7d4bd5a31c2db12b1ee449383f6174260f5134ef897874ffeff5fc9ce1a743f1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260415-e74bvaas2y
SHA256 7d4bd5a31c2db12b1ee449383f6174260f5134ef897874ffeff5fc9ce1a743f1
MD5 de6a188d254ef2de1bd9132024ce5415
SHA1 de540136607761354cf8b85bdfe59ed1d7af6ef8
SHA512 de34d0f547549157e85febbc40cc5904edce91917f25a07c9856961d0172c14c141d8ca58093d00fab96cdca251ed3f360d37c42e6fe6ef9bcf49ad9334a2b04
SSDEEP 49152:0gh8jK3xEPK3Hkcm4L8A5ilMfJJnB58MlSKl2HJpYtdnYz5d6JgCg:0MYTKXkcm+fJi3z50GC
TLSH
T16CE58E6D7AED00D6C176E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3948	alg.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4920	fxssvc.exe
1304	elevation_service.exe
1780	elevation_service.exe
2840	maintenanceservice.exe
4824	msdtc.exe
4536	OSE.EXE
4888	PerceptionSimulationService.exe
1768	perfhost.exe
5524	locator.exe
5900	SensorDataService.exe
5692	snmptrap.exe
1536	spectrum.exe
4804	ssh-agent.exe
3364	TieringEngineService.exe
1920	AgentService.exe
5856	vds.exe
1840	vssvc.exe
5148	wbengine.exe
648	WmiApSrv.exe
2776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\78ebc24afd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaw.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ebe7d5f91ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000945b9a5f91ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004ca855e91ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000339175f91ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f2ff05f91ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093407c5e91ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025cc475e91ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ccfaf5f91ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048fe1b5f91ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ee03b5e91ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4508	DiagnosticsHub.StandardCollector.Service.exe
4508	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4920	fxssvc.exe
Token: SeRestorePrivilege	3364	TieringEngineService.exe
Token: SeManageVolumePrivilege	3364	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1920	AgentService.exe
Token: SeBackupPrivilege	1840	vssvc.exe
Token: SeRestorePrivilege	1840	vssvc.exe
Token: SeAuditPrivilege	1840	vssvc.exe
Token: SeBackupPrivilege	5148	wbengine.exe
Token: SeRestorePrivilege	5148	wbengine.exe
Token: SeSecurityPrivilege	5148	wbengine.exe
Token: 33	2776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2776	SearchIndexer.exe
Token: SeDebugPrivilege	4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4532	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4508	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4204	2776	SearchIndexer.exe	110
PID 2776 wrote to memory of 1252	2776	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3948

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4556

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1768

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5900

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3120

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4204
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 097480e77accdf5f3edd843eb9911993c6368fd99fe28b70fb142e23ed2820a6
MD5 270cb01014e02dbd614c09e62dadd676
SHA1 643e70d9062c4492ef128a5f1c53eed57811749b
SHA512 f5193642c1f4e6c1603a9e9a038446cbfbf3ce32c18b5f1aa116d88b1d024ca32dd2d62ff614d74132be6d3ef0c24dcf083350d4b5b746a18c0392ee44a160ee
SSDEEP 49152:Ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxndtdnYz5d6JgCg:i3q6mjBBz50GC
TLSH
T161D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 80e1fea096994a9dec258ab873ef60bb9673a098a14a7a6efd40fb8d1fbf2547
MD5 4dbec953009ff6bd246f16abdc240dc3
SHA1 392b0628915f465b5bce6547e2ee0b0dd6bebc41
SHA512 5dc8f41e0d7095ae93a4b5f492a87fbfe13dce9efc598be6c4905bac3fd5296d27c715f8a6bd5f0883b6e9494af11a6cb8c87a5ebe4afe5db43a2db784318f3a
SSDEEP 24576:WXYfDtczAutdykir8q0Hsw47opM6g9+JVuOUj7Cg8:VtcTtdnYz5d6JgCg
TLSH
T11985016973E408F9ED6B8178CC62C501EA737C5547A4E6DB03E4AA250F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 82b7ce4f3aff2c6aa690deec3f03f7d36c516bcec175c79a8367c432a00f8fe2
MD5 ee3d32192a9b6f153ecbf02258387621
SHA1 50ed6d508b2678b0ea8572d880c572cbad9ae0da
SHA512 624ade92cc70fe724998df7efb81c709848d4c2c210eb40fe64118537eba8ef38d54b26aba541c9c91c1cf54e5c0807448a6177f16d4af1c0600323a1f028b1b
SSDEEP 24576:80Le5ji0hmxhrMFtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:8Pji0Az4tdnYz5d6JgCg
TLSH
T13395AE56F6748331D073C0B9C5D2A68EED7234825B3089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7d06770b5d018616fd6c04ec067d117714ec93f256d6b44d0a2deebe90bc3677
MD5 7476333570227fa8841aa9cab85a83ef
SHA1 07664e6e6e27bff7f8e9e2fee1e7a543b6e6045a
SHA512 84dcfbf9d62b46d2ac3ce8e0ce1f08c10fa1fc66341d84b7dcc660cccbb48e7606d5e462b2feea9a78c4c23e7596cf1c8c62841247ccc1fd4ef2ad44bdac3cbc
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWj6q8wyuDtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:b/ezSC6vUzPv+Hjy0tdnYz5d6JgCg
TLSH
T16E756C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 89ebfb322e05320760b7b77475548b7d96353e0a813659c248c0e17dc06a3d7e
MD5 f5632538e1378955ef890780da04aa3d
SHA1 ba79c36181f46de04ddc942ce667728dc1a9fb91
SHA512 4de46c139718af92e59df3addeed006c19cce9f63cc538b8e35ff9cac3db6499862d6081493bc1adfafb0cd2caa0b87a0fab64a49508f3a7e6339f647b9c0ba6
SSDEEP 24576:nVbqPb88hv/l+Bitdykir8q0Hsw47opM6g9+JVuOUj7Cg8:nVO88hXl+YtdnYz5d6JgCg
TLSH
T138559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0b49cf85a2c0de652d1541c3632e7f08570dbfdb60f1fe0c5015a55c7477138b
MD5 a14979bc76828492b9e41755128ea4ee
SHA1 9c995510a5793cde1f9bfb397e27f42ca406e14a
SHA512 d01ffbf0cb10f761ab8de0b947e56df773443024953a5f80794514a6214e720db9806370ac915535f49492bc4a9369d8feb4c76e92eb61e79a75b4d98e5d4949
SSDEEP 24576:NGptdykir8q0Hsw47opM6g9+JVuOUj7Cg8:CtdnYz5d6JgCg
TLSH
T1D76523D3A65C54B5DBFF45B1D80ACE04665DAF5988EA88B7E2643659887CCC0C338B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 416bdd973029927a229065093c34aef29dab74c54c19f120c04389bf4a48425b
MD5 0ccd62a47099298b2da44fe7f8c4e688
SHA1 c94db0a9c656a441006805a8153f55b6631f7b90
SHA512 5ba20d409b7993881ff6e339e292c39c9ac3d5b9a4f42055a4427c036be0ba48304b14123d067fbd62e9bf2a3be20a3dd99dbedbbd5cc574e31465f2b558168e
SSDEEP 24576:NJIUKtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:NJIUKtdnYz5d6JgCg
TLSH
T11085CF7BEE28FCE2C27E8DB95A51C600E76678304F6293CBE164920EDE235D04E79D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b7b520be553113fbd0913b1f2f17ab98a01931d423bc3d35b9acc08189de765
MD5 66ce49cb511fe47edd5bea4b8557f39c
SHA1 d32879f020f8bab2e783b034668b13c18f5b2244
SHA512 4919d61f67ddb5d4fdf91c0e94f19bc69920114dc9e1ee527b4a14742e71483bbe6f1cb470cbbfb72bad8b8823f12416ab0a05ee0cb5296b5127893c627d291a
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THL:1QvGAdlCEL8c/WRNw5Ccz50GC
TLSH
T15F266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 868a4fd2831c04a6865e25f7ece8d9915459f2c8ec1f42e7bf290900d9be7285
MD5 c02b36f85de214088223a900198ff621
SHA1 f8e824c9d6130cb8a3d9bfbe3991ff5d925b83e3
SHA512 d7bf19867d7d237157e66391f83e178abde8c6ac8479cae5acafb5c842b030365b3b349719ca8bb49d91dd972b75c7a9e97f059977195380e2a77a7e057897cf
SSDEEP 24576:sfewsAjotdykir8q0Hsw47opM6g9+JVuOUj7Cg8:OljotdnYz5d6JgCg
TLSH
T1C185E071FA74E036C6BF0DB21B26C716146D7E204FA219C3E3A85E9D59342D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 253472464450b07b3b27175d3a3e1e20a7a04d2c92917886dcae29d593286262
MD5 96170ccce1d6b58d5bdba9949d7db179
SHA1 cd1f6fa15f7f9dab3719a2a758e3a69aa9592b11
SHA512 25e4e8927c443203afe7d84621ac6d121d48e256bf5136ca29435b7797168885b5f34b5dcae8de5667cfd98d287e9d877c2012b13c5da32f8d15563259f13507
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHf50:/UEtQevvqc2W1cpV20I32f
TLSH
T14F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e0728ab2f5881471f388549ccda4000fe8b81e4a920005c218d232996b5a5985
MD5 c5ff6c027d8d10db879662f58d5e282e
SHA1 201500e1724d51053e2d568cd4e7a2e70663fc18
SHA512 1b0ce1774f1abb7c093040dd979898bfe34e23ea117dd2e3b1940bc929bd154be3266ccad61b8b958b34ad4d1b621191d0436c2faf6b31f38379d8acd980c273
SSDEEP 49152:NCbRquA/m2yL5zLfFiV+XenmE3/zItdnYz5d6JgCg:qoq2Vjnm4z50GC
TLSH
T10DD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bef07656aa8877fda418f1cfc5a4fe04371c7f6f99b93ce9293fa0965469551e
MD5 6a4ec4d234c59f1cc91eed729f3916ee
SHA1 a5f3ae18e921c5483fdc13aaed397c2d60f051e8
SHA512 ca9dfc3a81cbaff6e63017a511b07da65ab377471b143baad007c20d66eab650bfb3e9df55c743083119b3cbb3709dcf5ced3315f7a7660b1963415543b395e2
SSDEEP 24576:1AhGL6IFoiwtA5l7S53ftdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1AM5Foiq5vtdnYz5d6JgCg
TLSH
T185359D81E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3c881477eff4e3e2ab10ed36687d51e7e781a9cf4674df0ea0b43c4086ac68b5
MD5 61c0c076c74e5997517ef00cc9e5d889
SHA1 2cc89804f85b8c6d79b279fc55b797969f306dca
SHA512 ebfd80de30d854385aef61bf1a086bd1b8b1b57420211aa5db7a09d116067b7aac00578f5cee8670c32f54682fc22371454d6c55cdb1b67e64d157d53837352a
SSDEEP 24576:CwuROWUtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:CwSOLtdnYz5d6JgCg
TLSH
T13775F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F1360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 66899ae7643d6aaa98783ee12ed71521137bd1cb06965d08a9d99d732cb21f75
MD5 2f1cf4f80c524145e8c906623bf4da20
SHA1 941174095c86fb34bb38c6bdb494b9136d10411a
SHA512 b836785faca6e07546ba563e8bba820c76c2121e600df7a15d53d9b79ee90ecaa4a9925bca19860cbddbd809a21b2f9107d077f666fee208df20248b13a1facd
SSDEEP 24576:tZuNtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:+tdnYz5d6JgCg
TLSH
T1D16512C633E820F9D5B78278CC958A04E7B67C5657B683DF226423695E37EC04E38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 685bd1cbf3009745433b02bc1a9c9207dd6921e4f3be67f9cc2adc078218ba3a
MD5 5b836e2df7ac36cd3be068878dd2ba06
SHA1 32d4f13938be619c893d4b870cf3c91a03b42369
SHA512 d0e3b0ab3f950883a1fb83d4c1c1de4b875c40d8d51ccf5f831cf63002cb477e9d444957f10d60639f14e18db07a8ddecf8da5382b9c07278d99a5452541af67
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:1QRQyi36YOcPDLvw2gAf+PN31z50GC
TLSH
T103667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 44fab71e019801badd15cb5c8a8c67b886d2ae32a5cb4f210b1950a01e40e456
MD5 a5b9dc1d40079e351c35ddfc702fa628
SHA1 fed42497a420cb8f3e018ed1ab14c8353a05347b
SHA512 c8288abe51b45496600b34e2339a879056a563aa0a05c261bfa95f406ff61bbb1a0278527b4fff95fe6321f72e0a24c14850641c4f04545d2e30e691993a3276
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:WQRQyi36YOcPDLvw2gAf+PN31z50GC
TLSH
T1A7667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a737d6ee5ec94a6a69b1dbb1cfbe9b86173639f65250e9357f5aa000a43f7d2
MD5 ecacf2c985f5ba379a4feb1c898e4243
SHA1 38847d51475634206dea32148d3b4929c889b1e6
SHA512 91a12c0afc925a367570a4dd67435e45b2eb763775432d8688fcb9271071cc4cfd9d3261620dd1d0c20ef519665c3898d20fbbfd9d57a58cee5efd806e437a88
SSDEEP 49152:n68Qg55nhkeWu7PNU3/4tdnYz5d6JgCg:RthTRc/zz50GC
TLSH
T11FB55933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f0b0c2dd7f3a6a4a6da27dbc60865a22c59817f56599abb296250da1aee76479
MD5 4c51cea2614c2191b8e5fe2437e519cd
SHA1 d35c945c17f4baf4ef9802ee886896da86556662
SHA512 4c8feb7d17338e0f2065d55beeb66ccf1a2c4c33c722755e0b1bceb881ecad30051495493fe6e7ea8bce7d19122b56c218b30860524c5e6c857633d74d85653e
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99t:dy5112gYy5azzVvU69nLKnhZmz50GC
TLSH
T1FE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f2048d2c5e6323fdaf63b9f0c59126c6b1a247b55b6bae04c42fd6a2db70e0d1
MD5 88fdac36a7ed3ce049f0719e0613b639
SHA1 be4794dd7b0b395c3630de985a3541060d1a5fa5
SHA512 c1a14b599cb8f652250a03c8c5721bfa60c1618db7f5198e124a6b6d529d87887e7bfdd76ef7ac2c2e24f900007b38c99493a9b923d9ba0d927aeacf40d55ecd
SSDEEP 49152:qB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+tdnYz5d6JgCg:4u6JmIxd2dtz50GC
TLSH
T14ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8751ea09f1cda080bc95ee69e9029d4d707a29fec644358d000c1d9de664ea35
MD5 f02850d906bcc5902c83a6fec09926f1
SHA1 f9cfcd78707e8ff9a287bf1720d217c65c8ac6e1
SHA512 b29ac018eda4619a3de85e733abc494f8cc3120f1204c4fcfd26e61864e340a301b1e4e81f185ea82c839370c1a91fe03ffeb7814cacaaf44e4ef9f5bbd9a5bc
SSDEEP 49152:e1hpsNoJpF1A67U44CwH7R4xqtdnYz5d6JgCg:emifPqR4z50GC
TLSH
T1C4B5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f67d2dbbd4cae686c8510b3991004d1e1c33768442f0d18915869a0d57c89401
MD5 e38910c33aac7b7379fae58a8de8198a
SHA1 9bb3b6dd81a3d65f873ac6b33922d2b8e6e2271b
SHA512 520dfce34215f3c0047ccbbf0ddc81d5c97f5e942f1db1ee476274cdee08a753b7296fa6d2b86a7b4837d94f9d96cdbbcd2c27541c9912046a37cb6b6dfc05ea
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHqNtdnYz5d6JgCg:t5dKqi61qz50GC
TLSH
T1CFC5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 97663a49e3aa0dc38f7e50c2a666606c6f28ed3130f53b8ab4354e342ded655f
MD5 51c2968e1c11e3236d42c060b03cb939
SHA1 4043b493933958232f0f495667ae67a7b00effcf
SHA512 517eec5a31d9a9729636af6f0163a7efa5d1a44bbff126eff51706484662562b8b4c82bd799878faa6fe440bd9c1bca37f540400787e4b532c570fdd8d46df99
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5wutdnYz5d6JgCg:JX2iWphkz50GC
TLSH
T13995BF13F2D900E8D06ED174C7468632E962BC160B39A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ace2c344b1c04b68c62a836eb08e246eb57ddb5b5c5d617245d90417e8a1ea70
MD5 76b0dbf1dedcc700411b07bb0ee47181
SHA1 f83a1275b653f753baa1f231aca1cfe85b3c8e19
SHA512 7ce3dccd9de364c7463a4130271695715b990cce89de58d3f0cad09d1fc86e6a036629d215e5b1a37a68d77a2dc0964b38be165818c8b4a115b947048aec61e4
SSDEEP 24576:fxtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:JtdnYz5d6JgCg
TLSH
T1F06523D3B59D45AAD9BF82F1C80A8A44659D6F5BD8EB80F7B35832158879DC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 2f0c36df117014983a26fc4f7909f1adcd90cbe90ccc1e51ec02e9afc659ba5a
MD5 91f1889d97d1e0cdedf2e1e98d99b509
SHA1 0aade47c12b8ce8c507e40a27b37d651a647c8d0
SHA512 7c6d4f50d6c226aa5a3f290cc36b0046d7c3eb0d48aae012e4f8597e20b6d9940e455ee5fbc9e617fbf967566a099a29c1e0cea3e72b4a715bb69c146ca2bd51
SSDEEP 24576:cMtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BtdnYz5d6JgCg
TLSH
T1B06523D3B59D44AAD9BF81B1C80ACA44659D6F5BD8EB80F7B35832158879DC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 6d7d0cd600bc6f7dd8cdf1b5c2b2b113ccdeb417bbee1e2feb1b302ab7e1f2bb
MD5 6e9f492d2405a09cc7287a043d6dfdff
SHA1 a033a042ab6bf14b9a5bd46930a68fa6882eb72b
SHA512 e9ab83e464a5f2d4ad9cf19aa20f2aff426a56c004339c7aede8f44fa217d449ac8383d321f518b0297d9c2a735a61dde7b8ea0bc5749740eb52155beb1b00c5
SSDEEP 24576:4ytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rtdnYz5d6JgCg
TLSH
T1096523D3B59D44AAD9BF81B1C80A8A44659D6F5BD8EB80F7F35832158879DC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 9d379efb6b4316e943a3f7c8432c75cc912253d34bf5374941bf11b384cd4843
MD5 322bef9cbfc99912c2d1f31165783bd8
SHA1 de425dcad5e4559ac5064c0cbf19a5a30fcb782c
SHA512 9bb44920f8abfb4896415ca0aaf1c5d02550a1fb566f041aa23ab4942040a45607fdfb1fa893d86fdab8d81e338910bb494e0761585d88cd8fd0c779dc70048a
SSDEEP 24576:utdykir8q0Hsw47opM6g9+JVuOUj7Cg8:utdnYz5d6JgCg
TLSH
T1786523D377AD40E5D9BBC2B1C816C604E6ADBE5ADAB684FFA35036194C75AC04234F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f2c17ba89c022f03769f275c1f179315e8f07fc1745bc72a3b3286ec7230d165
MD5 aa48543a8471d5caaf7e7487667de43e
SHA1 aaedf1ba9c03634c9e6891ccdb63f433aea58b1d
SHA512 bbae2eaa3e0408c9cebd23a18130143dd615b273f894f355b97271620d5fe7f996ae982548c054e9910feb475f1aaf75fd7dd2d131ddee0490df81d9191cccb4
SSDEEP 24576:e3tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:utdnYz5d6JgCg
TLSH
T10B6523D3B59D44AAD9BF81B1C80A8A44659D6F5BE8EB80F7F35832158879DC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b66406a9815a86276e530ea53dbba756eb2d2fea384166418e886b5f31238d0c
MD5 4d340e31f203063c3a55fe9ef1b25895
SHA1 e8ea30e11d0cc51735ade88fc7b5b7a410657d19
SHA512 ca06fbbd0e6c6e6ccfe58403a16a715fcfe70ed7d6c9b8727b4143163c7807a2839a1761e98ff963f7a4c71f8237d73464a8ed7e3e4c6598b450464525b63ac5
SSDEEP 24576:LQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:0tdnYz5d6JgCg
TLSH
T1E86523D3B5AD44BAD9BF81B1C80A8A44659D6F5BD8EB80F7B35832158879DC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 41a012a5bdc8f9c368c7582c010b6f0f6f7c741043a9a92d1d909ecf8c296caf
MD5 3356785661946a7770247f9e5c996afc
SHA1 ae4790404f5f4b8cdcbe4f7d950532e6168ffcc5
SHA512 b29d0da37afc64932f35b27361b726e7c91fdcee9074dd601158971a3695011e531a315f637701fda55a08788821d0928a05fac2d9563677da0d4f04ed267b86
SSDEEP 24576:Iktdykir8q0Hsw47opM6g9+JVuOUj7Cg8:NtdnYz5d6JgCg
TLSH
T19E6523D3B59D44AADABF81B1C90ACA44659D6F5BD8EB80B7F35832159879CC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ed047c1f74607f1f65948b7c8a7a1c6c8ea7304e695474e025a7e631964cebff
MD5 d70943fa274f46589268e64c386f175a
SHA1 b6cb4c5c014b758defae733106c225ca119b8417
SHA512 7f548e660ba373e0533e858a28ff96700f566f17eb6757835fe9039c6bab813df29a8a39c3964d46b0c0ee29ed7d1502c0383c5a02bfc411f8adaafde1261586
SSDEEP 24576:cZM3zFVSOstdykir8q0Hsw47opM6g9+JVuOUj7Cg8:cZM3zfAtdnYz5d6JgCg
TLSH
T1F9850195B39418F8ECB7823ACD158905D6B27C5A4BB0C56F13A4362A5F337900D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e7b5dcfcf9f73ed1f35eeee28c221702a29204b34b104b05aec8c8872b4c6974
MD5 a480f4f19141348b99397657991f0fe4
SHA1 a5bbb58e458791d000519b3f89829adca421189d
SHA512 e1083b18c3b0d91fe22f508fa452769be82a2c9e6fd6143027114840d5a19c9adc8ea14bcdd687d11c5c6a9f21b927aa2e1d922a9163e893057af576fce6e324
SSDEEP 24576:V9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/tdnYz5d6JgCg
TLSH
T11F6523D3B59D44A9D9BF81B1C80A8A44659D6F5BE8EB84F7F3583215887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 324dbf0fe3fe2af7cee580fda7bdab1e17c21d9b385cf5053f8413bbcb14dfb5
MD5 9e2e2885d26d8f69bb5e3ed915cf7ead
SHA1 bb6289de3706a17165e3f346bc63ecd9ecbbb20e
SHA512 397281c4721a865344a9a929b89f80e18d1d1f8412a923d1ed0819d9a52232844a1d04d4daa577f0e4cbb58b314c35c1702a68dd538306295aab88d5b028b6b7
SSDEEP 24576:LZtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1tdnYz5d6JgCg
TLSH
T19F6523D3B59D44AAD9BF81B1C90A8A44659D6F5BE8EB80F7F35832158879DC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 2a7fe2a4e7f539e2c1a6e8866e5eff4151db37182f357859bbddb84e9dbfbb40
MD5 bb32319c44b1941d7093cbfc68019ffb
SHA1 68a12c8f348a1acf2f085f8d0cad096a8457567b
SHA512 1cf33b1611c831d00238f7641199fe6f12b6e6f5f471f001b8cc3a90f951c2413eb2222b9c721ab16f6536330bf5a07933a57a44b7e201e1f4852d0730a83098
SSDEEP 24576:2zyYtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:2rtdnYz5d6JgCg
TLSH
T1B875028373A520F9D17B8274C8524A01F77ABC364B6589BF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ea72485ae9a352d2a0654433bdf906ddc72b1a84c4fa10a129a4f817862e4e2b
MD5 743bc5334a10099a25bd7ca32ba7e0cf
SHA1 6f38c20611ab7f1d6fe546b0904be0b37c0636f9
SHA512 e76e1516c440f135be3bb15fe26e1f96e8971a232c4303fe4dda0c825d071585137fe142400158d54d065d5344e9c97aa9123398041e9df97e5170051a712739
SSDEEP 24576:G9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:gtdnYz5d6JgCg
TLSH
T1B16523D3B5AD44A9D9BF81B1C80A8A44659D6F5BE8EB84F7F35832148879CC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 21de302ae27582d55a9d18b2470825dace687a8bf85299ef2a3080e051e05fa8
MD5 118956ce68815ff35bc1bc59df468bbe
SHA1 a53fe055d9f419d7ec2f8c8515a6bd2123b57521
SHA512 9077e39388f7cbd937e4d7ed2ea55ffc15c58d8a0e0ef74b974f2a1b8148c2ca398b92d1c8cf4de0ee3ff5221d3fbfcf2a371c91b269bf2e59d8f1c8bdab153a
SSDEEP 24576:v9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ltdnYz5d6JgCg
TLSH
T1226523D3B59D44AAD9BF81B1C80A8A44659D6F5BE8EB84F7F35832158879CC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 cdd531ea7c0908721bc8c773e99652c4bb48b89f3c70521939d1b01751b3fab0
MD5 589476776f2f088aa0873d1d83267cbe
SHA1 c0aec2981af40d928c83f2b27d15b5546a62c4d2
SHA512 651302af0d092e9d94a7b9540c455cc7a385782f5f7781fb8d4ab734298139c547a37bff22491117e9c3e704be5a47497a0df79463367d6b4199284dc7360554
SSDEEP 24576:ozyYtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ortdnYz5d6JgCg
TLSH
T1D275028373A520F9D17B8274C8524A01F77ABC364B7589AF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ee1611e50a809480b0b27889559da17a4b2e8e8355204b5c62cb0e96f364079a
MD5 14fa6acca89d1a041164de69ea6a8b06
SHA1 c1884b3cd527880f064478aa32c5d3f0f8277559
SHA512 e2cf0ae98c278dc8800c395bbebc8ddcb58db17b688979f145680f003c8334dbfd6264a2bfb1579361a1cdb02db41ea399b522becaf5b0a3ee6c91db86daa99d
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71nNKbrh/8KBVtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:8P4m4IpOO67W8KztdnYz5d6JgCg
TLSH
T15365BE2DABDC0096D0BB917485658A49FAB1782A1F3286CB1160A33C7F77EE14F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 c4b051621c7f9ba96c2c0ef3166394a8d15a4615fb82e0a5a8448efdcf7551c6
MD5 663e3f3ee30bf5e533226e1417273d7d
SHA1 8519b5e736b2aecad0111971e75a86791dd704ea
SHA512 b5ba6d16502e1d7095e9dcaab567c0b8da8c2f410987ec968762ad7a0b14dd68aa78f6db26c7f4afdb68512822320607092fb43c593302c303721836a58472b8
SSDEEP 24576:PNtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ltdnYz5d6JgCg
TLSH
T1C375F15AE29801E8C06E5175CB468A40B3677D6587E1C2DB63D0F53E0F7AAC05EF9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 99cecbad5d30baf8f0822037424848fb231348ace92a0621dcaa6e03fb67cd56
MD5 288486eaa6bc341a52babd6635f8f416
SHA1 7713d27d49fa07d3dd9612acd86c0f355bb8253f
SHA512 e7620511b2ff9de7065f731af8a015134b852766a84fdc75a7110eb139991b76ff14f0492d0803d8f9e4873828e7ae6e806678e3ac70cb4d77ec9edfebe26255
SSDEEP 24576:Rttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RttdnYz5d6JgCg
TLSH
T1FC6523D3A39C446AE9BF86B0880AC514665E7F699EEAC4F7F25432598878CC04734F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5a530778770a375d9ffd5809cede8d65682f80f1e68237f53ebc499e80e35dbf
MD5 d6e5d41176e7a7c847ebfa1144b575ed
SHA1 f24c9ca42c36b3decd938026b429e3b8e084ceb9
SHA512 0a7a21b7b7a470394c25154564693087f3d0a0225191f4084d2ea13bbecd93757930129e25eaa2d2192c5eeddc9b81f4174306089a05bdfa7bc9f1f5d7ee6d2c
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQ3tdnYz5d6JgCg:Ua0hNYG4Jwrz50GC
TLSH
T1E7859E1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 8ba3383bbae8bfa8ac0ef3f6a344a5104efeb76da6b4fc423f91757df4c8616e
MD5 b8cb462bc36cb99665311484953e26c1
SHA1 dbe2f99fa1829382dec488b66aba28d67fd4ef3c
SHA512 80ebd1354e392a18a992121df3b31cd4d77fe1690c5df37124be0c4dcef1e0f8252bbee125148d94cd6e6dd6d684db593c1bb2e12c626031f7036557d4fab020
SSDEEP 24576:lhbHjPctdykir8q0Hsw47opM6g9+JVuOUj7Cg8:lhbHjktdnYz5d6JgCg
TLSH
T1296502BE26AC10D9E576D1B989468606D335BC261B6293FF63D0A2794F3BDD00D38F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b840d1ccd63a33919b90aae834862fc7dc58f620b2a40f2c435cc65c76175ff7
MD5 9241d57d6211f89abb34eb9ff965c5b5
SHA1 8808b29eca6862dbf9b03ef553638a882e416a41
SHA512 1732ab3a04cbcc99ec657db2337aa63c0d552feffdcd1117ed9d2b936946cf258643b77d48ecae6ec243cdce5761876b83ee09fda749dc10fb9d97fa34004682
SSDEEP 24576:n3YgnJcRTk4yti+R5dBR/Utdykir8q0Hsw47opM6g9+JVuOUj7Cg8:nIgnaTk46pBR/UtdnYz5d6JgCg
TLSH
T14A45AF2EF2B910B9D8AAD136450147B5BB71782D1F209ACB0170C538AF1AED85F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 69715930fa0f4f9de1159265597fbc6b5bdb84da85687fca474fc6d120299e6a
MD5 802cba8d4612245b60277c8c6aea0771
SHA1 406012c98f463c80d742b648e762ba79769b1502
SHA512 1d7c63618ed28e5d62453c64b6b6b8eecf8763f0fcd30d83ac3fa247e8508c7ea681e390e5f0eb19f3395670bc75e4b63331d12da1ceaa809a033f7a8957a19b
SSDEEP 24576:TJtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:TJtdnYz5d6JgCg
TLSH
T15C6523D3B29D44AAD9BF86F1880ACA04654D7F5A9BFB44F7B15832598879DC04338F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6192b3254d5f4542365eabe4c1006bcf2bc8afedb80381605f6a4f9d57e7e054
MD5 f2ee1dac6f970e94f39367706f425a8c
SHA1 b21c3b1d22ca344f03a25b37c40a3d5bb03d95ae
SHA512 59894483d098e0111843b85c1ca47e336be12ba12e07570a0891f5e20c5b7960f4c91c3669e039a4b3ffeed6b5c234147d1b973ba8f9dc22260b18fe0bf31cfb
SSDEEP 24576:qAL3UTutdykir8q0Hsw47opM6g9+JVuOUj7Cg8:qAL3UKtdnYz5d6JgCg
TLSH
T15C850155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3f1d9c5531bf7c05bc489fc0b37b69b173076985907ffa1642c56d328d60f1fd
MD5 59fedb19a6220c481b27722e4e89b801
SHA1 b1de6e117b094b70077e7cfdb9d3d7369294c993
SHA512 7cace35b324a7f5c034ce1627c059749fc26095b874f56634d15f870ba2e0e2e526bcb322bfc1307e7376d23449837f5f9b07e0845bbae9896aea0304017b497
SSDEEP 24576:mOqtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:mOqtdnYz5d6JgCg
TLSH
T1D975129A32EC10E5E57A91788942830CD376BC660B6243EF42D0A17E4F77EE85D39F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eaf4f3e7b4db75ffd9af51fc184435243f980cb1aa47085c6301a856d0e8bcc8
MD5 f2ef5ccd4a3ade833f982ceee3fd2474
SHA1 f08aea1dc21cae0a129e27c911b0d90615f12202
SHA512 9560ccab5f626c1a65ddfa318e9be4d41eae6d3c7e98c12968cefe5e4f32ea277fb29521c7f59e27a303df0b13d59d97d1a99c2b9a50190587a0635ff438e8cb
SSDEEP 24576:+7NM9YqZqmWMUkPjZM48Mv6bEhs9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:+7cBWMpPjN8DbEh8tdnYz5d6JgCg
TLSH
T15565AE6E6BEC81E5D477C13DC9928205F6F2B8611B318ADB1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6e8269ddc00394d1e6c55d94c7e3868109cf0104ef21722e3265f515c0d75f8d
MD5 011a14649dce8e248919d28e4ba40d06
SHA1 fd2dbcd69af9a2957bf10150684f3c4e87fe89fb
SHA512 6d9dc582687f7fdf276b5595c7c2f684c7136d5ab3a788c1c41821461a49cf1d5591238a50fdc4133c754a6b5a56db0c7bb828e05fcd16f36fdfd9b8894327c6
SSDEEP 49152:9F2YuHNETovAvNYf8kmdtdnYz5d6JgCg:I6BCf8kpz50GC
TLSH
T1E4858E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 cc2f0446839f3193b3abd2b41c849221cb3882ab2dccdf91bd69d26485f74afe
MD5 8904ab430044254a1ae31e6bf6528022
SHA1 fb8bb8c2658a078765ddbcc2ce169834a023f18a
SHA512 8f446792a6b910a159845ed2ce975a515327bb1a7d91abfa4d07ea900ffea67d4215a338e284660ec21aca2799d1fc1808448e5bb625a9d24ef3ddfd403f43ad
SSDEEP 24576:pAFs06+Omlf8NXEbTo2tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:uFs060loXuXtdnYz5d6JgCg
TLSH
T11C65AF2F62EC00D5D07ED17D8997C91AF6B1786707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 c4633c0934e377c1874cf63000bc2831390c0ac4a69c645bb993243bb8f435c5
MD5 17fdc71381d838ce547b868b65f5fdf9
SHA1 5cbb143038bb0a816f62a8bf0b3c053becada800
SHA512 d143e40507599c624036d443be2ab66af8ad5381a6534f484668d05e611bdc0d7e5148ceeeb9675d80ade474ecbfc299f05c11f26cf43d1311f3889596a20e39
SSDEEP 24576:CJnJ5D3WXXtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:CJnJ5DGXXtdnYz5d6JgCg
TLSH
T11985D06DD2A810F8D4B7C2B4815A5B45FE72383D2F2269C724B4D5357F22EE09A79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f28f4becb511abf52e4218c36f9ffbc25db1f836c83ec2d1939727dc92cc1739
MD5 7ae84a44d0a7fd968baf54321e9b1c33
SHA1 f4a7ccf34377db62a338b523b70ee89cd2eaa554
SHA512 c61cd5bea302391f9ec07d85833ed04119a2e34750e2282cdb1917e14d5852c559d0dac367fd9449321052142ed5974486dbb411be788678c356c82a0031c777
SSDEEP 49152:eg06DIKdwc+eQnSt65aVxtdnYz5d6JgCg:X0z50GC
TLSH
T176955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 0a7bfb9c489ea20f2ec51d459efd099c79664a4666525b474cf2709cb7cf006d
MD5 22bd9081139386dd424a067bec85c2af
SHA1 6ce1af99f0dccf505d037709daeef4a66e2ec26c
SHA512 3b4c2da2ccc91137bb69231275de53d25c8962e8c81919babe7489c834869179eb2f9cf79653053a237506fceb5dcf6039b415f1cb616a3bd78962be439f6f12
SSDEEP 24576:Vnjtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:VnjtdnYz5d6JgCg
TLSH
T1A86512AE37AC60E9D57A817984418604D3B6F8755BA257FF6290A23D8E37DE40E3CF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 36a3c161656abc65d7fc4660e5f8c1f3724bba9dc68126c0a698a95762ca2000
MD5 d94db94001dec023c1cc728c84f41dd5
SHA1 c7dd0ed0abcf6b872ef5b19ddbd8401d92d10e9a
SHA512 f097c0be3d9e14887ff4134ac34d31fdb4b7c21d8a84295920fa475a270bf9f009d202881f63274e5c94edfe1c545dbb1f9d5d39d65f43b054902c457ee24b88
SSDEEP 24576:nIyMtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:nIntdnYz5d6JgCg
TLSH
T1CF751285739C50D5DABA4274C92382509A79BC219F7681FFA190F73E9E3AFC05934F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 ecbd78dd7dcd7623a18c1bffd3a6bc490186576e6295a777b25b2356ffda16d1
MD5 a2fe67b914598fe8f17d152deb5dc2d5
SHA1 3449913329397ea15cbddda394aab89ef133378d
SHA512 2397d38fab5a72ae0fbe5e2718173c0eaa2c09d45d3bd51a5751b09e9cdfeca30b149732acc9e3aecf81b33db05ba8e6acf9c6afea61b5167a7c4e735d65bd2f
SSDEEP 24576:1atdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1atdnYz5d6JgCg
TLSH
T1C06523D672AD54A9D97B81B1880A8E04525D7E3A9BEA44FBB1E4B235CC79DC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 299e27ab2199ad7c364beb96dd77f281e01f7b82fde39c15d79e760d31cf46ff
MD5 c91789ffee9f57f3237f3e8d07f27170
SHA1 74f740aa2a3d9970c19cde91136e05685563d26e
SHA512 22d7bdee3f466d499b10999b31aa545fbf4d2a287e20e25f217dad83003eb9f8e5bd8d089d4f43357e9fd287e955fe130ee98dacd33fe57d7bca1fcab88a0c77
SSDEEP 24576:aQ9MxZKdcz9dw3ltdykir8q0Hsw47opM6g9+JVuOUj7Cg8:aVKZltdnYz5d6JgCg
TLSH
T193558C2DABE9059AE177D275D4A240C3A673B4311B35C6CF2448D03D4D7BEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 4179f8c5b850273cfada6aeaa2c3ddd6a4dc2e88162fc4e468bfc3a340ecab61
MD5 8e12a6067eb3e9bf598aa48be21d6555
SHA1 53032718c225163d5268807d4230be040d6fc26c
SHA512 f442f7b8516eb234c170dfd54da83b4f821d6ee88f62b4bbb102991a85acd00a38a586c7d7ae6d850b691da931d61f590fce842965ab14d31004f81a3e317028
SSDEEP 24576:ryocDApotdykir8q0Hsw47opM6g9+JVuOUj7Cg8:eocDApotdnYz5d6JgCg
TLSH
T19675E05FB76D40E2E176813889858745E7B3B8305B6257DB6290C33D8E779E8BD38B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 af66a840077fb87a50a72fe5a90660c947694c2f1b529cd9598cd90e2f7f0d28
MD5 bce283ccbc81e5d7d7d9b85aa9c5ee2f
SHA1 fcddac510789c9ed0215e3e422084a54c85689ef
SHA512 36db2013f298023cfbc6f78346e3cd55fc66e71f7a0f4ec2c1ffd196eeb5ea752502082abc7c8b704edcb826a7717107eee18dc4f38cae1f7cef5540f969900c
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKotdnYz5d6JgCg:h0zuNI9z50GC
TLSH
T187A57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a93e7a367dcf93d180f45eb367decc5696ed50ca3def4efda4421c0f1968f61c
MD5 19d0017e04f0104295fdff75bed8fcc7
SHA1 7fe6bc173c45b59c523077a5d5297c069663d3a8
SHA512 6b7129364f1ee3ba0b5dcffd9c3f98c1f45ffada76f27150accdee07553b24641bd87301bc95aa6f75a240297c9064c29bb16ec346e000807683327e12607d9f
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYzjMqbjtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rTDxR+N5YzTBjMKtdnYz5d6JgCg
TLSH
T13255B02EA7F815E9D17EC5798A23C502FA727821033193DB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 55390c4df69e8b79416252dd27cd349e001eb53c901b2908e51de2bec378e474
MD5 7e8219999af426308140372e8d3ae693
SHA1 166f6acf9e7249a51064e80721e9bd1e4735ce67
SHA512 95010b8660bb13e54b10b95948bc3b642ed56809088729780498b65eb4577073da96f1b0f1c9bcb96430fa891a482e3e3630e1c74bd6163096260ffa73eb6ac6
SSDEEP 24576:YTMdOz0FFS+UmSL/tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:w0K+UmSL/tdnYz5d6JgCg
TLSH
T1ED85E17EA3AD14E5E47BC17DDA438906E67238660322A5DB06D0C1792F6BED43A3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 cb1558f9def4fca2511a9eb620d94c8aefbc7dcc0c3eecee726fac5535725744
MD5 079e2af9cb863c0e7779006b5471806f
SHA1 c72ac1b57524784f9632326395f5c1d954e9678e
SHA512 70d97fdfde2a8e183ab2778ab16ce3823ada19eeb7fe707346c9d61c5e8457b3941e5ea1612eae892c5afdaae1896ba88cd8be9e02f5ec4dd75c8e9543ea9d8f
SSDEEP 24576:mutdykir8q0Hsw47opM6g9+JVuOUj7Cg8:mutdnYz5d6JgCg
TLSH
T1A565129A63EC20E5E8778271C92686049675BC36576654FF31E0F67E8F3ADC08638F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-172-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/648-412-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/1252-361-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-388-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-401-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-398-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-400-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-399-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-397-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-396-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-395-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-385-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-386-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-387-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-389-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-390-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-391-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-392-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-393-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-384-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-382-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-381-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-383-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-360-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-380-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-362-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-364-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-365-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-363-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-379-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-368-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-373-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-376-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-375-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-374-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-372-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-371-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-370-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-369-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-367-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1252-378-0x00000154FC110000-0x00000154FC120000-memory.dmp

Download

memory/1304-41-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1304-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1304-35-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1304-174-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1536-129-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1536-123-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1536-394-0x0000000001730000-0x00000000017DD000-memory.dmp

Download

memory/1536-175-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1768-107-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1768-359-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1768-111-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1768-102-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1780-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1780-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1780-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1780-210-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1840-170-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1840-411-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1920-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2776-208-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2776-192-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2776-176-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2776-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2776-355-0x000000000C990000-0x000000000C998000-memory.dmp

Download

memory/2776-413-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2840-67-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2840-57-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2840-63-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2840-70-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/2840-65-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/3364-168-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/3948-109-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3948-13-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4508-17-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4508-26-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4508-110-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/4508-25-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/4532-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4532-72-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4532-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4532-0-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4536-83-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4536-85-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4536-77-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4536-332-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4804-140-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4804-134-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4804-167-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/4824-73-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/4824-330-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/4888-358-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4888-97-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4888-100-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4888-91-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4920-33-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4920-31-0x0000000001280000-0x000000000132D000-memory.dmp

Download

memory/4920-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5148-171-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5524-366-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/5524-114-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/5692-166-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/5856-169-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5900-377-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5900-117-0x0000000140000000-0x00000001401D7000-memory.dmp

Download