab695f9f260c8686b5da7a63e0f867253b8fa45d1fb2575efed
SSDEEP 12288:YiJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YiJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 645730903f0cb88896f42d01a6e6c8c6c3c3344b2d726e2ad25ac4797b7c82c0
MD5 6029d22189448fcdf6d87c564ecff24f
SHA1 64ea283dbb8380abf6dcb7c9072df8f71060d3ee
SHA512 021532218b9a4a0b2c2cc4440c6f5ab3de34c0c18970a63c4fbd74d9743e1f44d1939cc50c5eaa7a58a6770136dbeb7c20298b568efd3aea5a9a9ada4b65aa58
SSDEEP 12288:RmJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RmJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BF965C41CAE52604B5C3E5F11DAC173E5BE9200483BA6B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f27b51ef58c1989be8074dbf79cf3d2ca3aa816fc3a1ea082d419181aaabd6ee
MD5 07e7aeb045419329e3c700fe30e3663d
SHA1 339203438538754f6af9c74003d38126e27ccd39
SHA512 6ad8c2c8438217f7b85d39fd91c870ae56626f4d94d6099f0f398dfd5ffad0d1c9ca7706f7a104a892f365e951ca7121bd34770534ca4876397859936b018045
SSDEEP 12288:ayPz5L8PJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HzyPJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 30192ad7d1e5cdcf731b97af6b53eff304e80705885c09b0578e68d16f052b42
MD5 03b12e5f548caeed87d4244cb01ec1b0
SHA1 5e6e9bca0b0de87e18bf46f3957bae68feee6f9f
SHA512 68a80ef37fc47c547ac47aa0e781e88043547b3c9b4e4013b7ce7bbbcf34d8f380a352e68fff590dd8d0a0f4470d5c8f284b62451c665f6e44ed75b119fe2319
SSDEEP 12288:tiJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tiJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0b80d5c448a081fb064490b7a26e31ecabc6721088ba186408bc9ef8604e7328
MD5 3c9dc0ea0e1a7e5872313ba7e2f387f3
SHA1 f3d22f2c646772471e19c678d3d370fcf8ca7f19
SHA512 4db8213c36e7bbb7f60ad78530db88b6c624dcf6a9cc707b74c5cf84fd5b224c8693f46e532c4f6f0fdf791c17286065af50fa656cc70533caf44842afc8447d
SSDEEP 12288:JiJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JiJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a9bdeefbda8f5a3ecc7d9a0ccfc96311162154afb4c66b1ef2d9f6bd2fee65ba
MD5 cc840b2cebf5b924e1bf670cfcd3c9cb
SHA1 c6ac52d0b6b616919ae64a0a7673cf8d0a01041f
SHA512 90c217d3d68b55bc3152710a486bfb7821b8c2365ed5c20e6ff35245da7e80704c326125410b5b8d70251e830b87ce2a8d849fef66f26f9e7735b224cc32eeaa
SSDEEP 12288:LyPz5L8PJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyPJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c30811aa585882fd68a8508a4e8365fd7a228b3aa541fb59428955fbf3c71dfb
MD5 eecb94f77bf645fa2627284f390b6ab5
SHA1 b68b5e620fb150f3d3fc6f0051f95a873aa2e531
SHA512 e3e7c7f047a9f63f9e607b6e9f5a65350d955d936a2af395baf3608b9b01e8427071ab0695b7c0649c8b0103f94b31bb76c34488c59cb9e3f6a9c54b10077215
SSDEEP 24576:QcP4mcvIjkGOxhKP2l71SNKbrh/8KBKJsqjnhMgeiCl7G0nehbGZpbD:7P4m4IpOO67N8KkNDmg27RnWGj
TLSH
T14765BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a130f2bd90ffce9cc5ad9ed49b8ab55db742065c247bad66d514b91fd2c2c676
MD5 837634b8b94a5a65894fb7a639a9128b
SHA1 d47f5f85a6157e7e03f13cc44058895d5e4a8857
SHA512 eafe661ba08657a90bcd9a954bbd8ebe9f2aea5966cf34b663c463dedd79debf682bdc8b6adf90d7bddb7d06f1856970fc67444861a2d5dc539c772364d8ee0a
SSDEEP 12288:EbsfSJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7SJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16055015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 01c0da94f48d6557792f4951ce4c9617b558019ded476fab99ae1952fe7aa335
MD5 db4cffa1d9f80c69a8b50284b289b789
SHA1 6c47926c82497e4c4de6747480d98b54b5ae4499
SHA512 20ba1e9161b56e5d7d2c68e4c248087e8f41aa87ebb85c3741b835bd55cd79acf2262e80dab9a83f04d3d0bb40d45997c8180b328f3b050851900157270f21f3
SSDEEP 12288:TyJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TyJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE45237FD34C518BE57649B082E9E02D681B3E669E204483BA477CFDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1ca46a1bd03df51fee4422dd1092519cbc4e5c5657eeb7158b84bdbd0d8f0777
MD5 cfefc61620be31f2960b3147313eda25
SHA1 8980dfd7a223a26ec4f2b80b6345b8a7165695ae
SHA512 60bb95ca52d1136b1e64c780c9b09f456e47d1573605b26341770193ab558c25bdcd59bad07a4708c70e3b6de7ba7cf20c48cd3aea98489efeac0ab5438d3ca2
SSDEEP 49152:ba0h2GEkuAe73q3pp46zwwQANDmg27RnWGj:ba0hNYG4JwND527BWG
TLSH
T16785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d2d343f522bec93f6f6c90f9acee9e809e65bf2c9ffe7a60a356fd88e03da5fb
MD5 dd5c2258dfde8a1824c25c8aaf7ac3c9
SHA1 135832a78b9372c25463acf459f7e0d00b650f4d
SHA512 bf47305a53bec65710f7ff9ba3d3a7cab5ad3b2b6d5a9e7c2453aaac5716cc9b1dff117ced49015bf137e04ef8d22d87bbca21c82249c28b56401d895ccc2758
SSDEEP 12288:KhbHjfXbJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KhbHjPbJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17955127E16AC20C9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7fe0ea6fcd217841ef4a6d7ee0f00a8c19937897e34c71bbed9d47d6eddcb699
MD5 b678a3b182b90900747e2515e91309bf
SHA1 0f88fed73321756a8bd3680fb18dd0e12dcf7399
SHA512 730cdf2085e78427198af820973a7576a551d74061b0523ba808e9129644b39e2665c36d70913c5cccfefd03b5b82d34b8c45e762f0c4b328609e97d811e323d
SSDEEP 24576:r3YgnJcRTk4yti+R5dpR/jJsqjnhMgeiCl7G0nehbGZpbD:rIgnaTk46ppR/jNDmg27RnWGj
TLSH
T19E45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ac55902ce0fc8c2948aaccaf21161491d8a6646ea91db76391edae914c44e2f4
MD5 c7e0e4ca0b66900e210ac153b3f164a6
SHA1 9df9ba464508f377b5e2da43d332f86ed1da3955
SHA512 544a670535aa6c33f6bc9113128144edc4279343b17f09a649a444008b82f1b715e7a480d2487d15f18f14484ae859ec2ded915f78d152a18e6f5227b5470e9e
SSDEEP 12288:n2JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n2JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BE924C51CAD93649F5C2E5E11DA8073E56AB2004D379A77CFEE7B14E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 0755e5a4f4393621cab05cd447639bcabd74e77b22ce431774c4700628c2f126
MD5 18459aa74743711ec81d6322222d71ea
SHA1 d0c8dca5a556867c2a1f72695cf985f0e32fc8b3
SHA512 7389fcd7288c5148cd6f4b050181cbccf5bbdb51f7de32573a99821a00728bd1be8aa9ff9d558e3503b1d89861d4d1c466b0decaabc5030821ee3f761d40cb4f
SSDEEP 12288:oObfA4LWOsvAYFTZJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/npp:FbL3UTZJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 5d05037b5d23df27f7eda224f58d00f6fea9fd9bb2e7fcdb8987247e4e2399b6
MD5 1272dd340a42ef280143b3200f9299ef
SHA1 bb9e541ae6debfaaaa330b5c7b3ca74b5c441d15
SHA512 0552cf65322d3cd6402575555a51ada32092e6de97148c63c288fcde770c127b9baf09e0087d1ec5a2426e1c3266aaf332b07ffdf2c379e6f5293f3400f4386b
SSDEEP 12288:fpFtIO9JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iO9JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D55022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 016166a5534195af4a2724fe88337ce9115bfc41ce50862016190b2db5a300cc
MD5 3e64fd4bd8a6fea2fbca8b6b44cc4a1d
SHA1 b38e090d78182133b5fb9e57e414611fd5953999
SHA512 e1bc90c8c3cd411610e5a8b96c2ce5b330d741b20df6bed7ad166aaa52d43ab55dd35b6a8bf2e7b506692b47850309fb267753db4a129928455d43a1f23a4c2c
SSDEEP 24576:j7NM9YmZqmWMUkPjZM48Mv6bEhsiJsqjnhMgeiCl7G0nehbGZpbD:j7cBWMpPjN8DbEh7NDmg27RnWGj
TLSH
T1FE659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9d1f82fd516264ee27541f096bb3440d3a0173f3a7f05e6e5c470f0a591d1149
MD5 7c556d48d89f9b3225b0873d18446dbd
SHA1 b7d0459a7e985c2b372e1a1382580503df3cde5b
SHA512 e464547f49063922a1483f6f1bafdedd4f6108f9951c2efe569decf384b9a46c749121b550b9bcf43daed710d89623de26b1f8603483023176a2573b31016b31
SSDEEP 24576:YW6BApg2YuyuNDYTabvcRvNYf8km1cJsqjnhMgeiCl7G0nehbGZpbD:YF2YuHNETovcvNYf8kmCNDmg27RnWGj
TLSH
T104857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9f8be4ff0696fd3acb3e4755e9f062d9ec222d0823ab4b5273f7a8d380d3ad5e
MD5 42c37b6074d24a5941cff39b6b166520
SHA1 2d11e7a847e37508283bb69e4061a0321b89fe97
SHA512 750442eec16829a4f95da4131b768af8365531d7db8ce674300628853c7a936a6f21e71df139e47de9c6fef13054ca2120549f3b76b11729b13358c5be2a8826
SSDEEP 24576:xAFs06+OmlfkNXEbToRJsqjnhMgeiCl7G0nehbGZpbD:GFs060lwXugNDmg27RnWGj
TLSH
T14C65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 018c786ad5bb20479df7a5de69fb02bc8685614a1ed8accbde25836de89430c1
MD5 172596c1fade6e240ad66f95f61440bb
SHA1 a051bff85c5a566b97bfe2a3ed8b673f4cecc92a
SHA512 db8a981fc9ab2161bd06efb12c378f0f1d4e2b46366f60737413af9d6f30ca41ca8b59ff82d714bc8ec9328e232a9767ac71bd0e04cfbc34c5a737fad48a4964
SSDEEP 24576:sJnJ5D3WtgJsqjnhMgeiCl7G0nehbGZpbD:sJnJ5DGtgNDmg27RnWGj
TLSH
T12075E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1226a8c99102bdc6ba2190712ab594fe80a4ef2610824b95e959b27879e84133
MD5 8ab9a0f8f181bf7c41bfcb19f7b69b5e
SHA1 668cf9e786b10c0c6c83165074a407728aa57b10
SHA512 252e67a305114e6c56a008ae17babcf8808024c45529eabe6e108758bdb46a46dafea0070d85a01a229b0ffe7f4e1d9f3566ecf3187368cb462cdb8f0021b04a
SSDEEP 49152:Ro06DIKdwc+eQnSt65aVONDmg27RnWGj:G+D527BWG
TLSH
T18A955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 7eeaa487ce4fd8a7977d3aa325471ce0f4fa771e0d4c9ef9904d1bdcc7278e30
MD5 329e1d4cedecf130584a373667cbe396
SHA1 148a32862d236ac8a4077cb2c7f50177b9feaeb4
SHA512 e06e330cf7e8e2b777b10daf5b097cce325fa522c31d2cffff710f139ac7227662a8334c584dd65a307c1acb1d984dce6dc203e853b6f25062f5c35639e0f93d
SSDEEP 12288:iEP3Rr0JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hr0JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F55126E679C60DAD136907D8291C209D733F4716B2127EF66A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 58260af159bd09ebd3a8fd7c242d3d4396bfceedda96db3f78d610fadbde2ee3
MD5 facdf6be61ad9bb8fa69cee5712476e5
SHA1 efed8d5e80287f4d9f0ab4abb36632c22a9c1225
SHA512 f5b83de37117535f64d42ca89501f77282f9dbe1fe917a95a3d368bae41818f1a1c889cc551e067ed013e9df3de36bbb45c02b3198bccc53f34174293c9e8816
SSDEEP 12288:6jkyrJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6IyrJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T184551219639C60C9EA760578C6B3D1589C32BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 3686510a46651645d860bf84933df1c7e8bc4c2119575281d22d0bf4c9444631
MD5 f15af5ca13cccb728681be0ca0935ca4
SHA1 4fd11335385f3fa08561a5e286027219afd49f3e
SHA512 dee2e11e70c3ce266a66f7271350d177a9812082d46d232c4d07c6ed7916e447d99f69bafaa19c87ed050975e6cc0d6389de6cbd2cabd738fb7eddbb11ef6ef3
SSDEEP 12288:lGFNJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lENJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10245237E525C60CEE93244B8C3A5E50DA8133D76AB2014E779E7F8BDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 81db08556e07c9d95f219ab6a11b25bb0d6aeab5d6a1c6bddd4544a9e2c99306
MD5 ce19d849a65375c42574ffbe1669c8ae
SHA1 0c41c4e477262e89c2d7c600a20033eff9211f50
SHA512 a155dfd6ec5c55f86db67e0e0c73734673d5df6551774c5c7b0fa99aece4264919996013a9b64cc4fafb99f26d33f98df89332a69b8948a69e4ef94a9f3eb618
SSDEEP 24576:RQ9MxZKdcz97w36JsqjnhMgeiCl7G0nehbGZpbD:RVKX6NDmg27RnWGj
TLSH
T1C7558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 eedf2fd30cddf434b9ca985ba734bf4beb9865955c1d26833b418e393afdcc4d
MD5 721e6919f3c0986c68094fa737510cf4
SHA1 66d35814252a657c8922e95023680fd9322b4206
SHA512 e51bbdbd51784d7b5317aa3267199ee5d73f71a3bdc166831735928398e4c6813abd8f3b82b6c2b18be83689fe242ddd1322d8c5d3435dae36119c31e37b3d7a
SSDEEP 24576:ayocxAp/JsqjnhMgeiCl7G0nehbGZpbD:nocxAp/NDmg27RnWGj
TLSH
T1EF65E01FB76D40E2E176813C8985C249E673B4305B6257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4e8009d0bf571457d92087cdb3156e05c047607c29c64262a597f250a9d7e52d
MD5 aabeef3cd29cc517fc9dc54aeeae4ec4
SHA1 c7e3a0cbddea29a0a188e36c32417782cbc7be79
SHA512 5369110d48ee45f90963e4d9a93f719b5b4ac60d126bc650f1b5c64eb6814ebd8e89ebca3feded42da1ac34602478fe0a3266b0f1fce6e50fad1c592a90ed737
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK/NDmg27RnWGj:J0zuNIpD527BWG
TLSH
T162A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 84ad5a4eefb9fe5f1be9ac27b7b06b6490cc71551bfc480b4fa2369c96034061
MD5 6f2997e39c2c48842df23092889aaeb5
SHA1 8aa4a58e17ba8d39cd622a1f38c89286ca460ff0
SHA512 005a9c7426313aaff73cf31e59d18dd928ca0235073768c167f47ed2a148ae27e3d40bce9d6b8453903deab6514f320def88768c18815f065cc5c3d30613a1b3
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYujMqb0JsqjnhMgeiCl7G0nehbGZpbD:BTDxR+N5YzT4jMdNDmg27RnWGj
TLSH
T17955B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 a3c4e5442730701efd6254b737977eca2c82d413a86d0decfe10a2a2472776f3
MD5 eaa67edc6431d2bb30192b86c79b2a19
SHA1 25825bd989782032d9e0d969018b95b3a06f5580
SHA512 18951c7608860f92f217277c1b004533e77249ed640e12110d9085ee5d6211c525a4efb87382efc83f3b130b08c5068451f24b09bd186a3496031e7ab0c94e59
SSDEEP 24576:ITMdOz0FFS+bmSL4JsqjnhMgeiCl7G0nehbGZpbD:A0K+bmSL4NDmg27RnWGj
TLSH
T1D375E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 9d4546c3f48414c37353d1ee2d8c1585b4030d8079bc8f6e7422a14e09ea37e7
MD5 ea524496f18c4a9969beac66d92a7945
SHA1 9a2f67381a9bc54b29ce19b09430c6f1ea0c3f4e
SHA512 c6e9165615cdba1b51f452244c6e6dbee892bd0d9fd609f962a8b85df2a1beeffb07c17cdfc765d817cfd96461dd6523053c6bc491e3f7762c9a2fa62849f6c7
SSDEEP 12288:847ZJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rZJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16055126E63EC30D9E4325574C6B6D1099432BC36272015FF39E1D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/564-216-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/812-375-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/812-116-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/812-110-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1104-451-0x000000000CD20000-0x000000000CD28000-memory.dmp

Download

memory/1104-403-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1104-274-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/1104-241-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1104-297-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/1104-247-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1104-509-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1104-258-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/1588-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1588-506-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1588-73-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1588-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1628-489-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1628-53-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1628-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1628-60-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1748-48-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/1748-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1748-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1748-46-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/1748-40-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2064-187-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2064-196-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2064-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2064-193-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2384-409-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2384-89-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2384-95-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2684-125-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2684-131-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2684-380-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2772-86-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2772-76-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2772-371-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2772-507-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2772-82-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2940-27-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2940-36-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2940-453-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2940-35-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3036-230-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3036-508-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3036-236-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3036-402-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3240-460-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-467-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-463-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-462-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-461-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-468-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-469-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-473-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-474-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-466-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-465-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-464-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-457-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-459-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-458-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-456-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-455-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3240-454-0x0000023C59640000-0x0000023C59650000-memory.dmp

Download

memory/3420-173-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3420-390-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3480-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3480-220-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/3480-226-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/3660-0-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/3660-1-0x0000000001F30000-0x0000000001F90000-memory.dmp

Download

memory/3660-9-0x0000000001F30000-0x0000000001F90000-memory.dmp

Download

memory/3660-72-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/3796-373-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3796-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3796-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3844-378-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3868-156-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3868-162-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3868-385-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4452-393-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4452-183-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4452-177-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4492-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4492-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4492-447-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4492-13-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4596-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4596-472-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4596-470-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4596-141-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4596-135-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5008-394-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5008-206-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5008-200-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5032-382-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5032-152-0x0000000000710000-0x0000000000770000-memory.dmp

Download