2e94cbca1b88337d23331055f60d9b4656997a018fe9fe6566115a4f20385511

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Size 1.4MB
Sample261027-rt9ypaew7p
SHA256 2e94cbca1b88337d23331055f60d9b4656997a018fe9fe6566115a4f20385511
MD5 73ee08c9c27134ba49909ca7ca333c90
SHA1 edaf079f3ce7ec1eede463a6e0d61350f3f61026
SHA512 2f92f9745d8256bcc71a8e19a9512c3809419d4bade2be772a66335a8eab6bc05d39a21fe251628c1bdebe0cfb2438ed64eba39b64844dbc09622d7bfb3136f9
SSDEEP 24576:3TVe23FrHmEGQe6gHkcsKb3Xrqk9th8AaUG1QOTT1VKaL+BgTAzy9cGQAVRcUp:jVe23FrGEGQe6gHkcxnrPtcS6T1dCmlN
TLSH
T1AD65AC12B7209965C4161A398970D7F19730FC088BA5A38736EF6D6BAF6F5C64F63380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1548	alg.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
5036	fxssvc.exe
1768	elevation_service.exe
1208	elevation_service.exe
884	maintenanceservice.exe
3520	msdtc.exe
1408	OSE.EXE
1028	PerceptionSimulationService.exe
3328	perfhost.exe
3696	locator.exe
4492	SensorDataService.exe
1680	snmptrap.exe
2612	spectrum.exe
2432	ssh-agent.exe
2688	TieringEngineService.exe
888	AgentService.exe
2620	vds.exe
448	vssvc.exe
4652	wbengine.exe
3000	WmiApSrv.exe
4244	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dfdc16bf60f3a3fa.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaw.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1909db81f66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038d584b91f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ddcaeba1f66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000735e8eb91f66dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000250f9fb91f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077d4a3b91f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007de797b91f66dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e90bcb81f66dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeAuditPrivilege	5036	fxssvc.exe
Token: SeRestorePrivilege	2688	TieringEngineService.exe
Token: SeManageVolumePrivilege	2688	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	888	AgentService.exe
Token: SeBackupPrivilege	448	vssvc.exe
Token: SeRestorePrivilege	448	vssvc.exe
Token: SeAuditPrivilege	448	vssvc.exe
Token: SeBackupPrivilege	4652	wbengine.exe
Token: SeRestorePrivilege	4652	wbengine.exe
Token: SeSecurityPrivilege	4652	wbengine.exe
Token: 33	4244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeDebugPrivilege	1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1548	alg.exe
Token: SeDebugPrivilege	1548	alg.exe
Token: SeDebugPrivilege	1548	alg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2008	4244	SearchIndexer.exe	111
PID 4244 wrote to memory of 4664	4244	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3064

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:884

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4492

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1680

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3164

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2008
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7ec977b80071b881b8610584f69d0c70112e98df4ea16723bd6eb3676813463
MD5 a1e7bc653a287a9c21c7773ad7360022
SHA1 836d8c16d7414928d7e65a5a93eed7cbf88ef862
SHA512 f2d0203973dc9b4b749b2ddb57609ad0b9a79b7db56084069f117f280e914c610ebdbd0b606cf2f4f59080c4e3119399492f5f17577fe5bdb0567cea91dc70f8
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVT1dCmlcGtVjp:Z3q6HjBcT1smlXtVj
TLSH
T15ED59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 37d3ad1d715b30105ea7e5c74f1aa1490c86a83ff1c24007274750d96ac0616e
MD5 0aae8aa5e22d7c9ff581d825229abc7c
SHA1 5c943e13f0dc4c7ee3169154a8cfffb41de40f5a
SHA512 2d3c8c4dbf4fd0a22e77910a96cfb65529cc699fb515560e3828699f686c3c2450816d351a2fe228d87a064f6d5040cc10cebeb41b9beeeb1d2d902d5e958158
SSDEEP 24576:DXYfDtczAwT1VKaL+BgTAzy9cGQAVRcUp:Gtc3T1dCmlcGtVjp
TLSH
T16605F138B79408F9EC67827CC8A2C116E633B8554BA4E7CB03E499651F336D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b3e437a4573491d3e3d0205114301cc8b4d93f75bfb4ae5fd899df5112a1c40a
MD5 51380d01f9db67d64006a2648b87834a
SHA1 6ea2861da9e1c1e7fbc9dcd1593d6088948c986d
SHA512 81a5a88756a91cebd96d7ea5b37f34957bc9a3337e6b2ec637664dcf47d29bd0d8092a38593754e2847be26fbb31cd0f4f6e77c6db383c9be5e69c7861b6f56b
SSDEEP 24576:h0Le5ji0hmxirM9T1VKaL+BgTAzy9cGQAVRcUp:hPji0AcWT1dCmlcGtVjp
TLSH
T19835AE25F6788775D073C0B9C5D2A68EE97130855B308ACB4286D77C3E27BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a19d7c716e17ea2b7af699b30e32c669f96151389600e25044540082c2544eb7
MD5 8d47be3742df10045e6e05e71b6129f3
SHA1 74537fc41420fe72ed6a6bdd7cc52473c07293b6
SHA512 b2855563a3de63f083b466e1668e5946641844a40729bd4a3be99fae909584fd8fe45e68b6dd202549ba808c75a776578906457c1b1959c4b37e0751535c8722
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyunT1VKaL+BgTAzy9cGQAVRcUp:K/ezSC6vUzPvxHjyKT1dCmlcGtVjp
TLSH
T11C755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3D277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 953b5fa0922047475b6d5f7ca2a84ee3c2a499a2e3c722a33efea5c63db6220c
MD5 2ed603b33e2057d4679dd005b881b8ac
SHA1 fd08a71c74387403b5264ac651a4cf7431c3ecbe
SHA512 bfeb1e649e64d15f7c27afa6aa3f1a66b1cd27cc522c33fd163d64eaa275d3987e49a852f0e868bcd80c684103289400700f626e4db696d4d8c5e5d788bb7807
SSDEEP 24576:QVbqPb88hv/l+6MT1VKaL+BgTAzy9cGQAVRcUp:QVO88hXl+hT1dCmlcGtVjp
TLSH
T177559E66F5748331D073C0BAC4D3AA9AEE3234415B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cb7bd3b98324d25ffc7500ce6e174b7e9cc0019371b2228d4501564cb5ec472b
MD5 04d17331b89212d34a31c68f030b30f7
SHA1 432ee936a243ef169f62d2e6d36e205500730f72
SHA512 b75f3c03efad9ec8f2880ea8b0b0b5ee6be50c445fbb78350f6c3176d9e7fe978243ec97787f869978a7af31cddfd8eaa9e0232ed2cd38546b1f9b481b13ccf5
SSDEEP 12288:aRBWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:aR5T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T19AC4233CEB0C18E4FAB64BB475D6E24B8679DF984CF85D816098FADA0436960F43F451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4bf0fea91614739b803053c83e0d78a06b90f7341473b1b96645fe6841837293
MD5 e10c9d033b03265d173da77a7d394582
SHA1 441f9a18cc895273ad80c5b463ff67461dd4ec85
SHA512 4085aac42e881f4a53954b6ac7a99ca6617639728b4cc1508adf8dff1e843281365769c2c39af7ce76200570c1c16f786611c04d4102b4fc7d071c400dd5569b
SSDEEP 12288:jeBNUbTVO86UuWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:jJIUUT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T12705CF3BEE28FCE2C67A8DB85691C200D77278704F61A3CBD165C24E9E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e687b2be963e81182ff1dc533ea8005415cc07614abde1e9f5c6dd92fff89331
MD5 537d241220946ede25d48ee38e0a3598
SHA1 15ca2cccf4aea0b7225e3b03673228098860f6fd
SHA512 0ddb96d6fd5f8bca1998621f2e8b89e23f5f9a9e20ba9dd6c3901dec9131d91a65d4b40a9fdab247481f2c6807d238e80a075b0da24afc8450499588e1314536
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:CQvGAdlCEL8c/yRNw5CXT1smlXtVj
TLSH
T19A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5f9a814ec0c155b1fbb204352b7408697c1c31241760b43b5e1ee600e0d86ea8
MD5 f04e45ad28e4344b409fcf8e69ca33fa
SHA1 1623e8ccb719dbcdd8d30094513c44899614c89a
SHA512 49f07c310e87b483019b56e457bb3bc4a72d272642e240b278b08e189896672d656da8b89ff7a73cc87aaefb65ba5272562b4d401443503a5472b6ed7d9d6d12
SSDEEP 12288:gAwSfxL/2Dc34DLLmt0LDQewsAjEWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJD:1dewsAjGT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T13515E031FE74E436C67B0DB61B26D316543DBA604F611AC3E3E89E9E59302D22336A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ff46acc1acbd39b9c70a7a05f2c239ca9d953f71601d6ff06cb9b135d8c685aa
MD5 4c479710c8a03f86503617e3e470f4e8
SHA1 b7c66d8ac980b8b355ff9bd45e31d4451ca23d13
SHA512 60f5a55598ade253f6a895c1a368277be97ef43618888157fd7bd226b5a362191a52faf5e30a22b1f3229a9ad2fb9ced3b678b117469079ec6043fb3537613e3
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHC:NUEtQevvqc2W1cpV2EI32C
TLSH
T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 95a007e2716def2c9def4422e84d9f272602a034c17de40b99ea3bfce91feba6
MD5 6a2f4b46ae807c9a4701c7a7d8983843
SHA1 7eaa8fb07591f4f7d79d7206219ae95f471a1a37
SHA512 b4fe196ee11400a4b39597f24a1670ef5a1bababfd0001e15a9715f0be1fb839b2a842cfc147224ea66d366a62d3b4f9f46a8cbb29fcb1ef39db627ae05f56c4
SSDEEP 49152:9CbRquA/m2yL5zTfFiV+XenmE3/zmT1dCmlcGtVjp:6oquVjnm7T1smlXtVj
TLSH
T10ED58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b9195f52ed300d7364fd842b452fc30e074eed8a01884c7dc51ab4a50877a69
MD5 eafc462cb254f87312f992def92cd170
SHA1 cc4188188238fd51e9139dcb6ff119c4409632ec
SHA512 085552d34f1db55dd69e0aaf75db59393a1a59e346fff850f9e3dc85db1238798c54bfdc4c362c6d8a43265e893640d9663516dfefa3fe7564621370a0c0d497
SSDEEP 24576:+AhGLJIFoiwtA5l7S53bT1VKaL+BgTAzy9cGQAVRcUp:+AMyFoiq5rT1dCmlcGtVjp
TLSH
T1C135AD90E7F955D4F5B3AAB899B69171EA76BCA95E30C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 23b1e9809baafb948b2ab710b7c5701333a525f3066d31fe12933da914bef82a
MD5 290afb68539cdd9deea01be31bcc7216
SHA1 678bd4a39dbced8b5e4facbaab884bb488133d47
SHA512 129e2e24530ce9036b012ed2936ff28ee6c5c59544b76cc558543b41f90ccf8ed8b9b6928ad1dd3e81729d45f9b5cc3bb540a67c63a679af6e8c0a9326fd7281
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+CjWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRt9:kwuoOWqT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1DB05F15977A80CF9E97786388597C136E7B2BC012A25DB1F1360C65B1F37261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 204fe5ffd557dd168838f5d1a4c7050ce868af1bcd461e8f8227f4116c2607ca
MD5 062908e3e979a715ff8a0f9fb9f5f9c5
SHA1 14167318c88dc390fd24f029a2dbef70174f6389
SHA512 353bcc751922ef34444efac0fc8f3e55681709ce21e8108524922c9ed8afcdbdfff5cfa112b713214c9a879de58ea06cb5ecf3bdd434c01541af1f67e91cd1cd
SSDEEP 12288:ZBZ1IyUWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:3ZuFT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1B6E4126D339820F9E5B3467CD8E29206D372B8952F7543CF1164A2AA1F33AD16D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 46633905375e279192d126f258f242b0a2c0060f09a2eafe964fc2d01c69fccc
MD5 6964b9daa4daf5ef5410269bb13aa898
SHA1 6e930f20cb5b99c247704e0d2af2efd704c987ad
SHA512 f6fb591f2e6746bd37270428c4daee66faa304de291e0b347e885a983b5fc6138ee8895d26ffc57d2f7723f9cc272b8c7c9937ac8e074eb4852c521f324bf694
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN34T1smlXtVj:cQyiKayX+PNQ
TLSH
T15A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 38c3eab5c11b8da977efcef09ebaa5272fae024135d6ea51e481dc27b14dbe0c
MD5 76c0cc4f18829251c3623f0f9bbebe89
SHA1 f74ce63f78b59f5a0679a2d1e9609969c79d8cee
SHA512 12f4d9f6a82e876dd7905df82befcbf48eb95a8c1f4f4026f8785fa174d78efcd8384c06354d60d981c51fb59e00a0ace9b2a18fefff2ad4767679d7c579e6bd
SSDEEP 98304:RQRQyi36YOcPQLvw2gAf+PN34T1smlXtVj:IQyiKayX+PNQ
TLSH
T17B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 18921eba68eeaa00fb2d58beb7e5f48e60965218ab7d40b3b6cd059a150e0e3b
MD5 d4346889cc409b8f77fa15dd6820e56f
SHA1 14f0869af3a05703bed688cf751f2750307415ab
SHA512 1c7340a40455eb9931351a9f9746a0b5ab01f9c56efc1972f6774bfe6649fb8a487501eca6df9f6b86b28b5a1d4a612ea0fc8d81fa712ae01cc966286f2c13f8
SSDEEP 49152:B68Qg55nhheWu7PNU3/WT1dCmlcGtVjp:/thWRc/WT1smlXtVj
TLSH
T1FCB55A33B2F600A9C45DE1769F4A873196E17C758FE0E3DB811572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 02b1d62ceefe64d73b6ef501ffaf454d899d6eaf798bd3fa09513d16d6f45389
MD5 e0907d775a9a9dc72e3fa48b2ba62402
SHA1 2d4c521aecd48c201bb03a56c13ea4e1abeb7512
SHA512 218ad227d33eac0d9a074c42a7e01d168febe613e0c3501d6c65c944dc9e209cb2cac6f5174f5834bfeb05298533acf129f40e1507dca4adb978e72ea7d340d2
SSDEEP 98304:cy5112gYy5azzVvL69nLKnhZ5T1smlXtVj:dLIHmWh/
TLSH
T173167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 15cbb0773601415037d188fdee217e50304a28b015ec3d3df1be182571ef402a
MD5 9a6f1fe8b9e9cc95182b236d2cd45815
SHA1 d48a9e98cc19668ee229393568e0db03de610f7f
SHA512 11f1ef402d247eaddb43937782379d29f53c7250cd4392064ab54cd6df443ef3b87c7f36ce0e4b5645db99364eddb9f13a4f66b1b7ccdcc5c2f5adc747c5489f
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAT1dCmlcGtVjp:Hu6JmVxd2dAT1smlXtVj
TLSH
T15ED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8f624305402da6803fb76c7bbd6b8f56310c13644e7c1be1b668a9dc46d9cf7e
MD5 be0314473387d5ebce6b3bf7a928c1a8
SHA1 51ada9af963dc76ccf8b354e1d00a6bce33ebf4c
SHA512 c53011a7584dbee7019db3d9448cf49b0f4748a3fe8bad262caee0f294c6fadc60bdb71bd135fd36e322c92657753aa0d4109370d0d9721035357f6c6fa3aec1
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4x0T1dCmlcGtVjp:LmifPbR7T1smlXtVj
TLSH
T124B5AE13F29901E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bc12f6728539cc34e19d53798687506470e4369b6b53aa64d3ec83fc59a1e14b
MD5 48caaa225cbff58523fc6dd5247a0cfb
SHA1 2ce2a1c5e8bef24cb4e3996b018af36a179a21de
SHA512 31951438a0744066f65b5b1b4c50b8dc15b9b4f26489e8ee47b730c11b48c441226f92d0701d45d088320932744c0d3f7b257145e296bed232bb80392376fc14
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqFT1dCmlcGtVjp:45dKTi61FT1smlXtVj
TLSH
T1A7C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e5ee74a5b33c81fab441b9491721ca474f2ef07aca5177199d5c2ddf0a47a0b3
MD5 a98536a9977b1dd047a78abae34fbe31
SHA1 de7a5ce95643707f11403dfbcad97c60ea8fe9e7
SHA512 b02a8a48ff6dc43d64849117d07886ec20ed5cd4b7de78d92669c918380f85afad8adffbad231b53a0f78a625461a9a2437a1cd2099364c5bf5b908a98fc87cf
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wwT1dCmlcGtVjp:IX2iyphPT1smlXtVj
TLSH
T15395BE13F2D900E8D06ED178C7468632EA72BC150B35AADF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6626f05eb08f7885bf05690fa2b150f92c4c8b5b3e216f2f14f3bf4bf9a8638b
MD5 c78dbfe61b20b41c71c49315e687f1bb
SHA1 be8874fe3bd43ee42438fbb87ef30e7bb4255444
SHA512 71546aad52226e70d18ac30413ce1eb4dacd2734609639b7a4a67031db9e2a6d401bf7095cf4986304fab4d5b98c592663c1703854020fa21a258f652e0857ad
SSDEEP 12288:OJWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:OhT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T196C4233CFA0D19E8E8758BF4B5D6E24BC6799F8CACB81682709CF59614379A0743F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f20c94e1c36ecf21f8515a609e881d376dbfb192b2087eae212a75fe1a91e421
MD5 a2b9c2b9dc7fdf753394e07bc8124165
SHA1 aa00d0d8f4b62699a3253e3d9701104df826bbda
SHA512 3fc531e9fb3f031023ea7994d667db3602ca09a33b7c162dc640702d62c40c42031e3a2bc86a1f40aa6ab844d6e438b2ca4b709e4e735239b97497412423196a
SSDEEP 12288:dwWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:dCT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1F1C4233CFA0D09E5E8758AF4B5D6E24BC639DF8CACB81682709CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6f26daf2558d277e1f93ac416d2ab00359043f0379e332d2ec4707c418423867
MD5 9adc695b14ada58acc966694c9f504c5
SHA1 e91611a006bbe8b3b6258e4cd617515cf9709672
SHA512 b4f89321ff177d826caba939af6de1fb5980b5afc3387f83da9df02f5a3faf513c18ed3a39cd826337fb4e9b332b8658f1fe600e15b0cb7a4d27058500b88ede
SSDEEP 12288:72WhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:7cT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1A5C4233CFA0D09E8E8754BF4B5D6E24BC6799F8CACB81682B09CF59614379A0753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d5c87388a5ca4f89cf0326ad389a54c0cbc1b3e76f7e0db485436667938b5e7a
MD5 07eb022c91ce832e822177ff2bd36f36
SHA1 0ea6550e03ffdbe986ac852a2fad6761529e5f14
SHA512 3ad00bebc3e7553b4359c725ddbdfdc9c65fb0b7b3b3360a114e4c7163996b48c3cde0f4dc30d34bbf5a4e33559266e35b146ec3cccb7e9fffa7a7d94594c3fc
SSDEEP 12288:VVnWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:rT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T18BD4233CBB0D04E4E876C7B8E5A2D207D379FE989E7557CF6144B59A0C336A0783AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 aa2891cdbf8d2b8f3038abe660ff46af61d02c486ca39c3d67a528672c1f3853
MD5 749908efe9138240656eeb78ef24ef52
SHA1 e3771cca6737af4104c4a2a9d7f8383e3dace7ed
SHA512 eee75adfa5730d1e8e74c92d42950832c2a6baff1e66f6f65a2566350367eac5ae30d0ed73c0a97687e3e619e6ea123d4670c94958b32be0c3b754c54a90b2b0
SSDEEP 12288:u/WhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:uTT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1DAC4233CFA0D09E8E8754BF4B5D6E24BC6799F8CACB81682709CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7c5d331928f57ca0e6492b6fafe6e399fa38f8c37abc2900f90f09cf04462e86
MD5 cad1dd9e5dcc2a9326dfcaff874301d8
SHA1 104ea1950727bef6c7c38460155f2b2a813f8905
SHA512 19092895467b836c3875b45126f02aa06ef892ace1921218935b45de40065f87e3e895c41ee0a02251da59c541d6367079843ff3c066365017b02fa08e8a8791
SSDEEP 12288:bsWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:buT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T15EC4233CFA0D09E8E8754BF4B5D6E24BC6399F8CACB81682709CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d5365a00e7f84bc360718e62323781a003d7857780de1ce884186c4f3344491b
MD5 9d3fbb7824000f29393ede09cb1c6747
SHA1 b27f84a4f0db2394f8ba2c1970d39e2677243ca3
SHA512 bd7f8c6bd36494d7ddfbb3ca399fa18a633ab19e598712e18c4cc8bb02776bfd6d28e7244d19a7dbf22112c57619dbabefc1991f03b049e43f2c6f5ae992f343
SSDEEP 12288:ooWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:o6T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1F6C4233CFA0D09E8E8754BF4B5D6E24B86399F8CACF81682709CF5961437960743E890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f6accb83bc96bff47853ae2caf526881d16443fda3a6e1c259e8c94d85358c13
MD5 fbc320847e638df7066b0d7707a7cebb
SHA1 ec61e0250f0a05a9403d903147f13899bd154693
SHA512 d2e80ab733c5fce2dc3a252254fce4962a329b8746f4b0f6ea868ccad51cf7b198f863040a0d13ee5554d9d2b1b031277ff43216935680a8e9547afb402c3d83
SSDEEP 24576:dZMSzFVSOiT1VKaL+BgTAzy9cGQAVRcUp:dZMSzfeT1dCmlcGtVjp
TLSH
T11605F1A8B35418F8EC77827DC9569906D6B2BC590AB0C64F13E836671F333A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 79c6cf407231db535d3871b2bcab289a90af74d23206dc693614e3844c4a40c0
MD5 a1c8f5bddae9bf1e00407cc8ea384bad
SHA1 04a572d7a3b616f00caa589bd51e2076a0e2fd69
SHA512 d0ad2ddbd869fe15b0b46c0fdcedc00f381faed53f634e56d05629208781852546cdfb5868338d99e665531f0eec4b2936f3c98b559649fe150b23c91b65f132
SSDEEP 12288:QtWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:Q1T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1D5C4233CFA0D18E8E8754BF8B5D6E24B86799F8CACB816C2B09CF5961437960753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 52d05c4d8abd1900d5130141518c0bf57380dbb7959b53e937164571a036776e
MD5 d622375b25a83169fb9f7f5eedca6aa0
SHA1 0fb960fa269ab13389bea8ce20bf27678eafc3a2
SHA512 d058289b68035ade2dd2739cc892bc85e973a1f9c14468492ab6ba67f83d5291c1a31658bfea776f12b8c3fa6757b77ee14a2ec9e4394c502c612ffcb073b477
SSDEEP 12288:CRWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:CpT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1C7C4233CFA0D09E8E8754BF8B5D6E24B8639DF8CACB916C2709CF5961437960753E490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 41a670de631ea2967b4509a8d5242ac80e9c064f51945fefd5644c91f42c72c6
MD5 17fb71ce1676fe199fe813d0158f6fe0
SHA1 b38d2c49a62f554cd2c04e13e03c7e08c91eaa05
SHA512 66a622ae98e0c80d79af7aaa1cc55583d46fc73fe2f5f022e6f7ae98322f06a61a20fcabac665cd5e90877dd8c853bf4b98a73a6846b2a165a368c1f52e23a11
SSDEEP 12288:kyPz5L8UWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:9zy2T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1ABF4021BB35530F8D0768278C8A25606F376B8354F748A9F13A457B61E376E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 46c74a45c373c8011c1653e6371d5772e4bd59c1aa1bbce98612cceb6975f673
MD5 12a2f83593b9cf041ed423bc7c9ba44c
SHA1 bd2bd472991640c5dfa71f2a1efc25ce10964dc2
SHA512 92d03fd59c26da3cd744a7028b1aa1c6d77b558a53be0b37c4248e3fe6780cdad1e9ad8d556e45f5e99b66ea768c5c7a65fbe098cf62c3ea78d06fd0e9aad2f2
SSDEEP 12288:UtWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:U1T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1BAC4233CFA0D19E8E8754AF8B5D6E24BC6399F8CACB816C2B09CF5961437960753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 af231dfd8b457a616397978d3836f0aa6e18b66503b93d263e0d3f962ddee845
MD5 ef752a2178fec2521ba2f8ee17fbc0ef
SHA1 7954778609a41cfba1a38a6e94f2f5cd44557aed
SHA512 d349395b50ea087b41c07fea6143caefdd78822f1a0e4b55fe500bb997af1a2b7e6594865cd0975228a022d71bf5bb6e610238d96c1e8426d3054c72c9fabb5d
SSDEEP 12288:ntWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:n1T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T13FC4233CFA0D18E8E9754BF8B596E24B8639DF8CACB816C2B09CF5961437960753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 943e54d49d6ee0dd0541ca74fd2054454254a68e89cb405988ab1c537298745b
MD5 ac52af4c74ad03dd09ba6a0523d7622b
SHA1 b9b41c69d22a30b3aed2e3b0ac0514c45dfce535
SHA512 d703878ba89fe3de22f68736e1dba95bd19913af8f48a715d768d9e2f3066bf0282b880186132d59593022a6b2e19f64ed016b615de3debf21314f74e1163652
SSDEEP 12288:UyPz5L8UWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:Nzy2T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T181F4021BB35530F8D0768278C8A25602F376B8350F748A9F13A457B61E376E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ee2359cf05d0aa0400686ff38cde7c014618f6baebcf11327e0a38daec446fea
MD5 7822ab28db047d022caef416538b1155
SHA1 83a3eb34e7295cdeed461920b552cf443173fc40
SHA512 69fffa92dc6e0644444a0bb9a36f62fcca08800515d9573676f1624a33788b72bed2376347ceffa5712a8be55eea7768dd13a523adca143aef74617799ac48d3
SSDEEP 24576:YcP4mcvIjkGOxhKP2l71SNKbrh/8KBNT1VKaL+BgTAzy9cGQAVRcUp:jP4m4IpOO67N8KXT1dCmlcGtVjp
TLSH
T11465AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8e0ede8616890e24a782beff3dd5c9c06d5d33c4e2aba535164b17513ef8bc17
MD5 688c83724b8b4537ad7a3dee4d31e58e
SHA1 db0d7b3590a55566c2e673015a2d42d2e0833e99
SHA512 70390052dcf3d45d6c06b6a749dd8c7f2ae51b227c4fe9fe300327e487a51e39deffc7d4b8c214345e651ac3e792aaff07b9ebf3ccb2eb04e84302634f32ae7f
SSDEEP 12288:kNsfdWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:1FT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1B5E4F129D25802E8D06E5278C7969641F3377D648BF1D3CB62D0F57E0F366906DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 bbc2b29c6abc5ceb65278898e5630f08b3b18469e6a4185767ba4dbe98a80d07
MD5 9d2f7ae2d0d4d132fb5bc086e37f7762
SHA1 a3e2c88fdb9b794413cbda7df47de63f9f262460
SHA512 db07c39def8ae0a7afc0a14a36c05495e5f2fb4bb21137b5a39bdd0439a7fa460dc73b7c21d5cdcaa00e4818d40ffea3f9c5ecace0d037a89fe0aa2c592b332d
SSDEEP 12288:09WhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:0lT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T147D4233CE70C19E5F8B64BB47496D21A523EBFAC5EB855C7B048F2DA14369A0BC3E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7f83cb82a1af9230b9e1906e2e4dd2cca95402699005a0f056f1eafa77deb6f8
MD5 ecdc6161171e09df49d73558cabfb22b
SHA1 1a9ff3adc38102413f8c9c3c76712f64931ec25e
SHA512 359d9e4707eec02e8af00ca432f27ea47e6be37cc18e9334864d7d4beb62a1e31174de19d3e86b583ae39410dd40964fc4066191d72713a6d8eb633eb4fd63ad
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQTT1dCmlcGtVjp:oa0hNYG4Jw+T1smlXtVj
TLSH
T15785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 ec902b4a2860a88f70565f62b81923ef0366703c36e32d001852cffc17b55c6a
MD5 6e4f20d3bc61466b94f4de8647c1f430
SHA1 41364492097fd0340105223e213e5cf6bd67f3b4
SHA512 ffc121605cf165f1ea4a115a6ebae945c2ee26feb3d3d714e480a8a38db000133c8fce6e8ec7ee6f9bd9087287d047f5379142b481ceae32f43d8b7d8b875e13
SSDEEP 12288:ehbHjfXgWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:ehbHjPST1VKaL+BgTAzy9cGQAVRcUp
TLSH
T11CE4027D666C20D8F57192BC9596820BC331BD681B2193DF22D5D2BA0F37EE46C3AE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 305cce404a4ab007b212e88b4e3b5e0b3c4313370d6060055708c2399fcef4c9
MD5 cf2b508b436301de5986b2c3ced33f38
SHA1 d2e26c065a2aad49f51a01b1b6ced11fe5f3e278
SHA512 355b9be1b283c6f1b236c5e93cff9a71a838ac3fdaf0e87d96daa06b1800aae26344f9c555a0ec0b22aa9192bfc76a192b7ba3f9e7c8f359d9e589fb28ed9af2
SSDEEP 24576:+3YgnJcRTk4yti+R5dpR/qT1VKaL+BgTAzy9cGQAVRcUp:+IgnaTk46ppR/qT1dCmlcGtVjp
TLSH
T19645BF2DF2B910F9D8AAD236450143B5FB71782D1F209ACB0174C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 44702918a8de5ff3ac0591aa33a73641f5e2747e036b28c35f739778e8381653
MD5 93fdc121d652de5e72ac5aee0aa7205f
SHA1 3efed1465deff99c27bcf0d682470be6783b5431
SHA512 0ae694f0a7341bfc42d56620a389738ae14b4af5976f3ff685ee05dab571f0a15b1cf2d691c8ba232ee679f18dfba77bc7c87b3c606d37b3f5be34f916a7bb15
SSDEEP 12288:BhWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:BZT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1C5C4233CE60D18E8E8758BF875D7E20B8239AF985FB91AC37098F6D614379E1753A440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 dd23d614b5ff911448602046f2573c62e9c71dcb030dbb18f6d7672ada870cf0
MD5 427ebd01a166cac5ebc42e1a749fd637
SHA1 2c3eec237474a46dc1f58f62a0a9b27f64339fd9
SHA512 81d93c21629d2bc4c935820102c8b992abea1e100e26b3b8940cf8a1e0143fdadbe9d0ca239870c70a3eb146246ec81ddcee3132586242b80539ae8ede834f1c
SSDEEP 12288:qOb9A4LWOsvAYFTKWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:bpL3UTwT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T15B25F119F79800F9E877C27CC9A69617D272B85C0764E7DF03A88A651E237E15E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 8cf13fe3bc26a8dcd2d34fb24e77bd2e4742f290a031bcc39a9c443547d44428
MD5 40b45e0861bb591840f5962f150eff2e
SHA1 1f7adbecee2c6d780267af1f6f1584b316e56b96
SHA512 48643fa36040f25ac9bdf5a9186f37d6bb9b1d7fd13b43c57ede8cbe2813dbea51e9a289336ff37dfd2810fd22b73bd85b6331790a0f4b42348096f65ba7b7d0
SSDEEP 12288:ypFtpOOWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:gO0T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1C0E4012D369C10E4E576927C9993930ED372B8690B6257DF02D091BE1F33EF86C3AA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c144453141df9408af2e67749a5da434600f3a0cdc1d5bcff5816ea4f7aed182
MD5 73d92c523bb31f8a139e86e5baeaa6e8
SHA1 d50efe099f85194dae440101ba88c329f47c6296
SHA512 66dbb1dfb757e7c77468eb176f1ea12d3e6803de62ba2d6789e9b85a62a53d4c5b1011561932d7d0545a79a025efbd6aeecd04dbbc35a7974608e9a6461310a9
SSDEEP 24576:K7NM9YmZqmWMUkPjZM48Mv6bEhs1T1VKaL+BgTAzy9cGQAVRcUp:K7cBWMpPjN8DbEhyT1dCmlcGtVjp
TLSH
T15B65AE2E6BAC81E5D477D13DC9E28206F6B1B4611B318ACB1152833E6F37AF45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fa4a6cbfb101ee73f3e741b7011f3b2ec4d11e0f75c8a49c04260e9388b3e762
MD5 e5fb9c6c8cb5160a7407d629e67e78f7
SHA1 5ac44dad9837c6689b1595acc1f1df64a8dcd33d
SHA512 22b6f384277ed8bd7c71a5a5c66cfee3300ea74e7ed50fa1b818eb6b3d0b4dc2642b37bf37c8572b8f6fb8f4ab379f715d3e908c375b5c8a34003c7c7d86a95c
SSDEEP 49152:pF2YuHNETovcvNYf8kmVT1dCmlcGtVjp:c6tCf8k0T1smlXtVj
TLSH
T135858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c146f6c9529c046c6b2895da7941ea5f2802c20dbfdf84976f2cf8cf7ca29348
MD5 52caac3e29b5ae49acc2c2de82e45cd1
SHA1 316e29c4f3cebb9a5738575791f3482f932b3149
SHA512 ba6e323356e4b168737d423ecd8cf8d5ad0cc2c34e55a16b42ee252f663af8d20099df5a3580545df94c6df58d3cd17b591be0f2df3a7393aa21623c093ab99e
SSDEEP 24576:qAFs06+Omlf3NXEbToYT1VKaL+BgTAzy9cGQAVRcUp:zFs060lVXuzT1dCmlcGtVjp
TLSH
T1B565AE3F62AC00D5D07ED17D8A97C91AF6B1746707256ACB0160867E3F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b5c73d81e3e0f55cc4a23a6f0b41b1df3dc1c14c1f977b121719ddedabc82d37
MD5 cd022eb7e16bd90e90f1fa85174f6e7c
SHA1 927a9127d5faffa24122c14113cf5c0a0d6dabdc
SHA512 7ea6555eacaea1b8c37ae5bbe9cc624ad4a9e5dfa72cd0f68327360ef2662b1a3698792d833bc191f4eae9c2931fbd9e3b91d89f31e009d2c9fec5e17446b4ec
SSDEEP 24576:9JnJ5D3WtzT1VKaL+BgTAzy9cGQAVRcUp:9JnJ5DGtzT1dCmlcGtVjp
TLSH
T17A15D03DD2A810E8D4B7C2B4819A5746FF72386D2F226AC724B4D5353F12EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 65ca7096ed4cc0ebe0b838c9a70506c02f6d02e7fc64077c853eaa5f5dc94478
MD5 ca776353151938d7b053cbd19584902f
SHA1 7858736a9574fda73e24e57e2336f24b43a62b46
SHA512 149c44dc6e0dd4979650b4220e89a215bb57e64894e93904a30f14ba78d9bfaacc11bf6fa3afebacb46d8b47cb711ce2c873b410dfbc0dd89050d8cf395bac5c
SSDEEP 49152:Ko06DIKdwc+eQnSt65aVhT1dCmlcGtVjp:r/T1smlXtVj
TLSH
T131955C15BBEA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 43c1395c1f2c605d94ae09983a45e763b8bcec18643890d02785bb2b1eff18a7
MD5 6dbe079751bb7a815ec205534b99fe6a
SHA1 68cce777bdf3c423adf7c461c9602f81d904b3a7
SHA512 07c45caa7f938cd8d8dc321b4d77b751a8d2f8232e5adfb4b96f817e310b368a2d4beba45883182a32a356166681887f3948e65c5efb5e4eacfcbbdc08fa16f0
SSDEEP 12288:VEP3RrjWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:WrHT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1D6E4127D6B5C20E9E43A917C9592C20AD372F4642F6227EF61D4D27E0E37AE52D3DA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 6731c519854be4e3e6cdde99008a750f54825cade3d2a73305ae04d18f3745c5
MD5 1dfc35cd029a43322a59ad5f9c2e790f
SHA1 899154a3ee5c654e9d239459b2ff2a62c9873e3e
SHA512 757bf8f3920367be832aee8b354f28dc0362b362d7c6fc9ed3ebc3f2e785e822580ff85cebb03c0ab7fea436e407041e1b5df1383944ef5c8b06eb4adf962fa7
SSDEEP 12288:rjkywWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:rIyCT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T177F41228A34C24D4E9B64678A9A382958B35FD245F3457CF60D0F67E1E37BE0B839B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 badac7af76a028259911a4075e93c69d999d1db3437228353c0819506f863036
MD5 b38c27ed3ea956dc45ec59b42d9c1f42
SHA1 c73e249265620b98421c4d013056bf3ab804a3ae
SHA512 fd9183dc6975665b67c5955d655fcde3dc902f8b828c54e412d180467b7016ec34c4697fb95a7b002f749b7f01f09a3297fdbf986fe0ed296b60b29be1655865
SSDEEP 12288:FFeWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:7kT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T19FD4233CA60D28E8E8754BF86596D2478239BB6C5FB829DB30D8F5B605379E1743BC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f550b7e3397d2a4b89ed91d84f6688949c9135d45f2f5ef1f7dc97652ca262aa
MD5 cbe900b55ba6306cae79f6b1d1362ba2
SHA1 a8cdf86c7b09eb6fc0145417b098654cb457561e
SHA512 1518c10cde2b44fafb0c4ed376bb9c2f8dd72061e5e5d9d1970eed0a7505383e89a09ada4da4f2c328a4de033a314661836d69fffb878395cfaedfd8f7cef6d9
SSDEEP 24576:NQ9MxZKdcz97w3dT1VKaL+BgTAzy9cGQAVRcUp:NVKXdT1dCmlcGtVjp
TLSH
T126558C2DABE9059AE177D27595A250C3A633B4301B35D6CF2448D03D0D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 139caa1fdc802cd0bde2804c5e7cba67e564959f1f2db4779ea4e33ab183b574
MD5 a441240e0e22d01ed87b22ae59b7fa69
SHA1 c59dc5d6bc392204bc3de634538ebb2aa045fd94
SHA512 0bbf5f1dcd060c47d9c460ff73adb7ce6bea5b1aebba665ea20ef42f5ffa38e980d1194cecdc6b8d748dd4249d898e95f843259d6911aa634e749950af4c1089
SSDEEP 12288:vyoKo2HRple9pEWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:vyocxApGT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1BCF4EF2FBB6D40E2E076823C89858345E773B0745F6257CB6191C33E4E27AE9BD39A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 91fa29847ce66966062121e77b8c5ece62c658066b95726c3d8c57967c829b8e
MD5 6ad9c033c7827837176212fa092deb85
SHA1 45aaae9bdc5ad5138c7a85253a202cfae46cde7b
SHA512 d07493be4ea36cc57fbb798313a174259298524da5d00bcc47095ed396012cd68eefcfd5f494e1f091779c78c8a1debfc3cac445c68ddf4060b77b2b2c171234
SSDEEP 49152:HWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKGT1dCmlcGtVjp:/0zuNIaT1smlXtVj
TLSH
T1C4A57C3DA2BC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 da17df19fab8af7a562ec9c55ee2cc57d91fcd345b54e962cc4aa2904a03b50c
MD5 66cad488fec8d3fe488f18eb05b279fb
SHA1 a01292e9819358070922c8868d0e57181caa4728
SHA512 105f7f917e5a4b8bdb0de69c5052f50e29a71571b115de76afc9640f3bb2b7a3c94796a120ab4191aa8ae6ffa809a791044fe7b05add8cd15d305830b2eab3bb
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYtjMqbHT1VKaL+BgTAzy9cGQAVRcUp:RTDxR+N5YzTfjMUT1dCmlcGtVjp
TLSH
T17855B02EA7F815E9D17E85789A23C512FB727861073193CB42A0C17E1E3B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 0c9f4b0e2fc514fa050ae11031cec1a08afc16243ba83aa28fc9c2c33743a911
MD5 412168bd80904680b5905db037e9df5c
SHA1 94f9ea36dcfa3f3af484ae64df2ba4d5ef7adb1d
SHA512 a0ae961cd493d7628ee74ed6854302c02febb664868781068818c4e761dc21bc1e59eac3d602982d078b13370f3eb2f171b19e81cefb378532cf31191c5a80be
SSDEEP 24576:9TMdOz0FFS+imSL7T1VKaL+BgTAzy9cGQAVRcUp:H0K+imSL7T1dCmlcGtVjp
TLSH
T1F415F13EA36D14E4E47BC27CD643C906E672746507216ADB06D0C1BA2F6BEE4393EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 726c3fa92d2ce4d3f6f37de4b4a0acdb11145c25ed155c23eac26a8c6050d85b
MD5 9ff2300ab6dcb1f57535a00ef4291d07
SHA1 778ac788a6149c93c7f521d8386ba2c12fc47ca1
SHA512 444e232cbdaa5d40b446a22cd93f2cb41f0a965c431437d2f907768333c95487c55296c7ea02d5bbf055a296a785ecea75ec6738c18d32ad2e5fc51b4adfb8d6
SSDEEP 12288:147KWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:QwT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1F9D4122CA79C34E4F47296789A668246C231FD781F741AEF30D4E5BA0F379E0A539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-402-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/448-210-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/448-216-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/884-86-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/884-545-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/884-74-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/884-391-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/884-82-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/888-187-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/888-196-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/888-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/888-193-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1028-116-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1028-393-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1028-110-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1068-6-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1068-80-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1068-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1068-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1208-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1208-544-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1208-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1208-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1408-392-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1408-100-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1408-106-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1548-13-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1548-22-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1548-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1548-458-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1680-146-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1680-397-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1680-152-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1768-533-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1768-56-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1768-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1768-50-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2432-167-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2432-173-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2432-399-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2612-398-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2612-162-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/2612-156-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/2620-206-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2620-200-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2620-401-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2688-183-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2688-177-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2688-400-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3000-404-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3000-236-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3328-394-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3520-95-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3520-406-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3696-131-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3696-125-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3696-395-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4244-241-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4244-247-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4244-257-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/4244-290-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/4244-546-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4244-273-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/4244-405-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4244-453-0x000000000B770000-0x000000000B778000-memory.dmp

Download

memory/4244-447-0x000000000B770000-0x000000000B771000-memory.dmp

Download

memory/4244-446-0x000000000B780000-0x000000000B788000-memory.dmp

Download

memory/4492-141-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4492-135-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4492-476-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4492-396-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4492-478-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4636-36-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4636-29-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4636-459-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4636-27-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4652-226-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4652-403-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4664-462-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-461-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-464-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-463-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-466-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-467-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-471-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-473-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-460-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-470-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-472-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-465-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-468-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-475-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-474-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/4664-469-0x0000012D3DC80000-0x0000012D3DC90000-memory.dmp

Download

memory/5036-70-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5036-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5036-46-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5036-40-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5036-81-0x0000000140000000-0x0000000140135000-memory.dmp

Download