7d4bd5a31c2db12b1ee449383f6174260f5134ef897874ffeff5fc9ce1a743f1

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260415-e74bvaas2y
SHA256 7d4bd5a31c2db12b1ee449383f6174260f5134ef897874ffeff5fc9ce1a743f1
MD5 de6a188d254ef2de1bd9132024ce5415
SHA1 de540136607761354cf8b85bdfe59ed1d7af6ef8
SHA512 de34d0f547549157e85febbc40cc5904edce91917f25a07c9856961d0172c14c141d8ca58093d00fab96cdca251ed3f360d37c42e6fe6ef9bcf49ad9334a2b04
SSDEEP 49152:0gh8jK3xEPK3Hkcm4L8A5ilMfJJnB58MlSKl2HJpYtdnYz5d6JgCg:0MYTKXkcm+fJi3z50GC
TLSH
T16CE58E6D7AED00D6C176E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2128	alg.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
4652	fxssvc.exe
3404	elevation_service.exe
1552	elevation_service.exe
1840	maintenanceservice.exe
4288	msdtc.exe
4240	OSE.EXE
2604	PerceptionSimulationService.exe
4672	perfhost.exe
592	locator.exe
4028	SensorDataService.exe
3328	snmptrap.exe
236	spectrum.exe
1004	ssh-agent.exe
444	TieringEngineService.exe
2124	AgentService.exe
2248	vds.exe
4832	vssvc.exe
2432	wbengine.exe
4300	WmiApSrv.exe
4236	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\efa76ea814bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb581d6191ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e10936091ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd52f35f91ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e5f826091ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd3a5c6091ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028d9596091ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
2084	DiagnosticsHub.StandardCollector.Service.exe
2084	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4652	fxssvc.exe
Token: SeAssignPrimaryTokenPrivilege	2124	AgentService.exe
Token: SeRestorePrivilege	444	TieringEngineService.exe
Token: SeManageVolumePrivilege	444	TieringEngineService.exe
Token: SeBackupPrivilege	4832	vssvc.exe
Token: SeRestorePrivilege	4832	vssvc.exe
Token: SeAuditPrivilege	4832	vssvc.exe
Token: SeBackupPrivilege	2432	wbengine.exe
Token: SeRestorePrivilege	2432	wbengine.exe
Token: SeSecurityPrivilege	2432	wbengine.exe
Token: 33	4236	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4236	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4236	SearchIndexer.exe
Token: SeDebugPrivilege	4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2084	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3084	4236	SearchIndexer.exe	105
PID 4236 wrote to memory of 1176	4236	SearchIndexer.exe	106
PID 4236 wrote to memory of 1744	4236	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_de6a188d254ef2de1bd9132024ce5415_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4528

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1840

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4288

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:592

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4028

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:444

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2760 2772 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1176
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2812 2752 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 49b208dad282004286ccf4e356bf6d4dbd6e5cb8c8472b6439f4450d50afb0b5
MD5 57d0de312765c1e1e55ad7711ecd012d
SHA1 2893589ad339d06771471d600b5ecd7d65fb9353
SHA512 c9662dd523cee926c3e1310ad393b663eb0a5a1a30764f3f49f9f3cf579561f60b746fc63192b9aa54e33522b675de1167e82b6ebf89d85c8c26a2211f54523e
SSDEEP 49152:fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMtdnYz5d6JgCg:d3q6mjBUz50GC
TLSH
T1DED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 32dd04805fba114d441c696bfdbab22af216f59f8dbdc5d1fbc97783778fedd1
MD5 bd9f96ea35ca8702ac17feed880b0904
SHA1 d7a22508a94b9d8a06f8a1a1aa40d0f6b9f0d2e2
SHA512 79574040bd45e02a3482bb537d1175c045a8314983e76b781fc509c4834d1b8a6d34a8947020aaf95a3224f1e8316f015e4b0c41cd782bf248572e15c4967606
SSDEEP 24576:GXYfDtczAntdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ltcatdnYz5d6JgCg
TLSH
T1DF85016973E408F9ED6B8178CCA2C501EA737C5547A4E6DB03E4A9250F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 33cdd50395ef98a29d05674b83f8e8f8a995ad901efaf741cf461a8741ba7bc7
MD5 e7573557169fdea8ea2350f279d746d2
SHA1 1d8432ea7c4b73365942426fee5cb740d9d5c4ad
SHA512 418694f086904755b9a4974a194231d5f7cb27a50d061c624d0491611c540802ec7589ab1cee1d6f72ca72d68bb29ac6bfb40548928953b8d375c2e9581e37eb
SSDEEP 24576:L0Le5ji0hmxhrMEtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:LPji0AzhtdnYz5d6JgCg
TLSH
T1D895AE56F6748331D073C0B9C5D2A68EED7234825B3089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 61d227f39efd0bff2a03b2060e3a09022a4e299d5068203a5b3ebd85287b52a5
MD5 d5868d563224e2ee2a2d79985794d9c8
SHA1 32bbce68a8dbd1996276ed58aaa9d102e164110c
SHA512 67b1d2bbef359ad12892a90266cf6700e462503b041b227029684fa366a38f83bf5bec42a44d2014ecf1b1bae6f100c4a458a45b0010c55425ad81a90ff00680
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyuKtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:E/ezSC6vUzPv+HjyNtdnYz5d6JgCg
TLSH
T11E756C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ae55b04ef09a71308bb9197eb9f0f487898f9ebe0d11d3019c7e533672e08590
MD5 2b589f41e8d4990e2a82b992c47d40fc
SHA1 bd49369dcc8b4a28708a91dc892631bb6ef66e85
SHA512 eb13726e3abb9166bfd3c407226f24bbfdbb92e0974ca92f56aace1665814639a2802258afc247fbebf2ea3c4d932a59ba67e330ff1f40338d3a6865a78c3ea9
SSDEEP 24576:FVbqPb88hv/l+Brtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:FVO88hXl+BtdnYz5d6JgCg
TLSH
T1E1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fb8bce79891708db0b41d8d50f8b89377908b46c20af97522ff94ee390590ca6
MD5 3475c286d2586db5c404654d25fff7e7
SHA1 a8a7f64af200b18edc8f736f930e553ed099838b
SHA512 4a277f52ca9ad5740404b67bcdf040ce9ec343ec41790e8de43a9ec3d498deb020dc1d56cb7dc08e385072d29a1c4c8780b2d03d5423053eac6860bc38f8f649
SSDEEP 24576:eGotdykir8q0Hsw47opM6g9+JVuOUj7Cg8:OtdnYz5d6JgCg
TLSH
T12B6523D3A69C54B5DBFF45B1980ACD04665DAF5988EA88B7E2643659887CCC0C338F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 341fa965b8b40358d592417bb7cdd88ef90f6369c4b50828deb2f215c8646108
MD5 7c80f49aea88e578ef54865247eda9f0
SHA1 3595266db098b27c21f0389afec92cd68bc33b4d
SHA512 9539e8b7e03de0fce4dbebd11380648f39a88bab02d95e3ea7207625812098000f8cde18c3789720e5ba556724c202ffd05fb13dd39aa249bec3e284f30c5833
SSDEEP 24576:BJIUDtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BJIUDtdnYz5d6JgCg
TLSH
T19885CF7BEE28FCE2C27E8DB95A51C600A77678314F6293CBE164920EDE235D04E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b30049da3ea1294f2e4e48b3b8fd59cd255e267de874228e781244fb9284632
MD5 ada4a176bf27895a066b9b8978a8f8a3
SHA1 e0e31320fb8c5d93724feb5e22087548e0604409
SHA512 d06fba6626bae44087a05c6cfcab7787cf82e44f10ecd20753058a13d8b6d141ad4aa3372e7ad4f2ff662d0d6e80d272b426b16c8a1764d8297e808919eb4d8f
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH8:2QvGAdlCEL8c/WRNw5CZz50GC
TLSH
T1D3266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b333dc2e849d236542ad1af1b6743b1ff6cec049c5829ca6e67490fd43fc8618
MD5 efc3eb61b11659df95887ed58b87a549
SHA1 7e3cb988b00632a2b763565df391316fe9219b2a
SHA512 9a56efa0fe5eea3efda9824677d2557a7e5745dfa841d2ac84546383d647e1ee2699bca7d7d39db5f9b1fb45f358f63fac0cd01f40cbf4366fb8f25703148748
SSDEEP 24576:AfewsAjRtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:qljRtdnYz5d6JgCg
TLSH
T16185E071FA74E036C6BF0DB21B26C716146D7E204FA219C3E3A85A9D59346C22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f982d8f6aaa3840f39afe90eb769bd733e31796614f35386edfa69be3d6e569
MD5 b6cc06259d0c0abe2c91139cb98925f7
SHA1 2892727a22c71f024f09802a8a0309fc9c068744
SHA512 1ee0dae915af7993ec81080023af972148d183b9f4bf69e54325c223414e00595d002613032362517bfa583a640f5117b5afd48630acfb21db6c2b0734ea2e1f
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH050:uUEtQevvqc2W1cpV20I320
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c4749ebcf76f562dde65482a95d9fcbb2fccef9dc46083583f9c06317ace636
MD5 3a6a8ff716aa3b6f8f2aef28e61b94b4
SHA1 92e3c6b2d13926818d1ce49a8eceab7866ae9d39
SHA512 c01da61c4540766f9d21c5479cce0587a99565e2eb6e7839d67ca020ffffded7a80670c8093c6ac32970293413e93e972dbfe454b40e17a27356587809eae3c6
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/zxtdnYz5d6JgCg:noq2Vjnmlz50GC
TLSH
T122D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9dfd578b4f65c31e81d2c9ebe8e996863298ef7262d2ddcf10087c2d0780c867
MD5 1e864ec690fd490ba00fb845f42119dd
SHA1 0a9cc5c50705dac56b17d151fd1d21865ae47df7
SHA512 0df41549eb17c991a63688b0aabb11a86d8c935a9ae465d3bbe884ed3df4c450b10626ee7457fe3e9d2c6b4591faa832abe84b862539d5ae0da63b6f35e75de5
SSDEEP 24576:VAhGL6IFoiwtA5l7S53Gtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:VAM5Foiq5WtdnYz5d6JgCg
TLSH
T193359D81E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 f2ceae415f4baf48f9d86d6e3d94c14fc2bf1fa08f0cf764c6e5d333e3b99125
MD5 224bf2467035ae6c743f02a0152a9559
SHA1 a732b87f7e2509077c456387ba36bde6dae1c6d4
SHA512 4bc3ae07f6f0f2676c469e6466ec8f59487b8dbf0f4fb9e596bebe2eb81b4c2fff72e519046dcb4523c3ecc862fa79998d1c51e7896f2d113c8bb2e80bd0bc8c
SSDEEP 24576:2wuROWttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:2wSOitdnYz5d6JgCg
TLSH
T1AC75F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F5360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 56f4a07fdd0358a99cdde29032f8c71bb1faa16decbb580a0f5e1faf1a667c26
MD5 9f860966817e1750edd4b5b04e8f468a
SHA1 e3a74d73902d4da41f64305b2cd9852cbf95a543
SHA512 b13ba22d874cb0100096164d550e556a3cb05f7479d0ed4b431c30d44e23d3a09cdd2af856121c5212177de8e5759634a97593c1f6939704e081191adcd06d92
SSDEEP 24576:3Zu8tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BtdnYz5d6JgCg
TLSH
T1196512C633E820F9D5B78278CC958A04E7B67C5657B683DF226422695E37EC04E38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6839f9c31dd204585bea1f4a3bff742b9ad9a0a92320cd6f7b01e89b3457fe75
MD5 68619efe38e233f7253c6e52b7d33008
SHA1 19ea061eef6dbbcd4c5c3b021d184fa2166dfe42
SHA512 a05b654dde332b7457d8b5dfc6deec3d452d588e94c1dc9ce0d9fb056d06f05b517c2d87350d08d26cced3bb1bec64498d450fca6d89b497749952b5b486d022
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U4:dQRQyi36YOcPDLvw2gAf+PN3Yz50GC
TLSH
T115667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b27c17c74349eb3a10c4376eacf37653ff34697561da41b5cc39b01cf209f16
MD5 7c1ed40b3c375922903b29f6d7fc082b
SHA1 045d978b1817829fe8bb4dcdc2d629b3e88c18c3
SHA512 d2e081f4e8e4ea17a968db569645a1947f2689a349a8e8037c21fb0dcb55071e0ad99ed00bac85ea369776c0e288ec4f7f52e4f2de7468ddd17f7ea013e6e966
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U4:5QRQyi36YOcPDLvw2gAf+PN3Yz50GC
TLSH
T1C9667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4c3a466c515a2ae0fdb39a7e45b042e1e74d3ee307e0c52ea847b9ea2c4e4ff
MD5 3fd7bae97e19b9cddc8e1180da8fcf6a
SHA1 018ce2b2cfc39341eacb2af8eacbf393a394aa42
SHA512 1692d66e8211f5388cde8c0909dd5175eca795ce8013c086eef28d1788314d9ba326ee5d6f09819bce3e85bd99f4f53db3609e286b65a5f50a7937cccdf93e32
SSDEEP 49152:c68Qg55nhkeWu7PNU3/htdnYz5d6JgCg:WthTRc/uz50GC
TLSH
T16DB55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dffe0516429fb373d9a759a2f85ebab85c2a5fd35956dce2b00cfd65d5223dd5
MD5 5f1d358c489c37069fe30b2543efd5a8
SHA1 fcd0c2a9a9e15e80580d292ba2158dc20110673e
SHA512 499de14461ad34058bbe558736df1fc3faaeba369182f25ee8113d6548d4f0d1e9b6e85b8faa8eec13106e060f1575ae39136a7c52b31f3ff31e0f1b6ace52d6
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99G:ny5112gYy5azzVvU69nLKnhZDz50GC
TLSH
T1C5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bebccb81b456bfdef04b6e9b7eab2472106e3b6a86aa1a613a2f132d5ab559ce
MD5 74913ab85381dd8c8a1d3831c1e58f12
SHA1 f5393e2be283ef35f4378772e7d7cd85394f74a8
SHA512 3afd3b0c5c72fcd27da20184daf930a29b4ffaa04cb0ddc804f9e24587f90e86cb8ca55e36acc0ced7ca0eec40992dbd6afb464aad0b003be130448b008699c2
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3tdnYz5d6JgCg:au6JmIxd2dgz50GC
TLSH
T117D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f0c08036df50525798a195b2918fa64922bed0c11c0596ff64f1b1390226bbdb
MD5 189e84b8218f37fa7e8e8ea3f04d749d
SHA1 7087b35731c4f4a196ba5e007c536a864192e212
SHA512 a751ed9bb387a0b299a168c39111e72cb639b7bf73decd7b95cf0ce06c154fe38dd1a1f424ea1c5301d99c7d487b72175775a07ab041324eafbffc83413e495c
SSDEEP 49152:u1hpsNoJpF1A67U44CwH7R4xjtdnYz5d6JgCg:umifPqRlz50GC
TLSH
T1DBB5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c14efd785529e33c1be774e0651ecf5914acb2ccb37c7e8e1af79ceb53e20226
MD5 0e21c7cde9a52f3332b8d5062aa4ae5f
SHA1 b82c2bbd857619bfc14767798aad66dd07c1a5c4
SHA512 54ba6d024bf38d6a23723b8eb03440061417a070c3ab3b7c990c71810c2da2d3e3131e350136c820aa910c2253cc995521e19d5b49407da703e189efcdb55933
SSDEEP 49152:8SuZQIY0Be2KkRVtOnks6NMHq8tdnYz5d6JgCg:+5dKqi61Xz50GC
TLSH
T107C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0ecd8d1c79fc9cd416798d07882b200dc3bcc8bdebf68e3e9871c11e41f5b37d
MD5 db5f57e82d71fddb4128bad8da91b342
SHA1 c454b1d5a476e00a24aa033bd272fb35ef4f09ec
SHA512 e3a394896fe3464c107db97afe81ea6b683010796897314b05d81a8a585f662a1b1f256fd4068e1759e2a66b80b422b5c6385fecdc9f59529d86a5f81ea8280c
SSDEEP 49152:qhtSn8EApI0figjgiDn0AP5wntdnYz5d6JgCg:LX2iWphxz50GC
TLSH
T10C95BF13F2D900E8D06ED174C7468632E962BC160B39A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6a07664b55262f5b4051ccdf69e05e559208541b39cd34ef1772640be263a4a3
MD5 e784f555f476acd4e75c772f923e05b6
SHA1 f480e4497234a901b222188787407c86f04081e7
SHA512 5e9fa689817dbb66d128d74f25053df05e6a7d6ae0769a84125d3ad2743713a4e2415a9f828a42841a6870ebe3fceccc710cf180ce0a7f21c7cf8046bd3c8351
SSDEEP 24576:hAtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:StdnYz5d6JgCg
TLSH
T1D56523D3B59D45BADABF81B1C80A8A44658D6F5BD8EB80F7F35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3643a2b670ac5bcff2cfac53d84c01ce4fe89382e8aab507a4081c24ea8d4c4b
MD5 6d1cd771e83d6aa36fed2e7455a88996
SHA1 6a4b127f39e0c169dbfd3a14b4cb093a6dd2e104
SHA512 d3474d4044d70db4c1b5b210688582785357325e52c7b7531e008c28cd2edc11e8d693ca577d17f8d5c178314f141d7e83f43b559e4bc1fab57d348192e25f50
SSDEEP 24576:LVtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BtdnYz5d6JgCg
TLSH
T13D6523D3B59D44BADABF81B1C80A8A44655D6F5BE8EB80F7F39831158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3f4990df8443e4544e48e1e7c7ed3a2664e7b8aa1b3066b75c8bf620c406ea30
MD5 326c97bc2db87ace725e938035e7ea10
SHA1 9e1b070604512e1c894cd3ed37507434746da464
SHA512 11f34bde003091fd90c159208a66e0f408dd02904fa8283e4e8c29ee2eea58dc99f6f01002813d38027088923c34a26ea45d662e6cd713859323145f807f2f67
SSDEEP 24576:F7tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RtdnYz5d6JgCg
TLSH
T1356523D3B59D44BAD9BF81B1C80A8A44699D6F5BE8EB84F7F35831148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 be12f2f545e3bd78a10d89403935fcd9051a915be961e3955154b5e13351e5eb
MD5 064496fd5f9bc9e26cab64462d23d130
SHA1 6963a6a172a76ae5e92fbba07b50bb4d89f085a4
SHA512 a98dfde60c40d772e9971ece3871a114d53f6d10e9b41ae8930e359c2e69305e6eb2ed1999332f28259003606d770663d30486243b7fc0fd687e70a52e7acad5
SSDEEP 24576:vtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vtdnYz5d6JgCg
TLSH
T1EB6523D377AD40E5D9BBC2B1C816C504A6ADBE5ADAB684FFE35035194C75AC04238F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5feee012e707a3c728362f94a979514841d1d58b95f0735a429467b42e4c93eb
MD5 bc909ffe94f474bc9b1f31c6fd81e8de
SHA1 74b7ca9c3cfcdf9a2ec0e6adcc7e81fb0c3d9d74
SHA512 ae777bff4791b0eff83ab7233960c92a733b49d54f19bdb9dda0dfb06aafcfd32c238bb56eacf94617326bfd010829a534d92638379a11a09c13eadaf97230ff
SSDEEP 24576:Nutdykir8q0Hsw47opM6g9+JVuOUj7Cg8:gtdnYz5d6JgCg
TLSH
T1E96523D3B59D44BAD9BF81B1C80A8A44699D6F5BD8EB84F7F39831148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c69cf65c26357a8d2cc3db1fc94766390a39d353dd9bd1764f9c374dafa08077
MD5 e0e934596ea7e82318bf2a3b99fdefba
SHA1 dbec66d1eaaa86c22a41eb49057703c54e956b4c
SHA512 c6d64ac2f67c66c66b3db17f0cf77f7e9f06b47aa3d61bf1e36433f0b698c937b0f5c96cc8a1e2663f45291a70ca8061c5ca901aeb044fb141afef9c299dbc58
SSDEEP 24576:1ptdykir8q0Hsw47opM6g9+JVuOUj7Cg8:7tdnYz5d6JgCg
TLSH
T1D16523D3B59D44BADABF81B1C80A8A44655D6F5BE8EB80F7F35832158879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 53509d02435dbe05bcd1e3b771c257949fee92505a3c5d8aef9cbb37c1c58823
MD5 2aea6150c3ee0e52c0493941014b374d
SHA1 e256e1e112053fc6d34f740c94c16def08b7ad32
SHA512 356409a294ce4271ca0e7b09a1198b5cbc5792a2263cbe66420376e8047fe3da8431b2c33d26a21071307052fff4285f03fc21aa3607e9d178d8964797749d10
SSDEEP 24576:29tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KtdnYz5d6JgCg
TLSH
T1E46523D3B59D44BADABF81B1C90A8A44659D6F5BD8EB80B7F3583215887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 75b9d744e92eda256375edee5184c2d80046a0b9f183bbfea0631b88276dbffb
MD5 207ab6d0d1b83c261583c7da9142ef15
SHA1 2d7644053753f922da86679899e700dd1c35b1b9
SHA512 2cb6286dc7616a799595b3d1bd993326bdbe073f984a3d6abad83532faf647c46cf82a87f884a045ff7dd752ff8494ea801305181b5ae0d4edb814f3ae352445
SSDEEP 24576:dZM3zFVSO1tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:dZM3zfZtdnYz5d6JgCg
TLSH
T1F28501D5B39418F8ECA7823ACD158905D6B27C5A4BB0C56F13A4362A5F337900D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c5556f7f462e445feac0d24c485d978aad85be99ac464f327a978efdd1b2b755
MD5 40330476848ed00632f263d20ad2ec37
SHA1 3708851cd8e66a2f71338a6501eabad1bec3cb9a
SHA512 5333bebe31a129f9160495f81ab7c41202f016403f53a9355092654dc794a2940b180732f5dd62333c9017f862aa93c3d7b22d4e4501bac3181cd4eb2fc85e14
SSDEEP 24576:ystdykir8q0Hsw47opM6g9+JVuOUj7Cg8:dtdnYz5d6JgCg
TLSH
T1566523D3B59D44B9DABF81B1C90A8A44699D6F5BE8EB84F7F2583114887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 598bf15fa1afd2afbf27d574edc2b86b26d426d7224ccb6384e2c7ee7b6df3aa
MD5 dc85a870c9b46e6c3d53ae3ebe63206f
SHA1 fae10e87cc3eb045d29f72ddc7acb05a914fd4c9
SHA512 f24fc0b93256cb7f1942e69b3961e5ab41b8f893490db6882bb76198c8fac59899bd93dafd8aea09c63334c83417692f6c4fa709e4e78ef8688ca77cbe64bf19
SSDEEP 24576:HYtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:4tdnYz5d6JgCg
TLSH
T1576523D3B59D44BADABF81B1C9068A44655D6F5BE8EB80F7F35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 c6ad6c6cc84fe80cbc9631acdcab4edc9a1fde915c65d9c7315efb6bace04cae
MD5 63357113b87fb1aa202349315dc5049a
SHA1 9e1f3770bee6e94befcd948b24f0ac2f84308027
SHA512 a01e52d5366a7e89181a6bcefa6e17401ac197dbeda4ca82350f11aa67d7fdb97658f36af515dd4e6556dbd8dacfe20e00826b37bcb42792e6c660d17dd0b74f
SSDEEP 24576:ezyBtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:eCtdnYz5d6JgCg
TLSH
T16175028373A520F9D17B8274C8524A01F77ABC364B6589BF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 bca684b2b4bff1ea408548c6aacb800223f8014b331bc064f2ce081a5a0e24c7
MD5 110c5ac43df8ab5c6e7574fd98d8df45
SHA1 045cacfa4a3f1e2bc73b0741098a7059bbb0e0bf
SHA512 72990abbd513e48db30f9c3e000f48886363274e7140d04b2271b90eae9a858db2b8fce62e5e706fcacdc95232c4b9535ce6af4a566593399f0efee8c52739b8
SSDEEP 24576:bstdykir8q0Hsw47opM6g9+JVuOUj7Cg8:4tdnYz5d6JgCg
TLSH
T10B6523D3B59D44B9DABF81B1C80A8A44699D6F5BD8EB84F7F2583214887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 d1f277928ac61468fb9deea2929a68b5befbc8a9cb7ea0fbf3fd58f9b5457349
MD5 3d533b3e2bf0dcecfe696cac31c846d4
SHA1 2e28afaf09278ce0f36528010e20e7474a64da8f
SHA512 9eeca84f85d4ed10b5f26f6b9821754409b615ac42ae89123af4ef36d450b216578828259c614fd5f25831ec1916354186443235deadc080727786adee05a09e
SSDEEP 24576:ystdykir8q0Hsw47opM6g9+JVuOUj7Cg8:dtdnYz5d6JgCg
TLSH
T1866523D3B59D44B9DABF81B1C90A8A44699D6F5BD8EB84F7F2583214887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9ba2921539a8f7a4cf76299163249bfd1aa00b49c929a5871e1cfe2bfa46009e
MD5 c118997e8d84eacd800e5fc4b279bfae
SHA1 f41526e268d0c8e1ebf7917455e5676860993f7b
SHA512 fd1df3d030f9d7268870bdc128ec809d5ac3108e0a9d2f8bd66bb718032af8fc03b93f1f82c67ffbf8c42c5d663e3b9f05a654188ebfccf516b83016bc47f0d2
SSDEEP 24576:/CUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAvtdykir8q0Hsw47opM6g9+Jp:/CUAPTY+8Wg2lIL8lrIUJLWwutdnYz5D
TLSH
T13065AE1EA3EC0896D4BB813589518A06EB727C2E1B22D6CF2160C33D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 cf236e9aa71815a1bfd4a85268351c0a57081168227f2ade1caca7839c13d539
MD5 9521f2eb7abb58bb96f057a61071a9b9
SHA1 d89545d5c5210bbeca2c456354f333f159fea44a
SHA512 61335343f468d4bdff5a416cfedac68b6ba929b21e7836fe95ea8e7c25677f97784a22daef4e20fc08731cb7121341848aef7ea4b29273448f6c066a88a6d794
SSDEEP 24576:+8tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ptdnYz5d6JgCg
TLSH
T1CB75F19AE29801E8C06E5175CB468A40B7677D6587E1C2DB63D0F53E0F7AAC04EF9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9754cb71762a64913ea9c29c425fdbbca61971cff44b3762e5745490a85e0313
MD5 8be582b2e4bb2151c9d1bcd1847cb0c6
SHA1 8a66019b4f2ddc402c4378dec810569499402ef6
SHA512 a35aec9a27f9de8ac9d9583e8681bdc7569e21ee0111beccb8124a2b10ecc4d6066975606066ed1bd22723c8c8f79c1af602e9f97f8ece335f17d242be693886
SSDEEP 24576:sbtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:sbtdnYz5d6JgCg
TLSH
T17A6523D3A39C44A9E9BF86B1880AC614665DBF699FE684F7F24432589839DC04734F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0b69ffe0070745606547166c23a8e754ef92baf962091cbe253ecfec4195e27c
MD5 f2c9f749c66117b0fb960e4c11f66ce6
SHA1 8be52800f3fa7b34dcc45f7720b7f05c7a51681a
SHA512 c61d10193b200a8f686cde0bc743bb916d8146dc0f9e9e7baaba692c154e5cbf11c08bacaf2b75ffb45f1709f47b22ca67caf9f304565dcfb8b027a9c6db072b
SSDEEP 24576:e8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCxtdykir8q0Hsw47opM6g9+JVuOUj74:HRZwQCyiHiQEaaPnMktdnYz5d6JgCg
TLSH
T1FD85BF1E62DC46A5E0BAD2B8CD674407E6B27816473197CF1290C27D1F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 d21875699f260ee4bc0f677820d7838a1e28a51038f159045e50c5525ef066af
MD5 d1f5b4c17883912a430c162b2bbbc45a
SHA1 01c510048348343e3d3ce2987ece67bb48a92b67
SHA512 932ec945f746b278177bce20fdfeb7aa7e81415b7f698e265e86a77dfca3bb7a08b0ac14324be481892ce7b4c4c2ec9e01aef9155ffec3bd563e333adc003e54
SSDEEP 24576:rbxA1UGLtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rbxA1UAtdnYz5d6JgCg
TLSH
T1257512AF62AC14F5E5BAC17988868105D332BC2A577183EF61D0A27E0E3BED44D35F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 abc6ed7a37caaefa74751a24cebceabaff77e60359321f3fd82b9a628d3aea5a
MD5 ea94f21a48291a8b01d01a01bef34331
SHA1 5a2eaa082295cff0de5ebfe2784c2534ba5b68d4
SHA512 449696c982fc898075f80f06cafb5969ce3b5e5d81344432577001f9b6be1a24bf7ed0aae8cf52fb55c9c43ecd7bb8b28a7cafcaf599fd9bd0232f9f94f5c457
SSDEEP 24576:XjsmP0yHaqrVqHra44KDzMsrnWtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:XjRP0yHfVqzlAsrnWtdnYz5d6JgCg
TLSH
T1DC45AF2EF2B910B9D4AAC176450107B5BB71B82D1F219AC70170C634AF1AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 53e898e68420451b886d562923977a9b9025881a16f583421ff6cd04424f0b18
MD5 8e87d00661ee16b15a050e3663495f8b
SHA1 4b45a0e8162ce2567a156a57bc0805520b104332
SHA512 80a22145994f6752663672bab92920408463d69ba2cce60185685b76620b5762eb659d0fd397a82b1c1c7011b96c3f7cc4e7600122a34585c7a4bb794293509b
SSDEEP 24576:/Jtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/JtdnYz5d6JgCg
TLSH
T1346523D3B29C44A9D9BF86B1880ACA04665D7F5A9BFB84F7B1943215887DDC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fb739554d4d387b24ef75d38de0652cf61f33a0b835bcf7e54eac85fae06e5c9
MD5 09ffd5e3dc288af49456919ed766635e
SHA1 2d6b62a265cf2a520b38f1f88336782da046e672
SHA512 99578f062c4932c541c33ffffb1ab1766fe84e9c642316373309e5e18a8150b8eed301c765d304ce4ec3fc559a85683f0673e24e49255e29dd53e6d80a0f171d
SSDEEP 24576:KALBUTntdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KALBUDtdnYz5d6JgCg
TLSH
T1E2850155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 342f479820c5b4f13f79b0b009aa1e44282d98932d8449b276fc7268bb73bb1c
MD5 5bb86be2aa3a6398f8dcb02d27191a1c
SHA1 4dd50067862b363b933d3b6e47a8de0ec397e148
SHA512 8710bb5f7afcd20dcd2408918fc4cecbe7aafe5a9e076a3db51c75f66aee9922807b9805df68487a5c19760a6a5871fd845fcfd02844cd6da22d2c7f3744ff5f
SSDEEP 24576:9fYNHytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:9fYtytdnYz5d6JgCg
TLSH
T1A675F16FA2AC08E4D57B9179CA838609F2737C66175192DF11B0827A0E37EE87D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e368ba8263b44bab4f351454f1ad4ba13e9707b4bde0aabbfe1b6cc3b07110f0
MD5 ce3d0e4d2796834ab8a6f16e3d583527
SHA1 a6e326f335e7cb17f34843851ce3051286916313
SHA512 4ec9b5167cd91684e7b43ba477ddc56701ac1393bd22493d35bd1a22e6c300a56c14912f7c17471040675cc2c43b53733249fc2fe87a47fb68147af84160c25c
SSDEEP 24576:jnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKd:jnXoJJYH84VVS6AmETJas+cHBjSSKHPq
TLSH
T11E65BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56d7367d9405061dd40fa18cc0fd9d43dc4f2faeea4db8cbbb7470520f22cbe6
MD5 3b73fe4ccb70ff2d9a01c9d72baa085c
SHA1 f6473e8bc61af2ff2b64489b5ec8f32dd0d13235
SHA512 113c4a63779f954e598f7745ca843cffebb378063160630e3db7805802dc118fe2482e9750e7040250c342083ddc7f30fb75b4a88606e84289780febf6ec3fa6
SSDEEP 24576:6v7Xbxd9Tuycf8M/TYlSuxwr2PCItdykir8q0Hsw47opM6g9+JVuOUj7Cg8:6DLL9TuJ0M/TYW2PptdnYz5d6JgCg
TLSH
T1C4858D5EA3EC42D8E0BBD6BD85B79146FAB2B855173081CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 de7e0db569d0117086b2060e5d095fab2581be0daacc7984a9c48f094716d109
MD5 41b5b9c6b802a17621ebf796080adc91
SHA1 5ff551cf2e29e8771e4edf07d8f683282ee7c701
SHA512 66d065053baebb5dac73460724d1cf66d7e69db39edd4c331aedb74509b3115867aee82d022fdccfd105d9b4e51ce6655d9ffb1513b7e15f59eff980947e9286
SSDEEP 24576:degJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wntdykir8q0Hsw47opM6g9+JVuOUjc:dngOJOmPOHkntdnYz5d6JgCg
TLSH
T18B55BF3FB7BC15D5E07EC17D8A968916F6B1782603255ACF0160827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 7b23fdd6f73f8cf2725f273ad1a349501474da213ff04c10a5717ecae6b15e5c
MD5 a7e8c2f1bb2546a037de198ed89e7633
SHA1 46b5f55b849eeac443f2fba0b1a47727bc649612
SHA512 2fcd30d8e08a4ca9869cd0564a7487eb48f6eb1e1e8cbdb9f9c113fbb6e554c30f5017f918979fb62147558f6419026ba9adea4d201467bb9593d240247e6bc2
SSDEEP 24576:JLJnJiTk3R3waE4JrOptdykir8q0Hsw47opM6g9+JVuOUj7Cg8:JLJnJK8R304lmtdnYz5d6JgCg
TLSH
T1E085E06DD2A810E8D4B7C2B4815A1B56FF31387D2B2569CB69B4D5313F22FD09A39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 33afc4d3414f6366d632b4f10f4078462ece9a29e4dccb70a53cf8ce283312e5
MD5 8adb3932e9d73bbbe3fb78034b99c471
SHA1 ca8214b22e7100a2b2dcc3468e4d4d0a70f3ac08
SHA512 9e2bfc93dc0bfd261df51d8e3c8c3f2b9e1467328d1549e311424b2eeda271417cae7e9666c05e631d1967f1325504ec545e5d6eda7f2656d7f23df03b5e7712
SSDEEP 49152:19GqCzDScAZmlvTcFg8Ph69tdnYz5d6JgCg:Jhz50GC
TLSH
T144955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 c03ddf851e793d3356e3d21c8371bb67897c59f16644ec2ed48a12933de2a48e
MD5 9c02c7bdce6a81d01a6e4bdd1a85ba1f
SHA1 5272b00c09321c69350084742752506fd502b271
SHA512 2e06be547560ce8006d9da36702c6213988ddb123955e5d964a54f9110459537cdb00018300672a6fdb3f15e83bd711fad34731a27936506a065dec44b016c37
SSDEEP 24576:9lYJeXm5jUuEXtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:9lYJeXmRUuEXtdnYz5d6JgCg
TLSH
T1A875129E76AC20F5D17F807588528A04E375BC66579253FF62E0E2798E7ADD00E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 334b93e3951356535b08439fa7df81ba2553ce031a5aa95bca076f5841ec1f17
MD5 51d5b2ade082297a8350a2b79e88f201
SHA1 7e673c8aea266b64bcda9cb86ace2af53ca9d779
SHA512 a3d1bbf51c702a10ea88df014f572e5ef4bf04ca00fa937e799eb651e040e02d44aebd1a45242811049f01b7a1da99ddbdf97393db286c0a61a0157377cbf5fe
SSDEEP 24576:/Vty2tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/VtltdnYz5d6JgCg
TLSH
T1C9751282739850E8EABA4674CD1382509B7DBD219F6581FFA1D0F23E5D36BC09634F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 e7144c6395eb2d9b6374512b7b91621528e0048d269cfa09d7cb0beffafb1d25
MD5 27aaa4a3c5633c5f0a03ba39fc0047db
SHA1 52169f6427a3ec1a1920c2b3fd36b39d1369771c
SHA512 a6b4a0a5fe41b0f2cd73325c703fe8cc2ba38e0b13eea13541b5d192aa6220285d9e2a9f73e4fd5607e71ab6a8b1a2443364c7770a5d85b85c208b4db923f908
SSDEEP 24576:gntdykir8q0Hsw47opM6g9+JVuOUj7Cg8:gntdnYz5d6JgCg
TLSH
T1B66523D662AC54B9D97B85B1880A8A00665D7F399AEA44FBB1E4B235CC7DDC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f2beadee41242f36e2f58e2eb3ed8d19907bc5f98b45475361034df1b92cd9d8
MD5 9ebd42c4a5e71ae90d0e4e07c31d5c2f
SHA1 f73aaf7ee67f18fb1ee106eb865bdb58248a8ec3
SHA512 95b3a9ad81f77c4c1dccc88fac9a67b210222f3d2a0561ceaa7f41379dcbcea07252d1a0644aa5ebe93469da188fe6397ade0594117441a746f37507d4bcdbcc
SSDEEP 24576:lC+TyQIu93VAumZr7jmctdykir8q0Hsw47opM6g9+JVuOUj7Cg8:l/TfIq+YctdnYz5d6JgCg
TLSH
T1C0558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 35a964504d2513fc0eb1518e9b6bbe46f28c7347f715c11797fa707531fddafb
MD5 b37cc515724a34d7ed28e2cd95842881
SHA1 f21c5fdcc27d9640cfd2d0a9186d73ef9f925be5
SHA512 21a243a15fb2a0697bee60c26ddbd2e503617e8d44027bac1397da8c122fc0e9fe3ed7bd6aecb5c29a9acaa3445c7aee968c8f79c2e83ea8a7a9c250800795dc
SSDEEP 24576:vLQikZTtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:DQikRtdnYz5d6JgCg
TLSH
T19675F14FB3AE00A5D4ABC178C8458101F6B37835576262EF52A0C7794EBB9E97E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 290a7dcde63d907ee25b732065a7718c62716e048d221528a78dcbf602dc260d
MD5 0dddaa9dbc8f9acb5d321737e9e0b2db
SHA1 9e9887a64df0b14c86859783545cf7aea06c5435
SHA512 8bfbc7d22ac3f58c28e073a175ee53fcb7f40bd3e7cff1c2393c05eecb2ce698cc57e983d7d7ba32e08e27a2a39c9ecc04c0c898ab05a7a6ba56f64c3a96638f
SSDEEP 49152:vpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP2tdnYz5d60:UpC7b4+80GTkyz50GC
TLSH
T121A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 08db1c8bebe79d34567e0f5710dbc12072da2cda4ce748793de90ed82ca08374
MD5 26b57793f3933376009f387960da47c1
SHA1 70ab98d19e86c1f3d16469d9df8402eb7a10b479
SHA512 6dca91826fc0ff6f2460d0c342d5646b9f8b27ff2b38320eba1b88a476f014604bb3464de35497619f9e7955cc3d441ccf79b05dec76d06fa9ef930d6ea343b5
SSDEEP 24576:DSAwJPE1IDAo+4Kt+l4413lUQOtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:DqPCIo4Kol4jQOtdnYz5d6JgCg
TLSH
T17655B01AA7F946F5E17AC7B4D663C601FB727822133163CF9290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 c738d1894ee8110f84395b317a2b458cd32e9873e8bbe71db018897ce40b0e31
MD5 0462c29c7f5ff3193e56db1e1b70189f
SHA1 d77787c271192b32426098cddf4ae71cbcb0c5f1
SHA512 4e3d450ffaeae10e97ec80c557beca6da906d5b642ab7ba52c6b691947dc8b97603d82168595fb490d77803880f69c7155ee56223a6760a48d0e2e5bfc7b2a56
SSDEEP 24576:vyLXPLcT94t+tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vy7Poqt+tdnYz5d6JgCg
TLSH
T1DF85D03EE66C08E5E47AC27CC6A38906F6723CAD037165DB15A091791F7BEE46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 c115940ea33c0a1d102fe31d48a7d4dedba41009e594e09a43a3a4bea2501be3
MD5 ac6ac35bbc3aaee17b439b3ca2dc04e2
SHA1 63c7c8cc959dd32e2c25c3c8319aec2345dca061
SHA512 f046e4cf2dd4aa119faf67a5e68616d4aa4250f46cf05e574f1f35203d88fe988821c2b43abc91ffbd7ea4703d0800dbf9af1ef20d27969dbd6f98106183af8d
SSDEEP 24576:vWv8qjpjtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vWv8GtdnYz5d6JgCg
TLSH
T16675129F62E824E8E47E8270D916811491B9BD7617B988FF71C4F57A4E35EC0823EF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-306-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/236-127-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/236-131-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/236-121-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/444-368-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/444-148-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/592-116-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/1004-353-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1004-142-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1004-136-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1004-144-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1176-401-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-405-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-414-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-415-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-413-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-412-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-411-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-400-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-402-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-403-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-404-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-406-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-407-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-408-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-399-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-397-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-398-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-396-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-395-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-394-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-393-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-391-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-385-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-377-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-378-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-380-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-379-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-381-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-382-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-383-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-384-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-387-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-388-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-386-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-390-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-389-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1176-392-0x00000266CF0E0000-0x00000266CF0F0000-memory.dmp

Download

memory/1552-159-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1552-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1552-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1552-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1840-67-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1840-72-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/1840-64-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/1840-62-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1840-56-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2084-26-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2084-371-0x0000000000C60000-0x0000000000D03000-memory.dmp

Download

memory/2084-130-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2084-25-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2084-17-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2124-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2124-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2128-129-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2128-14-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2248-375-0x00000000006C0000-0x0000000000763000-memory.dmp

Download

memory/2248-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2248-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2432-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2432-372-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2604-86-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2604-119-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/2604-92-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3328-118-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3404-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3404-155-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3404-39-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3404-33-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4028-117-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4028-373-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4236-224-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4236-409-0x000000000B9F0000-0x000000000B9F8000-memory.dmp

Download

memory/4236-180-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4236-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4236-204-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4236-188-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4236-376-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4236-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4240-82-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4240-76-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4240-167-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4240-113-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4268-0-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4268-70-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4268-9-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4268-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4288-166-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/4288-71-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/4300-168-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/4300-374-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/4652-43-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4652-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4672-104-0x0000000000A80000-0x0000000000AE6000-memory.dmp

Download

memory/4672-115-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/4672-99-0x0000000000A80000-0x0000000000AE6000-memory.dmp

Download

memory/4832-370-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4832-160-0x0000000140000000-0x00000001401F6000-memory.dmp

Download