1215a3e07536f672024a6a7c7b46296b3d5b08078c5f421ccf022ab7a9c207a7

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Size 1.4MB
Sample260415-m22j3act3k
SHA256 1215a3e07536f672024a6a7c7b46296b3d5b08078c5f421ccf022ab7a9c207a7
MD5 6dcc28f47a6d46d005636810a0ce1e6e
SHA1 99464a5b993053a5f6989b7c007315d63ec50a2f
SHA512 1332c3165a897648838060b8375219da2bcb10d47f4e8685cc2230e3d011d96c2646fcb472f67603aba72fd841919a3e6576d97d67afcf8ab263fee94f576020
SSDEEP 24576:MNvgRojKXJaZ87NMS2yJkX4n7sHitY1pQ5i0CVGLx9Pk5g2pAG9J4BiXC:MNvgR5XySkIn7miGu5i0CVG7yH9J4BG
TLSH
T1B665CF4667E801E8E477D03C86638627F6717C421734CBDF42A0D66A2F3F6919D3AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1136	alg.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4348	fxssvc.exe
5748	elevation_service.exe
5716	elevation_service.exe
4732	maintenanceservice.exe
2640	msdtc.exe
2484	OSE.EXE
4524	PerceptionSimulationService.exe
5720	perfhost.exe
3784	locator.exe
3588	SensorDataService.exe
5288	snmptrap.exe
2932	spectrum.exe
6020	ssh-agent.exe
1364	TieringEngineService.exe
5896	AgentService.exe
2820	vds.exe
2680	vssvc.exe
3676	wbengine.exe
2828	WmiApSrv.exe
5932	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75931b0db955e89e.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaws.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c015cd3c6ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025a4a4d3c6ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083f1add3c6ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b96fb3d3c6ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5df74d3c6ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed8683d3c6ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeAuditPrivilege	4348	fxssvc.exe
Token: SeRestorePrivilege	1364	TieringEngineService.exe
Token: SeManageVolumePrivilege	1364	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5896	AgentService.exe
Token: SeBackupPrivilege	2680	vssvc.exe
Token: SeRestorePrivilege	2680	vssvc.exe
Token: SeAuditPrivilege	2680	vssvc.exe
Token: SeBackupPrivilege	3676	wbengine.exe
Token: SeRestorePrivilege	3676	wbengine.exe
Token: SeSecurityPrivilege	3676	wbengine.exe
Token: 33	5932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5932	SearchIndexer.exe
Token: SeDebugPrivilege	4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	1136	alg.exe
Token: SeDebugPrivilege	1136	alg.exe
Token: SeDebugPrivilege	1136	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
4764	2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 1720	5932	SearchIndexer.exe	105
PID 5932 wrote to memory of 4280	5932	SearchIndexer.exe	106
PID 5932 wrote to memory of 1072	5932	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5016

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5716

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3588

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5288

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2496

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1720
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2868 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4280
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2920 2916 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ec8d572750eab90796c1bfa9a2fc5910088ce3c5121d309741a1e1549bc9b883
MD5 1d06df865939ca0f3ac9c1934c3613b1
SHA1 9f3649b2cc424346d6efc119bed5a474aa45f78b
SHA512 802cad9f38255f1c61f2904a430ec178e21382282eae885777f2e49b14a81a945843f1a17e613904d7c7768a38e2510af6e24b7e0f0f43d9c6f75075f9a7cb88
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnI5i0CVG7yH9J4BG:u3q6mjBR8sCz
TLSH
T10BD58D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8eccbc235dca19707713382fe04cf20f51c2ebc41143c99b5d77b37f3d152a1e
MD5 10077b3e1091ffaab4fd59abdddabf3b
SHA1 61b5e778fc71ef2f3a1de650c4970e9871650277
SHA512 f3a10fdc3d72f9192eb5f89b8c6af486c7d944f5420b913b196c6eeb7839766c3134b78a789a412918c377a96fe5165bd3cff3874425171bd711a038bf8291d8
SSDEEP 24576:jXYfDtczAb5i0CVGLx9Pk5g2pAG9J4BiXC:mtcO5i0CVG7yH9J4BG
TLSH
T10185F12467D408F5ED6B823DC9A1C411EA337C5447A0EBCB03E49A665F372D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 371871ec1ec7dbd217ef2473ff5388e60c255e233bedd87523d8c72f6d5a4878
MD5 79e2946a147b616778084ae3614d8749
SHA1 8decc0bf4eeccfe47d2baf98fec347201eaedbab
SHA512 5cee9f50c0f15890996028a8de4e4e6472cdb0d89f91628ac55923185d3836fd422ee7efec862c106c29b2c1407e3976051d54daed480a46e671af04b4312443
SSDEEP 24576:20Le5ji0hmxPrMw5i0CVGLx9Pk5g2pAG9J4BiXC:2Pji0A1V5i0CVG7yH9J4BG
TLSH
T11695AE16F6788331D073C0B9C5D2A69AEE7230855B308ACB4286D77C7F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5954735ef15750fd504411205021014f7e6b1bae024dcc487273ce87610955f9
MD5 6c3b05e8e134d791fd061f5bb79e6048
SHA1 5ce2c9a52cf009da46eb27b1f8e7b888289d4532
SHA512 3f41937298f5be51fd1d22b4e46af5f82d7e9a98198ec841bb0f02ac53f7a21fc954262e6a0f5d066e9645a14089fee74198273a97278d8d44ad29549e338693
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyu+5i0CVGLx9Pk5g2pAG9J4BiXC://ezSC6vUzPv+Hjyx5i0CVG7yH9J4BG
TLSH
T1EA755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 50abc5e2d13acdcbcc01a3d0c3c92ef9f365c866df39695ce123076b90e491ca
MD5 1979a67cc576f38e96c4c1bac7983930
SHA1 ea08788b98cd38fbae5de67b896a5a2d4ec8bfc8
SHA512 7de683d0f6aad174f2e0cee9fd736161d2b0b03da33c2746511f00c360c00560d054f6e091c5428118d22c756f48f8b3ee7da13e3bb129fbf49fc40567f4956c
SSDEEP 24576:UVbqPb88hv/l+B/5i0CVGLx9Pk5g2pAG9J4BiXC:UVO88hXl+15i0CVG7yH9J4BG
TLSH
T14C559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 5c64b5490843cf4d2a44e45571786489f3549df03334094a6dc33b27e0f8d594
MD5 d1a6fdacf051f0140624ac1f41a8ddad
SHA1 05dd8717a9ff197e4d18c5020c4c395da793acb4
SHA512 a22834b7c49a4528f9e8f245640f40a24712b3498c189099219160885fd59057438098851f73d5df55e354f4236bc6501ad9450ad7c59309070415553f469a43
SSDEEP 12288:s0a1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:s0U5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T14C6523421ACD2882D37E4239B69CD4A1EB323E5859C41DD3C2A377939F7C1B6F456287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 eaf920fcd123d3bbdf429717d67ae29dae4fac7451cc0c27236f65197c1e38e4
MD5 f81563bbf6cda6cde19b98a743a9b4b8
SHA1 c2f62089324d4a6f65b349f3c42b59917a1c773d
SHA512 9aa33fcb53f30ddd7d8620db81bdbdc55993acbc5f8dcec90d889373260d6f2edd639623c4049f6063f838e631cb1478a43cce2c4cd9804435d1327ec1fc690e
SSDEEP 12288:veBNUbTVO86Up1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBy:vJIUH5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1E085CF3BAE68FCD2C27E89785B91C240E77278304B61A3CBD165830EDE275E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 235e1aab9f41db61f5d176f8ea72094a867b1a9fd8de07a4de72cf638b407d37
MD5 7106dcb4d2887414e5925f0f69f6dfff
SHA1 cae296e36f73fb3aa6191f4d96e360fa1c2fc8d0
SHA512 11bd622d41f928bd24c1bf9290efb2cabc75b3ebfdbd218ce5a2439395f94004e8572685936b10b81889c9d989d57b81b1c7e9787042fb0b4d8e04e7019c396d
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THg:+QvGAdlCEL8c/WRNw5Ce8sCz
TLSH
T110266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 21961a40d511b3af363e52c8cc5ee46d7f8ea9659a74074d82978dbed223982b
MD5 3a95eb0de2f4a15a9a294272abb8f01d
SHA1 083461f9662289a4666eb9e371bd9bcf37368e3e
SHA512 f5e931fcff2aa770bbc59324759c65e4313503908a9d5f186a1fbe4a468bb7f3eacb45e3a9d513e8e0de1cf4732f1f54ee74bc97386335658a1fbbfab7c3ca6a
SSDEEP 24576:uNewsAjF5i0CVGLx9Pk5g2pAG9J4BiXC:uljF5i0CVG7yH9J4BG
TLSH
T1C485E031FEB4E432C37F0DB61B25C716543D7A204B911AC3E3E89A9E5A342D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0b09228eeee6a51fd344fed08c17cc3d81ba11eff4cd51e6d4bb273c94de5ee5
MD5 af375455e5236b8affbcded1f586869b
SHA1 1cd60b5f57f01010f63aad6e002ea91d186fa527
SHA512 59e6610c592c6039520db4865ecdaabf1250b4850241e63adaa9345b3bbe5fb5340187108f2048438009935bf86bb9a181a964637707b4da8161c2216d6e0688
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+:yUEtQevvqc2W1cpV20I32
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7f362c6115f741896c437254e87ffcac378a78a1b8dd2907af8e362717cb0698
MD5 ae4abc1eda62c5db54567bca387827bf
SHA1 17d0f157afb8809f079d0c72c448342c7a6aca85
SHA512 4fb460f74a6b1ce84de7d5a000565b2e1d57db7e8b78972689c3d34d72995ca23f003c40bb4f5c07802628da084ff43f90c2ab8f4f75ec21a2b43dc08802a71b
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zl5i0CVG7yH9J4BG:EoquVjnmK8sCz
TLSH
T198D58D0976B8C1E4D1F6C37896A2C647F37178154B349BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f469f3a48aef0fb0f423630ec86cfe6144b48afde867cdea2c77e6a2eed0881a
MD5 20bd4c450b8cda8939439b8a0a264fce
SHA1 e0d0bddc39fb1755e2093ee6927e065094f6a5ed
SHA512 460087abc75627862e84c5af5119a83076232bafaaeec10fe23edb81a4e370587d00b12ca80ad7927c593a81b5ca2922d476e544ecf735aa12c89e462ed03716
SSDEEP 24576:/AhGL6IFoiwtA5l7S5365i0CVGLx9Pk5g2pAG9J4BiXC:/AM5Foiq5K5i0CVG7yH9J4BG
TLSH
T16C35AD81E7F955D4F5B3AA7899B68171EA76BCA95E30C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 cee072651623cd6829e584893dc00e7517e20147f580435fd82bac870b3701d1
MD5 b7761ce403588aae2cb9ef64bb0b759b
SHA1 ae8e322a25244f271d2619059a650b999f7cce77
SHA512 e4a2070fe9d78b0e0a01eb6b3fec173f2be269c25b13a2d410834e8a1c31a021893255e8894696613a14805c0053a9aad97aca49a4a850419777b03122c20374
SSDEEP 12288:Omw5HEjsChNmBFgl0WDm+Cs1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43QacJ:HwuvOWR5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1EE85F14636D81CF5E66B8239C697C032F7B2BC052A65DB1F43A0C75B5F37261AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e8dff6d4a6f35482270c710160fd1272e2c11035a7dcdc8cee8db11329eecba6
MD5 53b0511ac8565647e3ccb51ee2aa7a3f
SHA1 d6c66f53fe262a5c18940fa47c18dbe44bcbfb4d
SHA512 108782ddb1aa102426c86c084126efc2efa042c0d450e23548e3dcc23bb80de076dcfd35660da71324b8474196ca1b1479f3d45819f7efbd3874aee6126928f3
SSDEEP 12288:l4Z1Iyn1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:mZu45i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1A175128223D834F2E3AB423DD9E88141E7723C5567B507CF426153A65F3A6E6AD39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5daeab9b6dc0956b911df6a3513852860574dd6d24fb488d8976e5b9775a4fa9
MD5 036a898e3adc547a8a1c0b969921ef1c
SHA1 ce2468c81150d68f69056f58a0a549d4f3a94d6b
SHA512 41d92740a4f4cc4c1392e1cd5e30df95ec0e26739dff4ecc75d97c4cb6be51ee64a6ef708d5ea264dc9f1a9eeb51436b0149b65bb99612eb926240f07f2896e6
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UE:lQRQyi36YOcPDLvw2gAf+PN3F8sCz
TLSH
T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4f86bfb694558b0d54282447c7f7f96350acbf319f89a26cd35c2130ba31c8c
MD5 c7447a0eebc6f95c9717137b8670942f
SHA1 df72aa1247b90ac2c9d273bf03ce6e14ddb79254
SHA512 4f38161ad499d6b079c16660947b44a26aaeaec6e126b7065bab114091430a22ba19ad2e1e6e3489315ab86032492b542538c2b66eb4a0df678d2a4284a7b63a
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UE:3QRQyi36YOcPDLvw2gAf+PN3F8sCz
TLSH
T1A5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 47fc02910857cc0c99af41795250e44cbf7f9a6ae4029cc98467c3e9402bcbbc
MD5 7dac2033824ecf70c0087c28312850f6
SHA1 92013d3781a53ec31bbfc7e26a70baa6c509beee
SHA512 26d88e914737281b7ea00fde808cccf263ddce539d7f5cbad53165daf36641681beec3a41fdb9dc4747707c81a82345729cfd2a0e5d0420b4c60ab9466a52c6e
SSDEEP 49152:e68Qg55nhkeWu7PNU3/V5i0CVG7yH9J4BG:sthTRc/b8sCz
TLSH
T1C8B54933B2F60099C44DE1769F4A873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2aef4278d5c9d8340f714e5e66bcb2924d1fcabe6b845840f6d45d56f2dbf72d
MD5 2198586191a53f1e298627e6ff022931
SHA1 9224aea8e7499a492aa48e849c58d5f5fcd45273
SHA512 d923b5ac67a30e93bc8415b2b8b67803e230520b11a2b696ec07b4fba1c03cbc3027d998422ae519e4dc6fd9c8248361d5c5bebaed06af0c6386b18a55a5b885
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99C:Ry5112gYy5azzVvU69nLKnhZQ8sCz
TLSH
T1B4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 60925d41c0f7dae4acb8eff16035e760312567213a88280d9192adefbc3ffb51
MD5 ddf2f4bc4ac6286fc7d2f94d5413c117
SHA1 c769ecec219087ea8f11626559c932b971821b4d
SHA512 14aeb8ecb7f6d3e01b7c66e4e0f92ed18de194607a8193efb34545a7b386a9c1f3346977f9523a35d3764b951233f41fc60068b6dd67f8bd86bde9832e69a993
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glr5i0CVG7yH9J4BG:Mu6JmIxd2d98sCz
TLSH
T1A9D59D13F1DA01E8D06ED178974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 23df5e3fa3210a31ba9294dab23d937e5656c82a0283434f0be9480f46ca0363
MD5 40268f23cfe734a3156297154f4be59e
SHA1 64d587c4b14b63146dfd0abd09c51178585cbffc
SHA512 57f12d5627d95a36a2f2db1cb89376dd15e7b8d447ce50972d47a7566fa60f4f56627d71c5fd5a45204223ff0ac26f5c719391c852a3b54532123c9874a7a2fc
SSDEEP 49152:f1hpsNoJpF1A67U44CwH7R4xn5i0CVG7yH9J4BG:fmifPqRK8sCz
TLSH
T158B5AE13F2D900E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BAE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2ddfdc5a82ae5840858475aea58013422509ea7df19ea76ab11e8e760cae7bd2
MD5 addb691a711f18dc1b5933ddc74c07be
SHA1 347325ccd4ec4a55c90f6f3725c0ef3491a340e8
SHA512 190a1e0d9b6b909caf6fc4182b1fe9527c8a52b51262f402d3b333992ebca9afe99c76ac263cb827143c94fd488df32455f542d6f5fd69a99b9fdb11c4f4987d
SSDEEP 49152:rSuZQIY0Be2KkRVtOnks6NMHq45i0CVG7yH9J4BG:55dKqi6108sCz
TLSH
T130C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d43cc4bbd839f8994344a56ffc451e13eb9046c3ff0962cc73bac11a0207fd5
MD5 9124e20679d5a0804fc98fe7748cee08
SHA1 299c238b6a5021d380cdc8e47eca06bcd3d88537
SHA512 861cae87b1fbd69453e7806e8c094a5b787aa557e121857812abced3c9d32ba302d5d9a99a179483974fdb45eed2196f2edc3c98d446b389d43f1d12000cc5da
SSDEEP 49152:+htSn8EApI0figjgiDn0AP5wb5i0CVG7yH9J4BG:fX2iWphG8sCz
TLSH
T12495AE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7aab496b3296f575923b1b3653f235e6bc1542475a4ce794f8e84da9462c495d
MD5 cf9b7b8ac58df1090268513062067527
SHA1 1b1cb428c5624b8135373d329290cdbe0722527f
SHA512 5146b02ff2c50d90b2f49b5dcd4264a39003469a8795623e03d4c4aadfd7d5f5c3e8c46efdcd7847f54fb89e5003f978acd0791864fa1f51a2437867f905d0e0
SSDEEP 12288:ZS1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:Z85i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1B665234219CD2C83D32E4239E658D0E1EB363E5CA6C419D782A763639F7C1BBB855287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b65b1f7b950e109d455f80b0b7e936b81438af0e6f29360bcb25656f9ec61fc2
MD5 3094f9e43e496881d4b40ed551bd66ac
SHA1 5cf57d94ffc2211a741a2c31d3d07bc534d6979b
SHA512 2430414367e62f5d7a0b8a9dfaf8177e75e28bf88abe3fdc4e87a0c2cd62761edf12febf0cdd44ebe7b8e6b2e1e26e5b10bac898d1f1f344f14d3b893b3d2df3
SSDEEP 12288:4r1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:4J5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T14365234219CE2C83D32E4239E648D0E1EB363E1CA6C419D7C2A763539F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 394319d8426bf994914f5c22786b79eb8d012b8b0c0bc0d6089471d1875de3fb
MD5 c9d796c615ba25ac2db3548eaf50b2a9
SHA1 088399853114b038fb640bf3496c7d8fd8193b3e
SHA512 1d745361fbc2b58e13088ad43edfff8eaded242c74329e34e7df28b5cff13224a00b3e4816da272150ab7bb4584b79bd3d9833ece020851d1be6b3eaa00f76d9
SSDEEP 12288:eB1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:eP5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T13B65234219CE2C83D32E4239E648D0E1EB363E5CA6C419D7C2A763539F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 b45dddb16fa39c2d4dc99d2bc5c2ddc47af2bb579a0952ab867e9e0b6a90d8a2
MD5 c67ca07322dede84f6462b1dd7374aab
SHA1 62a7c4b2d9e53e0c607a561e7f7a0d373a7c354b
SHA512 d128dea73535af101500bc577accd447936e047db549e229ed4f50a44db8a951373e069f687d0ce2550e74a503b4e2b988479454eb4a639176ee469045b5e51c
SSDEEP 12288:cV41RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:75i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T11A6523422ACD18C2D33E8239DA99D0A1E7723D5CA7A41ADBC35217534F783B6B835793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0772d2fa76c240205e988fc45a29745effcc2ebf21152ba425fa1eb4fa73e11d
MD5 9f7caa8a4d29ea9141d898d9398d39ba
SHA1 39e3a888d65040c5c45dd0a93be227d6844152d4
SHA512 e5f179ab7eb414caba006cfe5ade8dd1d1d9d88e720d4cf6b78f41b61e818f80d949e8a01c7c2503f639ef7e257611908a27888da6b463a294a407a1ed060899
SSDEEP 12288:kg1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:ky5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1B465234219CE2883D32D4239E64CD0E1EB363E5CA6C419D7C2A763639F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3ba580d71e77189283490fff070d0dff4de07e70041ea4c7b8bb676c171be789
MD5 b7e382a5a004c4f27e30985788268dce
SHA1 add768fa57a2048565f03a58504ba0e5fa559f72
SHA512 2433966361173ea51bcf552649b0adf1edea2c8bedf22d0ac7fedfa2138ff813c7302823bd4edd45640b436e4e3b56f9818a2cc7f7fe785dd43a53f17f6b1a89
SSDEEP 12288:Mv1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:MN5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T17965234219CD2C83D32E4239E648D0E1EB363E5CA6C419D782A763639F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 62374b930c337e14c1bc7cabf0611277ed09a9091c126098917b4fe8aad0911f
MD5 ebbe593cf7e599449fa4751b4a545a9e
SHA1 c8cbc988a4cf884d3c7cee6545921d443392631e
SHA512 482620c235742023b5940327fb4d756883790b522279157dd18ceb7b0f9bf8c18299bee756ac9a10d85fb931530d0864ccd9b6d97f6b156dd6fd576ac57f935a
SSDEEP 12288:qz1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:qh5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T12065234219CE2C83D32E4239E648D0E1DB363E5CAAD419D7C2A763639F7C17BB815297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 501e7cbdb4e9b8aa388b28c102c2a4007e02d28bfe93783d3f06a71f708e61a0
MD5 0cee7acd42e458e642790a36baeb7a3f
SHA1 4933a847ca1076752d1ef6a760088346509bff15
SHA512 09f675952e59595e32e4cedc07be0f13455bbb6fc468836708c9736b8bfcea8c9cb81b453c9d942a51c4503970acca11de267a3905994b90404b8f4f6b129492
SSDEEP 24576:bZMNzFVSOp5i0CVGLx9Pk5g2pAG9J4BiXC:bZMNzf95i0CVG7yH9J4BG
TLSH
T1BC85019173941CF4ED67823EC9558816D6B27C190BA0CA5F03E436675F373A12C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 1eea0af51f22ff4a966ddeceb16587390ae6f9d8b237f5647bbdfecdd10eed78
MD5 2c33660ab3622ba073b247f9ea35a18c
SHA1 f59ce89f5cb6d1fc2165024c8ca749dcdfc99d17
SHA512 b0ff9dbbb0aa390e006005776d65f2b6709f93a4f2802283780496aef2cf1d195b4f69c8388f2fc6970bdd99b6883eafaa4fa0bba11c6a63064a989b64d8f348
SSDEEP 12288:3+1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:3o5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T15D65234219CE2C83D32E4239E648D0E1DB363E5CA6C419D7C2A763639F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c4e3a2a6f9a2cc7c4024581f05f72b30c2fd4b1754c339c1affe324e02122f55
MD5 cddb3133fc971461781c51393b36814a
SHA1 37ccd5b144b91434f48a11f599213d557fe9801f
SHA512 a3da0fb06e654ad720c5ee950b9c90a8819f6d2d974bf25a4f4d2c8aeeacdc30ff16e41e9815512f750ca14ab5ea6c0c20b09435c843baf040d0cdeeffb42f98
SSDEEP 12288:ZK1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:ZE5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1F565234219CD2C83D32E4239E648D0E1EB363E5CA6C419D3C2A763639F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 33bd6fb872bc0c795e281ec1cda4b9afd57d0b32045facb89c2fd17f1ff1262a
MD5 19f4bdbd0e6df56eea942fbdf7942544
SHA1 6c8a64bbdf52f0407f44d1cd9ffc22a157f8c8e7
SHA512 2e833794c6257a20931a99841a37a0a38432f012b06a246549aec16af4ce295ef5a88f0e0bb99d50272e57f85885fac0deb86b4ca6cd3a6bf99eddabb910aa9d
SSDEEP 12288:CyPz5L8n1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:fzy15i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T11C75014332D930F5D23A8239C9A55952F7727C3547608EEF43A047772F3A2A1AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a707521d946cfd9d5852ae0d9aaece15dc094ad818958c19a5bfaf0ed049bee2
MD5 fe61034e6a7430df36e64ea1621141d2
SHA1 320e2bd8e8a7b2492262ba800945f8c7c162d9cf
SHA512 ada5130a67efc5fa0312fe7ecb4906e55a2ff2afcf52b5fd2e25439e823eebf3419fd4a08472deb1453169642411f2364f4382a0f32456448f46c745de13399d
SSDEEP 12288:p+1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:po5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T19765234219CE2C83D32E4239E648D0E1DB363E5CA6C419D7C2A763639F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1b4a472ba12eb3cd3dd6f1d33271c9b7e2a2c35ce8448596a77e8bd647c31506
MD5 8dfb50e1be1c1ab3f9da194553e816ed
SHA1 0643797d483e04d832268f922b03a82339ddacde
SHA512 a3b829e06a53690eb3a2b096345fa26bef1a91e157cb7ea358a8a11771c5df6750d5034db840a8f770ff60ef801f3218607b40f691d8d5daf24ad9c4f8da71e6
SSDEEP 12288:Y+1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:Yo5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T19065234219CD2C83D32E4239E648D0E1EB363E5CA6C419D7C2A763639F7C1BBB855297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 cda8c1d3700a693cdf9d678afda07ea722361b3df66432d811a884489ef4bcc5
MD5 5c96bffb5f14bc4401279296c4cb7606
SHA1 ea93a1c7d733c8611cbb6c6ad49dae3c5f687087
SHA512 695ce8e81da195992720e325d35e7da7660f4199261d3d13c7ca4a5c3be60b2be8e4781d1d1f207979b93cfbd41631c05280ab3cfdf67a5fb0ce582e13605f31
SSDEEP 24576:7CUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAz5i0CVGLx9Pk5g2pAG9J4Biy:7CUAPTY+8Wg2lIL8lrIUJLWwy5i0CVGo
TLSH
T19A65AE1EA3DC0896D1BB81358A51CA16FB327C2E1B2196CF1160C37D6F27AE95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c4fe127a86be1c6bb137879c19ade40d0c947fde186dbc14acdb8a0021d07a8e
MD5 b63e2369a060e203efee82a654a6457b
SHA1 e4e83241fe2331369893b6bce45193ba5c34e74b
SHA512 d05584b0b99f20ca5266269838677e95ecc4e1b9cad9da6e6ea9ad5c46fefd0df006181ce53058ac583227c073fb89215edfb7f65a8ef21def5cc049679f7cd4
SSDEEP 12288:ODsfO1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:545i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T154750106D28811D5C26E5239CB598681F7333C2897E097CB93D1F63E1F792A1ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.ini

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_6dcc28f47a6d46d005636810a0ce1e6e_cobalt-strike_icedid_luca-stealer_njrat_vidar.ini
Size 65B
SHA256 20495311dd3fe12dd93872d5cb566655dbd7cda18fc50b839110f31c257974bc
MD5 21f1095279e170b820c35afb428e3716
SHA1 c0b8061d12fc03131ccd163b3a8efda525f56275
SHA512 77dc2eb089411dca3031497ae486a871216e9e04f40aaa108409ff3e84452020f6c0d40ed35625a04c8adfc8b163dac1a70eeb65a851c7018c10919176b0bc72
TLSH
T1CFA022020030C00288808280F0B0CEB083C883E828820C000E8208CBACA320320C0802
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 92d5deaf8fabd04106ae074808409f1facec99e84acb3a34fd2a697e6e0e69ea
MD5 10dcd8a40819b012f9fb66f9ca703f17
SHA1 f5a13ff858b930769e2d0d5d6c33ad21d29191c3
SHA512 29a236ea6d342bfbf1599ecc839f3fd5bd6d2ca50cc937613c48de413b7da936c013e03fe8d53ad75ed50b2f44ef9f595ebd30053346c8f109a8cd3a45afbaeb
SSDEEP 12288:Yh1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:Yv5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1B565225216CD6C82E37E4235A69DD071A73A3E1C9BC419C3D29263A2AF3C1E6BC75347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 212934de44ce119b71e2d61d78b22b1a558da92c22eed600917a08a745cc1e94
MD5 15983b746da42f7d43293567c68cf3a4
SHA1 9b1ab447c266cdbc0308f98fe71d92988b4f2be2
SHA512 6650384d6c7d669340791441e6977330fc15a10b8629a97f1690a879792dc93bd2896f853b30a84b96072694ca08eeda2d738b73e06b6945f4ead40865311b11
SSDEEP 49152:BRZwQCyiHiQEaiPnMQ5i0CVG7yH9J4BG:79xPPf8sCz
TLSH
T1C885B01E62DC46A5E0BAD278CDA74407E6B23816573197CF0291C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 e9bb04e5e74dc01e69ee9e1fa66246b7559f72b0b443f2673637bb2358360bc8
MD5 e9cb20db5072526809ccf0461e127ac7
SHA1 1a9e38b503a9460b88912dd8194b56965163fe09
SHA512 1451ae5840682d6c6da19b6f34ea76d4968f4c8e45afa948fc9be3b37ce6f8ca17c3b84b8b894f00a5e7bf82a037d3bea30059a8d833ba3d9ac47be9f9d71d49
SSDEEP 24576:vbxA1UGf5i0CVGLx9Pk5g2pAG9J4BiXC:vbxA1U85i0CVG7yH9J4BG
TLSH
T16775122E26DC28E1E27A923D99D5C001D7327C19276057DF51D2837A4F3AAF9AC35B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 80299a3602286c5f88fa9eb96ccec000e1c52a40f59e92403027dadc8448636a
MD5 972f4b5023d818a36c3554ca0f31472e
SHA1 20e2715896a49e3af7d36770c535bc6d38dbf09b
SHA512 b3366d8b81d907b7650a2858091dcd5b768d5832aad6249ba9f98144a7c0c951d260b15069f15bcb1fd31be574ed9c8acb7aef1ea806e5adaede09783af9c451
SSDEEP 24576:vjsmP0yHaqrVqHra44KDzMsrnK5i0CVGLx9Pk5g2pAG9J4BiXC:vjRP0yHfVqzlAsrnK5i0CVG7yH9J4BG
TLSH
T1B445BF2EF2B910F9D4AAC136454507B5FB71782D1F209AC701B0C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 bbb3478166ea71503d0264ea213e702b488fe5e184507416e9305c179e3a703d
MD5 ecb80d0fa48fd2053eaa7eb6d7895f04
SHA1 1c43297c2482b753eee1f9f8cd59ff2b584d925c
SHA512 874ee1025381e279f54c8a04470771601988b2ffd470a6d0ed9bfc747f3ced24098df4e34e6846f73a9d74bee4e6f27a0fb97ca82121065062d161199ad4cdb3
SSDEEP 12288:dP1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:dt5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T10265239215CD6C82D33E4239A648D0A1E7363E185BD41AD391A373639F7C1FBB876283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1b13376a6be04ddec0c90b8962fe060191d51cd96ca36f42e3c47bfd34ce745b
MD5 30ee8c6ac48e8c186521be6be63a7400
SHA1 8b78ae60f8652322c79d17ca34d16a192e06c487
SHA512 8e34a10b19a3862c3294eb658959fd344a88bb6b8c2cf7965682123b81fd9c97c67861fe128556e06cbd7b0426eb88de16692457a5862e5d8e0bfd2e67f83129
SSDEEP 12288:1ObOA4LWO+vAYFTN1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5t:yeLBUTb5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T1FB95F151E7D804F5EA7B823CC9A68512E672785C0764E7DF03A94B661F233E28E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 dc614f0a0762689822849969e2330f375b61ab2dc16d27e2a4db1c43e8384774
MD5 d9d1c620f34f62ee280c0161a269c677
SHA1 0b0a282f7df2edefce720ba63af135ee911bfaf8
SHA512 df790714f0bee0a1b8ae43314593a55224b2bf89ebdfcd92a2207f4e873d6d44b8cd04f27c4b4cca49e5b2c7e48602e961aa90d4285a36ac2bbdc6b7ad36264a
SSDEEP 12288:U70Vm9IYNvUyBpi1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5Bv:hJYNH25i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T12B85E12E629D1CE1E63B913DCAC2C159F2737866175196CF01B0837A1F27AE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c0fa44fec3b4697a51de592fca3149ab0bc4e17d86c1bf7f989e4c18430a7a4f
MD5 5cf218d3dfc557a2cec17d0b3d65b52c
SHA1 3e677190a95c3d902101936dc0453c905732648e
SHA512 04e7c854e1d8d6ab668cb88c6b4f6c22d79b094d812755a2c9421e5ac59a4ff5facfbb9495de794f8124e8575b8b33dee3c177b8550883732048a09d40683ad2
SSDEEP 24576:TnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKn:TnXoJJYH84VVS6AmETJas+cHBjSSKHPO
TLSH
T17765BF5EA2BC04D8D5BBD13DC5C28506F5B278651331CACF026182BA7F27AF5AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7986d48551d6e79851d6edd2e978d101a058c62901c8a152c1c06a3bc464e936
MD5 b17a434f28d19bc8c5647556ed8f4f81
SHA1 a366716c92320b8240223183e1c648d7d725d60d
SHA512 d6d3a052e02795ca0a5ba921f10f69bd28dee1acfad6b5516e281321f1bda779f9b0fd96b24f802570e2f66415c300fc9117c2b681af95f14ed97421b2773de8
SSDEEP 24576:Nv7Xbxd9Tuycf8M/TYlSuxrr2PC05i0CVGLx9Pk5g2pAG9J4BiXC:NDLL9TuJ0M/TYj2PN5i0CVG7yH9J4BG
TLSH
T125858D5EA2EC52D4E07BD6BD85B79046FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 cbc8e13047e32a8f91a801eefc1b122018fbb3c20efdfd61b08c319256f7a902
MD5 095918a03e9feb68d33d63b04b1c4c9e
SHA1 ce9b781304bf26f905843a6399691a7e39e4e324
SHA512 83025c5cb97c0406ab775c9fdbaef4746f34ca5d4a348be03ba96550720c73081c546c32865e0ab0921863597ade9925dd62efc321f89c2db7a306045f2d37f3
SSDEEP 24576:4egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wb5i0CVGLx9Pk5g2pAG9J4BiXC:4ngOJOmPOHkb5i0CVG7yH9J4BG
TLSH
T15555BF3FA7BC15D5D03EC17D8A968816F6B1782613255ACF01A0827E5F2BEF46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 31cfec53f00e564ecb1163edc281b9f40afccf8eb88a38c278ec9ad6db704149
MD5 59b65a166896678df19ccb9907f53648
SHA1 7bad6ef120850baac7a000c1d1cdc09d856d400c
SHA512 1b8487d12d46f771e883f541f1ef383f37dfba451b2082b980e291f68e43de2f7d662615f3a523b50894139880cf5369383ff9ede3478a65f279b9c34d44f40c
SSDEEP 24576:wLJnJiTk3R3waE4JrON5i0CVGLx9Pk5g2pAG9J4BiXC:wLJnJK8R304la5i0CVG7yH9J4BG
TLSH
T10885E02DD2E810E4D4B7C2B4825A5696FF32387C2B2169CB59B4D5313F12FE0A979F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 566ddd38bde50a3074c5178d38c24f6485f58392000636eabcafec004a92647c
MD5 a0a7a7224d65f5013339822fc1aaadd6
SHA1 2090d74003e99910491ca3fdd737c19cac47ea32
SHA512 6d2fb1f3186511d6f725fed709dd5393753f937204db095bfd58b8a1cdedd64408f24ab9ca447be7a83f37b009c4510201834c3953869e7418aaf330ae6c286d
SSDEEP 49152:89mqCzDScAZmlvTcFg8Ph6h5i0CVG7yH9J4BG:+W8sCz
TLSH
T162955C05F7EB5294E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 dacb88aeb735dac2f26980b2ca023f36eb11d73e1b684da61601a49baebcf825
MD5 37e3a1f3dd07853f2d2b6ee91ab72d0f
SHA1 6ae452c72269c9fb7c0abc4b72ec0661ecefbd6c
SHA512 f43434212bf9b0fefafedb15c4691d651a9feb1d4e800680820deedd724342674f4e0ee8de443a1e1d1b602cc89b9a618162262e044ec6328d4beaab780c5fec
SSDEEP 24576:zlYJeXm5jUuEL5i0CVGLx9Pk5g2pAG9J4BiXC:zlYJeXmRUuEL5i0CVG7yH9J4BG
TLSH
T1C375125D36DC34D1E33E813DDA958450E372B864178127EF81E0C27A8F7AAE66D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 ee7ba2194109208bcfb3f49f90fc1fa3ef7ee069781e82e72d0f6630cb002f2b
MD5 5b215bddab0825db1039805003c3ffb7
SHA1 94a872936ba26ec6b423d7fd90eb8f5f1204cbf4
SHA512 8d5042ff874259fc3a30a6dde21e9f133bce31a2900e3f8c9794c4186ef7d4a7016c462a5d36a6a2581bd0853ec0e88696d9b4afef5fce4bfd1db7e15d7a9945
SSDEEP 12288:eEu6kyI1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:eZtyq5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T12B75124122C86491E77A4238EAA6C0A0DB367C249B5057DF81E1F73F6F397E5B831B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 0c9442151c5da2e92a16c8947ab77a0e5c9cce9d0000f20b8e829a11b8192266
MD5 998d6aab911e423292fe30c849b35dce
SHA1 d066f19682c551c0102cfb9b14b262ec05433859
SHA512 3f5e03a6946441b1c641e403edaa93531dca83411dda8a3d2a8dbe237ae668d798050860181be56e710a302b96520dc55919c47c0c3108672431c6681549acc6
SSDEEP 12288:xPN1RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5BsBXSHR:lb5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T13E65235116CD3882D73E4239A659D0A1E7363E285BD419EB81E2E372DF7C1E7B831683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d0a10e21f0fb7545d4f6f6f2ca20165b97e60ed254f425c5c61928b9e58a84d3
MD5 ef2cd0023524153c51485f10e496c480
SHA1 45de445101df06f1ac03e37e904adeb2c6566d7a
SHA512 6e0a87ba9069cf577b47c5bc06fb8a780c6e1c2513afa70adc7704b0b24d4c44e4aa390ea7217fafbf5becbd324bd8c3855f54db02cedaafe5e64de7920f125a
SSDEEP 24576:WC+TyQIu93VAumZr7jmY5i0CVGLx9Pk5g2pAG9J4BiXC:W/TfIq+YY5i0CVG7yH9J4BG
TLSH
T14C559D1DA7E91DCAE276C675C8A34493E6337872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 a5a64085dc25cd7f3d4baee0a36aacbf7868167c9ae95f6347e2570815ee74ef
MD5 399197fb0a74c715d350134d959a0cd7
SHA1 ccf8f8b9efeee813e1a3d90207d1393051667d8b
SHA512 972c04aa02580e9ffa124a3670cadf94bcaf1a8483fb6313e7dfe85766e1d5b00100ff51e1688ded200f14d5fab059bedd680b96cb10a333cfcc56149c832868
SSDEEP 12288:8cyrWOstaa3kcs51RTa+670CeaXhGmcW6ugPVOfj5g2biMfwNh43Qacy9YY4x5Bv:5LQikZX5i0CVGLx9Pk5g2pAG9J4BiXC
TLSH
T18875F10F73AE1092D16B823C88858152F7737834575167DF42A1C77A4FAB5EABD38B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 db831acf365ab7af1a38f9f38d04ddbed840966786e596c50cbe0debf48949ec
MD5 44671b86760bf77d7a3acd1ccbc146de
SHA1 5c2828e075830d8728cab7de3d973d4c311425af
SHA512 33b96bfca0a2927c77744a87fd82ccceaa4e87756544e9c6c3d0a7ea65c4ed0e378f069fe756fc30ba29d51f629f887a2347cde36322b9ba7195547009265527
SSDEEP 49152:/pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPq5i0CVG7yx:kpC7b4+80GTk/8sCz
TLSH
T1CEA57C3DE2F810A9D9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2811852af759a7c5f4fa10582048b4a1deb5d5f80d0f9c4410131b07208e175
MD5 8df787a8b05bfcdc2c1b3585dbe046c2
SHA1 057ab0be261d0ebd148276742cf8ff1f73e0a422
SHA512 3ff8be701242e2c4e328b583f3cc8b3661c390a3b01c8931bb52643fc926c0d9bc6261cbcb4f1a59be78c41e71e7db37d443d94702062411be6bc5845252da52
SSDEEP 24576:ySAwJPE1IDAo+4Kt+l4413lUQS5i0CVGLx9Pk5g2pAG9J4BiXC:yqPCIo4Kol4jQS5i0CVG7yH9J4BG
TLSH
T1E855BF2AA7F956E5E17AC774D663C511FB723822133163CF8290823E0F169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 d2c8d2010efc7cc02bc4548b622f602d57906025b41fd1967f7a25ca50b863e0
MD5 c6bdb6ed4b8235d0b9b17db6c3ec7480
SHA1 26a687a568514d1ecbfa42fd9dc9e5adf44bdb19
SHA512 4a0abae34674ca08d88ac3f9c394f1a7bbbee67e1aed3c55d127e01d0b235dff9093e6be2951ce174aa8e819fdae95f110ced5e3ba625c9a601037d4392a66a9
SSDEEP 24576:ZyLXPLcZ94tC5i0CVGLx9Pk5g2pAG9J4BiXC:Zy7PoktC5i0CVG7yH9J4BG
TLSH
T10B95E03ED69D08E1E57AC27CD6A38506F6723CAD037166CB05E091761F6BEF4A939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 1b333892e6fb7303dbc2d07842d3d7b5955cb167d0342fdcab2eeb0f334b18d2
MD5 b3799cf33636bced26e94305a3490b09
SHA1 aeaf3f5635f9d50c1a3a39bd08d1f2a0fdb7e815
SHA512 5505d222e17ff19dca9dd6a2df787c58ab9a681496fd3bca2fceb73bbc280b1a1430c60782412c70087f7c83ca5655c2dac5cc39f344be69ba5ac99da9e00381
SSDEEP 24576:RWv8qjpn5i0CVGLx9Pk5g2pAG9J4BiXC:RWv865i0CVG7yH9J4BG
TLSH
T13C75124E16C828C1E23E4234E666C061D2727C7917A45AEF71D5E6B78F386D1E83EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-523-0x0000000000C50000-0x0000000000CAD000-memory.dmp

Download

memory/1136-23-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1136-14-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1136-109-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1136-22-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1364-195-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1364-204-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1364-470-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1364-201-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2484-532-0x00000000008C0000-0x000000000091D000-memory.dmp

Download

memory/2484-100-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2484-232-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2484-106-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2484-111-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2640-97-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2640-215-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2640-531-0x0000000000D80000-0x0000000000DDD000-memory.dmp

Download

memory/2640-94-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2640-88-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2680-235-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2680-524-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2680-245-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2680-241-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2820-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2820-233-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2820-223-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2820-229-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2828-270-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2828-259-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2828-265-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2828-545-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2932-178-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2932-409-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2932-169-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2932-175-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2932-538-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/3588-534-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3588-527-0x0000000000C60000-0x0000000000CBD000-memory.dmp

Download

memory/3588-156-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3588-146-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3588-280-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3588-152-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3588-526-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3676-247-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3676-537-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3676-253-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3676-257-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3784-535-0x0000000000C80000-0x0000000000CDD000-memory.dmp

Download

memory/3784-134-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3784-269-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3784-144-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3784-140-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4124-143-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4124-36-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4124-28-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4124-35-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4124-34-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4124-528-0x0000000000C20000-0x0000000000C7D000-memory.dmp

Download

memory/4348-47-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4348-116-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4348-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4348-41-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4348-112-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4348-114-0x0000000001610000-0x00000000016FA000-memory.dmp

Download

memory/4524-244-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4524-123-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4524-126-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4524-117-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4524-533-0x0000000000C50000-0x0000000000CAD000-memory.dmp

Download

memory/4732-73-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4732-85-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4732-79-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4732-110-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4732-84-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4764-82-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4764-0-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4764-9-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4764-7-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4764-522-0x0000000000530000-0x000000000058D000-memory.dmp

Download

memory/5288-167-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/5288-158-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5288-164-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5288-536-0x0000000000C40000-0x0000000000C9D000-memory.dmp

Download

memory/5288-324-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/5716-192-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5716-71-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5716-68-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5716-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5716-530-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Download

memory/5720-256-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5720-132-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5748-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5748-52-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5748-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5748-177-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5748-529-0x0000000000740000-0x000000000079D000-memory.dmp

Download

memory/5896-221-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5896-216-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5896-206-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5896-218-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5896-212-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5896-220-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/5932-272-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5932-278-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5932-322-0x000000000A580000-0x000000000A588000-memory.dmp

Download

memory/5932-288-0x0000000001C90000-0x0000000001CA0000-memory.dmp

Download

memory/5932-304-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/5932-281-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5932-547-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6020-193-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/6020-189-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/6020-455-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/6020-539-0x0000000000D40000-0x0000000000D9D000-memory.dmp

Download

memory/6020-183-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download