9f35c91efe6b9565a4722e00c11cc6fdf971cbf6d69db44d6ebc01f06126bc73

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260417-ege7bshx8s
SHA256 9f35c91efe6b9565a4722e00c11cc6fdf971cbf6d69db44d6ebc01f06126bc73
MD5 4fd6c1a23ebf2a25b596f5461a19d2e6
SHA1 4cb11c087f1891b880971db82f7770a11c485739
SHA512 8f1cac10bf17cd6a68c4171746915c6a1b516c520a5636799e03ba23bb93f8cf2da669e53e58ea7c39eb0608b80113d19c9cbecaffdee16c34ca0f6b380518e0
SSDEEP 49152:sgh8jK3xEPK3Hkcm4L8A5ilCfJJnB58MlSKl2HJp7tJqwYB+IZY0nGMAl6I19X:sMYTKXkcmEfJilJqwYB3ZY0nGM3o9X
TLSH
T1D6E58D6D7AED00D6C175E0B8CC022791E2B2B825473145CB76A46E2D6F3FEE49E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4040	alg.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
4932	fxssvc.exe
3640	elevation_service.exe
4404	elevation_service.exe
1744	maintenanceservice.exe
2076	msdtc.exe
564	OSE.EXE
2360	PerceptionSimulationService.exe
3656	perfhost.exe
2676	locator.exe
3996	SensorDataService.exe
1252	snmptrap.exe
3168	spectrum.exe
2144	ssh-agent.exe
1364	TieringEngineService.exe
3092	AgentService.exe
5092	vds.exe
2568	vssvc.exe
2664	wbengine.exe
1260	WmiApSrv.exe
1656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4be92d97932a944.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\java.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036f55ff41dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1454ff41dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecca5bf61dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dedfaf41dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6214cf51dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a000ef51dcedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e90457f61dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b21240f51dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
2008	DiagnosticsHub.StandardCollector.Service.exe
2008	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4932	fxssvc.exe
Token: SeRestorePrivilege	1364	TieringEngineService.exe
Token: SeManageVolumePrivilege	1364	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3092	AgentService.exe
Token: SeBackupPrivilege	2568	vssvc.exe
Token: SeRestorePrivilege	2568	vssvc.exe
Token: SeAuditPrivilege	2568	vssvc.exe
Token: SeBackupPrivilege	2664	wbengine.exe
Token: SeRestorePrivilege	2664	wbengine.exe
Token: SeSecurityPrivilege	2664	wbengine.exe
Token: 33	1656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1656	SearchIndexer.exe
Token: SeDebugPrivilege	1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1292	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2008	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2744	1656	SearchIndexer.exe	104
PID 1656 wrote to memory of 1792	1656	SearchIndexer.exe	105
PID 1656 wrote to memory of 4680	1656	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2444

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2076

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2676

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3996

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3168

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3792

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2744
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2796 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1792
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2848 2844 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 36b76c659cea063c29e5b58f0f506081045fb49f277abc35faee16d2ad1e6f24
MD5 22a9cfbff3bbcd95ba8cf1b79ac1227f
SHA1 1c8854590885564a01ee630ea18f540516bc2ea5
SHA512 01f0f673bc80641ea4c72a9d8b41be0d772364658cf026937d7b36eb4af5dead375aae072c95057740015a482954bddf92771be034e8379929ad26614ab8a311
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTtJqwYB+IZY0nGMAl6I19X:+3q6HjB+JqwYB3ZY0nGM3o9X
TLSH
T1D3D59D03F2D900E9E06AD578D7469133EAA2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bce53ada8cf7abe3de74ff44404e674dfaf66b9a4690d45202610c40b6c1cd2f
MD5 72cf372eb03b32e7d5b64ca977e24f3d
SHA1 54755028f73ab59323c6b1d04f7a254a6d1449cd
SHA512 e462aec073a6e70dc6c806f322f6103db5a8514a4a0b7a2f21ae1b5cee972943413d57da0a746344929f4804de9ea122d9117e8ef5bca1aeb1ed71a5655bcba3
SSDEEP 24576:FXYfDtczActJqjcYYTI+IZY4jxBRvc3cAl6I19G4:QtcptJqwYB+IZY0nGMAl6I19X
TLSH
T16765F128B3E508F9ED678178C9A18412EB337C5547A0E7CB03A4992A5F337D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bd5066bf10abecc903c0d7bba6ae29e936720ee516f9cd65c753c0d872599cea
MD5 a17613509ab6a0fea2cd54d1b040bec2
SHA1 150c4fc7c4b0d323a42afb6ea88c25840f839484
SHA512 5e3a78d638c978d196a0e3546fff34f52610431c35b8fb1aa1333aabd8cffb29cf38ac57c0abf427c5fabf24c5535f0c91bfa79ce2cf25ba1545a2e2a02c6212
SSDEEP 24576:k0Le5ji0hmxsrM7tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:kPji0AS2tJqwYB+IZY0nGMAl6I19X
TLSH
T1A9859E15F6788335D073C0B9C5D2A69AED7230861B308ACB4286D77C7E67BE68536731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2daf22994c45910ea93fe4c6c6cd9bce6e226ea55b990742aa16f75adc67f07c
MD5 a20e175691366dee5d81e9695f1fda36
SHA1 704e7980754bfb8b5f9328f361f1caa7d18fae72
SHA512 ff95bc5c5aa869820884d98de6a45a4d4dcf0505c576f40c12375fa6f25a7ef5f947b7e13b0dacba540c0bc231c99a4b3aa5fe4e4b3cfee5c4c7f1ba0c333395
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuZtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:q/ezSC6vUzPvxHjyqtJqwYB+IZY0nGM+
TLSH
T1BF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a90a6dad07f60068dd69e6c13e42d6d125fe37266761c73b2f5c60b1ea8f54e5
MD5 f2ca975986734caad3e9b291f89e4957
SHA1 b39d05ff80b441485c523e02cf153ee524bf12fc
SHA512 71bc1eb01ad0224abf5be124ca85b40a845de576f726fc0fea6fe902fb88074176581dc26bed6b4e5de985372476bf84a4f9519f85a91cdfc34852a3bea14dd3
SSDEEP 24576:sVbqPb88hv/l+64tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:sVO88hXl+PtJqwYB+IZY0nGMAl6I19X
TLSH
T1BF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0651de1e4544c2f43a1cb1716aa5a742d187e3a656de62ac56003c10069021cb
MD5 42eb1c053c0fa19d76abbae2ac14bc0a
SHA1 34453959e2790c956971f211a6e868afd3913a60
SHA512 7203f2544f0d5fd09bc484f8a1f9efad39f3b9db63ba570463a19cca64665abfaecdf8c24585617cc23b52ef03d0b79cf6325974873b136d20684d8fc8d73681
SSDEEP 24576:njntJqjcYYTI+IZY4jxBRvc3cAl6I19G4:7tJqwYB+IZY0nGMAl6I19X
TLSH
T17045235DC31E891AEB1A4C70F2D890A36B3BBD5C0AB48FCB8B083D5E95B86D4F095547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2752df8b81948326d2e63288c9a7d565be4ce3fee1a61a482462e4d08c8c338c
MD5 cea2174c57c4df3e93f82889178a7e03
SHA1 5644fd4b580825036e74e45d518cf84087312663
SHA512 e19b0ac11bffd42b91fac61bc1fc98f5494524bd77a67a3c82e03e67ba9ee266815bf07c94d87208e642c45dc8f922ea9ae737b5301a3a9bebb8199b07ef3867
SSDEEP 24576:0JIUgtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:0JIUgtJqwYB+IZY0nGMAl6I19X
TLSH
T14B65CF3BEE28ECD2C67E8DB857918640E77278704F62A3CBD165820EDE235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7c7b7e8f723f8134096647ddae160e90480a82c638feb8cec2f7d82c8cdc3d45
MD5 6e08a65cd05fac4c7a69e67d4c50cc97
SHA1 4d01d1037e9898ed8b17549115855d6b30b4e898
SHA512 0df8ef3e885465489147f4289c95ad63c4fb95f7416f5f202c27567d7653b6f4bfadc355e2644235253c51f91a173515f7583ba54169bf2691a53d2aa87ba648
SSDEEP 98304:XQvGAdlCEL8c/yRNw5CfJqwYB3ZY0nGM3o9X:AvyEYc/y3w8fvYBYM3o9
TLSH
T139266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2ceb5bd3b10eaa1fb5fc86eb4c1f933b486ebf845dfab444c048dc6cf9613994
MD5 4c44a91a5147329127e131277c0e5c89
SHA1 63c85ef13312c080c6a3973c90644dba214c558d
SHA512 242760cf8d55b526528eddc52dcd2089d5c3aea3380632e4aa1050d4cc4dd4deee3b358dd414891e66dcde25d83d028b1eb111c85d53769fc9f0dae3c4e884ef
SSDEEP 24576:CXewsAjmtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:EljmtJqwYB+IZY0nGMAl6I19X
TLSH
T1F075E031FA75D436C77F0CB12B66C716183DB9204FA11AC3E3A89E9E59702D12376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a5a3d5a44d9c0bb1fb7cf8b272e08d1302665f0c6f2b0e69e61db917b8552f2a
MD5 1e103d4f23679575dc89626559f1c044
SHA1 5333caaf778a1207a64204b6cc4b9c33195b33dc
SHA512 8301462ffc5d79684d90811b50d4b7ac4264541d489d477156c7473a66b28eab18ef6e524e8f7eecc98243823ed3f5f26d09a49c274e9be37596c6f05262f7a6
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkvYBYM3o9:hUEtQevvqc2W1cpV2EI32km5u
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 605130970d3600ded05eebb5843bdec416fc7fcf277b76afa61394c90980cc12
MD5 5f934dc1b9922aa2ea8b5eee7602c859
SHA1 6b985da0320e4b42c34db7d0a4cd249ec634b887
SHA512 438b41b7652fd6335552a6e82f407c0fcbf35a34d2476a2585d811553dedd65402ac3fa3e5f42219989c5a0b4811b908b15aec53977bea900e96195d1e023d9d
SSDEEP 49152:cCbRquA/m2yL5zLfFiV+XenmE3/zGtJqwYB+IZY0nGMAl6I19X:Voq2Vjnm7JqwYB3ZY0nGM3o9X
TLSH
T190D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e504bfa51246f2adfe3f26201b6075ce8f5593d5714dc1dd9fd3c48f89219ec
MD5 4d2a4149037f9a6efd6b4c6b1edf4293
SHA1 a55e73f826bba3c7c8623a6f97d86dff7b17adb0
SHA512 a105c618299cc7ebe77dd12a73d2c349e63f110ce4ead9e2a5f7d334827f4dc6a341f4d4d49cf8ff7e5a8cf4e069cc395374b8a2c8113b7dc2e2c80921d3392a
SSDEEP 24576:vAhGLJIFoiwtA5l7S53dtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:vAMyFoiq5ttJqwYB+IZY0nGMAl6I19X
TLSH
T1B5359D81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2150D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bfe5f126a379cc431769050c9fe3517955b32caf9ede10e8dcd7108efb6fea05
MD5 5b1f98759f1b2ca8e67aac0306e03302
SHA1 80b048f76543bfa4d38424ef20be8d7ef5dfadba
SHA512 5586231d84948777bf6b8548f0727c30da21e0d7e5914fdc63b886e9baaa5f88a62ab66e6b2239262e7687bee4b44dfdf3705b3571717c589196e5b9910306da
SSDEEP 24576:Owu+OWKtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:Ow5OBtJqwYB+IZY0nGMAl6I19X
TLSH
T11365F14972A90CF9E9678538C697C132F7B3BC052A61DB1F0760C65B6F37360AD29B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c15b749ecf18dfdab8d9d4951c71a432f1e7fd1b93a60cfdcb806d5e81f517c9
MD5 a97af33396fd30d20bb1d0447bd7c0ee
SHA1 723c354452846b568a2f2b5ef54c0c02988f982b
SHA512 a63fef25df818f542c1c0b8325887bda5e6b7c4e6c5499d0d20d7450ef76e8064a838bc7675ebaacb3f74b951bb1d1f15a58ea9420815f06330b8d83abeaeab6
SSDEEP 24576:+ZuDtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:PtJqwYB+IZY0nGMAl6I19X
TLSH
T1C055125D23A850FAE6578578E6E08542E7737C5A277283CF07044A6E6F73AD06C39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ac20ff34f3a6e4d1e49cdd1573c66ef8c30dfec8a9b4c7f098ec24a9d5c0ead3
MD5 3ba1338795850daba3474063aa821c7c
SHA1 7e66b26e4eb78a8218262ed3329b6ec32bf26cff
SHA512 436ef5d5aac1ed09a72f0cd5ac2768971e8993a4b1b924cdec573228d9c2f679764e28589001b0d8d0719389135ba146e42c08c70583ec47fee9d136f56929c5
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN3yJqwYB3ZY0nGM3o9X:DQyiKayX+PNCvYBYM3o9
TLSH
T120666C13F3A501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6b2b379d4bc99090edbe831978fd924c1a0624434009a4aac0bc865fb62b5a37
MD5 600850d17508fe7e85945fa5aa0fd2eb
SHA1 ac3170859cb17d88505c125b17996a42b025429b
SHA512 ab41f563e9ac509d9b1f894bc6430d628f615eb7f60a1e1f4da3f6459f8fef71a58f124d1b4e265339c2fc3693cf0b2971d836abe59310ceec5a26e6dfd9f2ba
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN3yJqwYB3ZY0nGM3o9X:DQyiKayX+PNCvYBYM3o9
TLSH
T188666C13F3A501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 202a456c707f7fd5dafe5be2389868c1bc9b1edb79c48b5ec56e0599e88accb7
MD5 b913bd6318568e1e8f4886f0142cf52d
SHA1 6b7a6679f36542ade141e7defa741a46c6fdd8f1
SHA512 1386f095993340c25d43ffefe5e7ce4f1aee95c1b3f2d32d2b9d3a355a07e76d3f4b0960619a2d29e5e5ce10896c7368272e864d7ff038daa2ce478bd874fe85
SSDEEP 49152:x68Qg55nhheWu7PNU3/2tJqwYB+IZY0nGMAl6I19X:vthWRc/8JqwYB3ZY0nGM3o9X
TLSH
T1EBB54933B2F60099C44DE1769F4A872196D27C758FE0E7DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d123ed977178fa031a178262b2795f116535f8428c1174e4d11547ddeb61bbc3
MD5 e14c4a3469dc97efac8784ac0818f973
SHA1 8f9126ff32f1a920c73be3ed2deabc2aeef4728f
SHA512 75cf90deba3b9b044189336c49f767ce9e1691fa882b14473c65bc16e2e090c463434582219cd1441331600d30f29cd0981c4a02ef8be0a5b8920cacc9bccf2c
SSDEEP 98304:jy5112gYy5azzVvL69nLKnhZtJqwYB3ZY0nGM3o9X:+LIHmWhTvYBYM3o9
TLSH
T160167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 279b649277e7ee4bc5a38439bdbf546790c3cc3bb0b22d0723231036dead35f2
MD5 7bfe5bb546fb24a7fdeea1b231ad3c9e
SHA1 a2c59f3b9816cbfe80a35cf2b54c0e7aea891ad1
SHA512 dd8be542d88b74b21333001db6a3316c4ff157f538045fed1d6b7feb63e354b41226cf6b9e449ff33e9f92b2e95bbba8573b8d9f810f14363806c114068ef578
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glstJqwYB+IZY0nGMAl6I19X:Wu6JmVxd2d6JqwYB3ZY0nGM3o9X
TLSH
T12FD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b979259435428c385c6c5417b98f4d9f649fa1dc60b0c8e26bddbfd646f01d30
MD5 5f4546e8617118c81490a51404acb491
SHA1 cd5c00e764319e71b4892c596fbce8e86ea75b3c
SHA512 04b200ba531a725e01a6f95bf244b28ed629e6b52305177d8798f5e0f83867828ccc2a3ae38e9e2553506911ce0b7f580ecbbf592e41005a8a58256c36bb06ed
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xAtJqwYB+IZY0nGMAl6I19X:MmifPbR7JqwYB3ZY0nGM3o9X
TLSH
T1D2B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7a552aeff162c37256161efdec4bb4c1675ec705a988206c1d33243d0b7291e5
MD5 bcb91f73a3f4f847ee64f60c6a16e158
SHA1 d4b1cc8f2d1a3b0c4393a2c72109532a7553b1e7
SHA512 86cea656047d6c675d9605a50d0765a398f24f8af6efadb0456b67060b103062233c454e91de29d8682c482a73d2ea2cf1720c6bcfca2130925df9c2e5db0323
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqDtJqwYB+IZY0nGMAl6I19X:o5dKTi61xJqwYB3ZY0nGM3o9X
TLSH
T164C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c9c06eccf3bad90f95331b99bf19ecbc84e8bb18c79144fef38368887bdfbc20
MD5 3bf5992ccefbeab76413da4f6e5ecd22
SHA1 80a0fe3967975e3a8c0b5d952808bfd1e550a8cc
SHA512 5014d28ce0811c236e67282df9245a7110adf3c554b6b71d1da47f6354c30b474c750c331749c74a58bf8cfc722b9375578a83f3e052c5d2170f44f0e887b559
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wctJqwYB+IZY0nGMAl6I19X:zX2iyph3JqwYB3ZY0nGM3o9X
TLSH
T11295BE13F2D900E8D05ED174C7468632EA72BC150B39AAEF0A50B6561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 70e6c8d0b91dd89893359c55823ca0bdd1491cb668d96e25f7631fd5ed1a9bd6
MD5 d541ccaa977c7390dfaa83a7a936b206
SHA1 c7cf37d6b798055de0cff693747ed4af74b7ee20
SHA512 4859a1b9486c63c31c7fa7c828d438d791c3fdd6d7fcc6849ed24f08de965727ebdc46f86f1797c494467a34eef6e8e0ff77d03de0b1e8c8d8e085a106daa233
SSDEEP 24576:lPtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:9tJqwYB+IZY0nGMAl6I19X
TLSH
T12345231DD21F890BDA058CB0F3C490A3AB3F7D5D5BF58BCB9B08280EA6B5AD4709554B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 916690495fa00a05b968b7f60cba5ebadf90e8fd51b03a60afd3fbe980706761
MD5 859cfccd4843ccd3dcb5e2b5740017e4
SHA1 18e7b6ad2dabd37c2e171c32e0da9adc0ed94241
SHA512 5fd8c2e535089442846baab744ec5f192b14d32b0384350f7ef1042540cd113760fad3d32334955abb9f9463bfb17e4cd585f046bdd671f9cc6a13ff041c9e8c
SSDEEP 24576:titJqjcYYTI+IZY4jxBRvc3cAl6I19G4:gtJqwYB+IZY0nGMAl6I19X
TLSH
T1E145231DD21F490BDA058CB0F3C490A3AB3F7D5D1BB58BCB9B08280EA6F5AD4709595B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f7a4190a8cd17e6986f4aa791d81d08e1fa5c3d1bf798a4838b6c7ca432b4a6d
MD5 2de72b2e5781a70794605b313d0d9d13
SHA1 8a8f3d3bd8a3f81b5979a58bb057ef5cbad64f00
SHA512 40d029bfa4b707a8fab73b467644c6e207abfc0fd0251bcb4a7168f405f40ce6926ee18d368926b7b46d3bce4c1627c9ee4b90f91eeaaa920f1980cb13ddacc4
SSDEEP 24576:lItJqjcYYTI+IZY4jxBRvc3cAl6I19G4:GtJqwYB+IZY0nGMAl6I19X
TLSH
T1EF45231CD21F490BDA054CB0F3C490A3AB3B7D5D1AF58BCB9B0D280EA6F5AD47095587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 07ddf22a01f7d847c47563442f6fac5b0b4d2b000ab3cb99ae2b656f1374a24f
MD5 92a3f04f767826386650f28cf5ee8054
SHA1 f958004e15c26ff7b8d2753b880dab06142496e2
SHA512 a4d1eaa5f590c056f582b24e3f18b6895beab768111963aa0c749d9364ea2451a060d38584a3715585f0d52c864b5d186d307cad62402e5cb700f08133fc913e
SSDEEP 12288:QV3tAuJqji1vB2Z138bTItz0IZ1po4jxBRs2163cAl6IRb17mF4:AtJqjcYYTI+IZY4jxBRvc3cAl6I19G4
TLSH
T1D645231DA36E458ADA16C8B0E2D09063E77BBC9C5B728BCF8B041C0E5EB17D4B474A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 473103352e2faa39074695711e371af6f60bc9c4bc2ad9bebf9944a426065c03
MD5 aa4cd91a89f99b95a9f36f9e8e3a7210
SHA1 1b02d283766cc832666d31c5f3bb465bfc70bb5b
SHA512 e9433ab64a8e54a692fb1c7b6fd77e6a6076bcab0b4157d3e6fe8c2bf29d94ea89b7ecfda0c27c9d2c090704639487751cff10bd997563bf7d42bcd658536116
SSDEEP 24576:wVtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:KtJqwYB+IZY0nGMAl6I19X
TLSH
T12B45231DD21F490BDA054CB0F3C490A3AB3B7D5D1AF58BCB9B0C280EA6F5AD47095997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3357c86aac608170d188b6fe18408ce2dff0934cfdf598bf93828068d7f5ad51
MD5 5675aee54e141fe467ab291f71a87105
SHA1 5a30300161c97479b97a60290012fad8d29a9b6e
SHA512 02764d7d939745994d7788ebec7019d335406f1b1ad5ff61dc35f89b1166ba5125a0bd9f20b93af3d0a8a5fb22826aff3b706704b606f6d477d8545fa7fdba5a
SSDEEP 24576:oOtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:htJqwYB+IZY0nGMAl6I19X
TLSH
T10A45231DD21F490BDA058CB0F3C490A3AB3B7D5D1AF58BCB9B08280EA6F5AD4709595B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 37684645c6985121e711a9a687d2c95e3f0279c7aecd775b1948b890ea661638
MD5 c5dab3aff840d729c0b2c7119484c8cc
SHA1 0095b888166839a2efd43167c4e5f8d61b5f8953
SHA512 3ff20c172f2fc597614936cb632bf8ba8934091507a126745dc33e2e6f1de72e40119900b3eb2dfb1137c6e49cdbfae360001e5fe85b18c17ae8bf5bd26c71c5
SSDEEP 24576:jatJqjcYYTI+IZY4jxBRvc3cAl6I19G4:2tJqwYB+IZY0nGMAl6I19X
TLSH
T1E145231DD21F490BDA054CB0F3C490A39B3F7D5D5AF58BCB9B08280EA6F5AE4709499B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9ac99008cb6ac45154865cbebe6b50845345bb4e309066bf8ee8d2fc4db06120
MD5 59cea4d491fe4712c36a052c37494994
SHA1 65c665d3fda0f37ee0c128d0c38b71492b1e6705
SHA512 d81a3585a4351ef7245cacbb3fc8f2dde4f888d1409b9cc64d5f0f896217ba533ab5862ccd02531328a766b3cea6aa0c933268faa8bbd01d2bb1cb45d2487fc8
SSDEEP 24576:dZMYzFVSOCtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:dZMYzf+tJqwYB+IZY0nGMAl6I19X
TLSH
T163650199B35408F9EC678139C9558916D6B37C590BB0CA5F03A8362B5F733E01C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dcb59a7b65e754b837b80562d58b64d22f4e8b154e7a657ad9491060beee15da
MD5 4017474d46c92168feb68c6cc2265723
SHA1 6808e5ab972bf834ba18e1bd8729d837bca8cd75
SHA512 bd30a8a4249d83672c3d1a5a868c5511d5e8fae3c20d41e72f143a4562d271c9652b64ad42f89aff733715ffa00efcb9d810c6528bad243eaebdbbb26edd18f8
SSDEEP 24576:OztJqjcYYTI+IZY4jxBRvc3cAl6I19G4:GtJqwYB+IZY0nGMAl6I19X
TLSH
T11145231DD21F490BEA054CB0F3C490A39B3F7D5D2AF58BCB8B0D280EA6B5AD4709559B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 00d63ef1653d4836f2998e5cd964b3e0003b030406cbf64edf10078ace162085
MD5 aa0a9c67b9a7ec127ff286a65468dd9b
SHA1 9a11d2aed3458c777867a6dbc786a384379aa57f
SHA512 46df101fee3c1a94736b40a3bd8da240e85d47607f45e5093451ad4e6eaef7f8a4ffbfbc15cc021761504abefd921d8f122873b266a26f40edaa15348354d493
SSDEEP 24576:pXtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:FtJqwYB+IZY0nGMAl6I19X
TLSH
T18945231DD21F490BDA054CB0F3C490A39B3F7D5D6AF68BCB9B0C280EA6B4AD4709595B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4d1c7c73984ab893c97f91e2dd95d61a05bf59a57e66c83307774b511f940451
MD5 28d6516768b3bb5aea728ee5b3f932df
SHA1 674e6a9df9801dbfc3ea37b14f2bbcafa4cc1d4f
SHA512 08f50cec38b102ea11102d3e80fa322bb9a247705068f4f0c7d133b0be0e3a64d6775950ec252479d9cbc9448ea7ef23c49a8dd5ba5ddf36be3ffc9c6cad81f4
SSDEEP 24576:/zyWtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:/htJqwYB+IZY0nGMAl6I19X
TLSH
T16A55021BB3A620F9D5268134C9911902F776BC360B708BEF5714067A2F776E0AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 10248facbb2280f8461eeb4f550f03fdd9fdf24998f4be2f167abbde9128ca1e
MD5 8de748602442a8302d513b4915cd193a
SHA1 c4b12336bd8014ae0e2c5bdd45d83a68367fd179
SHA512 2f8c7513700d71a138db9c687121dba349dbf4e511ab02b4af737052085ffb1f8939cf23d23259ff83734b6108db802c5a57e9b8c3f89d18f543c054d6b4736f
SSDEEP 24576:xztJqjcYYTI+IZY4jxBRvc3cAl6I19G4:5tJqwYB+IZY0nGMAl6I19X
TLSH
T11145231DD21F490BDA054CB0F3C490A39B3F7D5D2AF58BCB8B0D280EA6B5AD4709559B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 02f9db094e91dc1c579adb1020c837756ce17a2b60c5b8e614182047b9b4fcba
MD5 f0a69ec90d1bf71e46fcab5d7100c4e8
SHA1 94d10e2083535818428f1275aa173fe4606469de
SHA512 6a324cf26e66b4e5427bc51d0d9f49e66ac94b92dd2af93a7dc9aa4f502f04a92a9dadc129b9652993bbd68079339f07b1b1f7bfbf8c0c16aef0afcd631e7b43
SSDEEP 24576:IztJqjcYYTI+IZY4jxBRvc3cAl6I19G4:UtJqwYB+IZY0nGMAl6I19X
TLSH
T1ED45231DD21F490BDA054CB0F3C490A3AB3F7D5D2AF58BCB8B0D280EA6B5AD4709559B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8efb7690bdfdd7abe218368ca9c96dcec297addc64f21f9c068adbbc011583c3
MD5 c5926c62bb9923f492627d0f4d12bd14
SHA1 eaa5509d4eae26635130485f0d51387a1a5e51aa
SHA512 aca836677380dcb594437cc0d118540a65cab04dff24668bb7dba4085484a1075d92cf0990cc7afb25580ff29a76a04db1454aee49dd1d5b1c9d3fd635c0ddf8
SSDEEP 24576:zCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAUtJqjcYYTI+IZY4jxBRvc3c+:zCUxPTY+8Wg2lIL8lrIUJLWwVtJqwYBU
TLSH
T1AB65AE1DA3EC089AD4BB81348A518A16EB327C2E1B32D6CF1160C73D6F67AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cb3649e15d7f5d8b66acac6a2d9e21eb12bd4e2b551b7a102375b46643dd2dcb
MD5 ea0026b4a5aa44f4bd7942f434bd9eab
SHA1 e1b4781e380a507a9942beec7797dd7c8b542911
SHA512 ad2aba6585e5f15afde8cfc4ec07fc636865ed66ff0a63fc641dc530b4fb724a23342da8b98519fbdff24e78d54ef7cbdee9088cacd24b6306736072e62f2db6
SSDEEP 24576:8DtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:YtJqwYB+IZY0nGMAl6I19X
TLSH
T17255F019D29802E9C06EA174D7958642B3377C6987E1D3CB57C0F83E1F766D0ACEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 511e1df2e333c229046ed751091179a21c14a174d9a57c83b572178b81bde4cc
MD5 58cb5b40c9bd1e3b857795d48e6cc9dd
SHA1 3153f3e26411c787d3f800d2178e153725411082
SHA512 beac0303b9a5cd20d3eab7f1503359ad47529aec4b3c0ac4c5bb7076df0208be097e3a713aac01247138b5d0b3eb961d66ca7526bd203e633626bed4e8ef5ce8
SSDEEP 24576:KotJqjcYYTI+IZY4jxBRvc3cAl6I19G4:KotJqwYB+IZY0nGMAl6I19X
TLSH
T19245231DD35D890AEA2A4C70E2D9D032673FBD5C1FB1CACBDB08294EA574AD4B874607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 872d77b4643f4b19684e117656d56fb431ec4443b76c7b834899e6f6e0ca8de9
MD5 cfc264b75b92ee60eba310bcc533fca5
SHA1 c7a3571a4c5e22a64f046a3405fc942bca30d670
SHA512 b03654270f765500a92d89cdddf746fa246e4a516d6c8701335941546c4771ef67051f543cb905c0dcd6e89ae0ce6e573f943a81c92e83b9bac66db085e9b8f0
SSDEEP 49152:qRZwQCyiHiQEaaPnMbtJqwYB+IZY0nGMAl6I19X:o9xvPwJqwYB3ZY0nGM3o9X
TLSH
T16D85AF1E62DC46A5E0BAD2B8CDA74407E6B27816573197CF0250C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f3652b659f21f3a29f492820e4741607b68b5c7aca857a33b938bab01f2c16e4
MD5 3c23d7fc29c49ff6a119f94f600a2710
SHA1 3520fd00f6724e724f529c6d49fa9f13fbcf507b
SHA512 4427691445d3d0cea2c300458d2da214bad84d77b1bf0a5ae4420ed9513160a299576e3c37ba6ff1bafe732a9803b828cd55e0102e4bbfcef4dbae8ae3a93b83
SSDEEP 24576:8bxA1UGYtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:8bxA1UPtJqwYB+IZY0nGMAl6I19X
TLSH
T16F55122E92AD04A5E6769478D6D18002D732BC2A177197DF1644827E4F3BFE4AC35F83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ec9efd08c2349349f7beb7e375f153747bae5e3efb2f6ad9004bf4e1425021ac
MD5 3c93b9f881cd0bccbe1198b2a4ac50b8
SHA1 eaaeaabee1f918534d0149b36af0bf06e8c7f2a3
SHA512 eda0ddbdc96ca25fe40b1806a4b7f515820522f9e55ab58e5a6445b48e7f7e11ea5cf1cbd8140e15765157c95f19c9244cdcfeeab0fe16a0e024e689ab66c9ed
SSDEEP 24576:pjsmP0yHaqrVqHra44KDzMsrnttJqjcYYTI+IZY4jxBRvc3cAl6I19G4:pjRP0yHfVqzlAsrnttJqwYB+IZY0nGM+
TLSH
T16545AF2EF2B910B9D4AAD136454107B5BB71782D1F209BCB0170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6d4ef205da2aa1d75985da790f16044ce5037c8c75c58d8feed01e03b58c8842
MD5 33fffcc123744554fc9cccd7e8dae20c
SHA1 8dc065f70ccd0319b33a185e70c9ae1a077640e7
SHA512 2b834848105c30133e41ae03c54c40bf26a92c63179a3f92b6c6918fc358440002b7837719c9ab3a486a939af5677ee187f9a685a51a380addf55fca66e8390f
SSDEEP 24576:DutJqjcYYTI+IZY4jxBRvc3cAl6I19G4:DutJqwYB+IZY0nGMAl6I19X
TLSH
T17A45235CD21F890ADE158CB0F3C49063673B7D5C1BB64BCB9B08281E96F9AE8B0B5547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 72ea0c9d074df66d5ce1c119465f31d4d8bdc8e334825bf8c87bbe4edaab362f
MD5 2689f9b3fa965811eb5afe3b0058a6ed
SHA1 a8bc6184dde42d5e5cb8e277c973c90b52445fa5
SHA512 9d5e31ea67719915d70fddfd39a8a855970cc7cb606edf5792cf7e56b7a36109a5e47b5c598c3239d5c316685aeac7735ecd52f9eba6e2fa9598646816d9cb08
SSDEEP 24576:rzLBUTctJqjcYYTI+IZY4jxBRvc3cAl6I19G4h:rzLBUgtJqwYB+IZY0nGMAl6I19Xh
TLSH
T124750119E7A900F9E96BC13CC5A28513E372B85D0764E7DF03684A6A1F637E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4af8d7895d454626cdfeea6cbf29c0e56659eefeb234dd9fa76c2132776d8ae8
MD5 000cebcf4aa4227d782cce93cd029704
SHA1 48db7069995ac4c92feef16e282e0bea62522652
SHA512 55bddc66ae6a4d9f3e4d82861bbaea47670aea7bfdd46639dc8fb2396afa651913799b67ae4db5d9b12dc611473dab5167cc24d5440ecbcaf3a865f1449a6831
SSDEEP 24576:ppYNHRtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:ppYtRtJqwYB+IZY0nGMAl6I19X
TLSH
T1E565F12EA2AD0CE5E53B9179CAC28115F2737C66176197CF05A0827E1F17EE8BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a52a5d18f7cb385b68c7e16b856bddcd7de0ace06e8b52e6cea5991ebcc85eb
MD5 7ec2ae57adc7c04b758ca19b5a313032
SHA1 e0677ead789b4b0c6e6eb8757fc5595f14f57b65
SHA512 fd33a2ba4b825eff594e85b61e4745312533eb97b28da2e49bec01239097827ce26ab5734d38537f6d326ed4d3227461d714284954594d0582f30636e529bfea
SSDEEP 24576:xnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKQ:xnXoJJYH84VVS6AmEcJas+cHBjSSKHP
TLSH
T11865BF6DA2BC04E9D5BBD17CC5C24506F5B278651331CACF022182BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fe15b5d20d3e11c2a8102eb1bdc54a07d16f3c705e84c025e7f718c17f245d3f
MD5 617f1f213e81a67eff0378cf6c69d303
SHA1 d158a31beab949d5a02b8403d3b812c63779c2f2
SHA512 e26563979b88e198955f77e8a1e512a0a5c8bfcaeed3f2056263ffdf0bcebe4f1618f4549e8f9ad4df3bdf0f61e847ee6cee677e9e86bd028b698eae40aa1517
SSDEEP 49152:ODLL9TuJ0M/TYW2POtJqwYB+IZY0nGMAl6I19X:t/JqwYB3ZY0nGM3o9X
TLSH
T19C858C5EA3EC42D8E47BDABD85A79047FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 efade0a77985ca23c30fb4478e9f914eb1cef38c2ebec8c016a057a714cf29ce
MD5 b4288b07f24f12b3012fad18a106e3ea
SHA1 4a75dc707d1664a527f71a30d69087d831f508ff
SHA512 12b627d508a7f31138f5728679ac7b3ae4a96a990ff5a632fb4ca12deb8b67db402308a5d701357eff57841d5a0f8e2f9002c87dce18897c398b0ce2d8f63ed4
SSDEEP 24576:negJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wctJqjcYYTI+IZY4jxBRvc3cAl6I19:nngOJOmPOHhctJqwYB+IZY0nGMAl6I19
TLSH
T1A355BF3FA7BC05D5E03EC17D8A968816F6B1782603359ACF0550827E5F2BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 96aba2b46e4e2543f82abfd85fca21e0470ff2efb0f30d6ca3ccabe8e602304c
MD5 f71e0fba849a7837339f3e8ec66713bf
SHA1 c47ac69cedc65de6da02e6bd8a2482eada39b1dc
SHA512 20ec80e2ea9e6a1b2ace7a0d2531b0b3ce2628005c50f7dffc4c90c1ec66976f8bd731e0558c2505f5b193dbc6cf393b6063751af8ee5ff40fa4b9fa0b9de36d
SSDEEP 49152:ULJnJK8R304l9tJqwYB+IZY0nGMAl6I19X:FSJqwYB3ZY0nGM3o9X
TLSH
T1FC75D03CD2A910E8D477C2B4829A1656FF32387C2B216ACB5974D4353F12FE0A979F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 74df2c43502c7f60bd36393e2195bc1e9013e879d7aa5d28aeb9439ea92db05d
MD5 2efa58a38797ac764b72ea0c2312885e
SHA1 5aabac34e0ff7c44034af0b070233a34904fb992
SHA512 0c2e7e0c8200fc30aa2144d7d96b48699ba0231aa8d8b6c1e8780cab96b405b85859fb1e4c99f967b7f36de9a3aedae65f0a7cddfe59306cc0b97247fc84b05f
SSDEEP 49152:B9GqCzDScAZmlvTcFg8Ph6atJqwYB+IZY0nGMAl6I19X:dHJqwYB3ZY0nGM3o9X
TLSH
T11D955C05F7EB5298E8B3C9F1C96694169B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 040f4f42bef6981a3f5cff3f66aa98d1ef0aaf75091c8f27a0921c601d263e06
MD5 1071d3b11430ace1083707e625054a1e
SHA1 bf9be33f46fa54554fadd4b54c3e37b5a9dd814d
SHA512 2b71e2e8654f74734397a58f8772ac1635ebf76695d0709052c27dd8c7e568a127629992a4e3ca384dc0730fe79f2261466304942327deeb860ee60159455938
SSDEEP 24576:ClYJeXm5jUuEMtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:ClYJeXmRUuEMtJqwYB+IZY0nGMAl6I19
TLSH
T13A55125D72AD20E5E22E8474E2D18411E333F879176257EF4690C57E8FA7AE43D38E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 bb103f8f943b78cab3b136b73c705f3d63b6a5fa4ad7ee07771f7c846c9b12f4
MD5 0d999971acab6f5c926c8b3e6ee3c02b
SHA1 42b3c6e33de8aff89e276b7b458999e5ec9bce21
SHA512 7813c1f8124e5bf02b04b77b8d5895833fc3a4c96b0e73ebe0e9dd2515007ba4245f111fca7a8033ce3e47b96a41ed78f2952c1ef0454fe654dedf69187bdb12
SSDEEP 24576:WjtyNtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:WjtytJqwYB+IZY0nGMAl6I19X
TLSH
T13855130863994599EA794974E6E280A19F3ABC244F3087DF4640FA3F6E767D4B830F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1262c5728dea56855aed63829b0a752f93e10a25a75389806a65b51a9ca8ca30
MD5 16496f76bac8483a08376115599a9fcc
SHA1 c8e926421f1fcfe5c748cb3df97994460e674f14
SHA512 1dca57f3df8baa8e0a712153783a705ad1f33c1ab34230ebd0246f61a35453c58bc703c4fe31cb6e9e548347333e685cfd3e0ee1067b7ab2ded21b51324daa96
SSDEEP 24576:QctJqjcYYTI+IZY4jxBRvc3cAl6I19G4:QctJqwYB+IZY0nGMAl6I19X
TLSH
T18E45231C922E451ADE064CB0E2D49063673B7D7C1BB15AEF5B08A83EDBB56D0B0B1D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4dd4db44a8efff40a9b26e9b8ddb2a64381b79ef1f78d777c3b0c706efe81af4
MD5 d218c8b05130f4c232affe266d250057
SHA1 873eba97b29fd4fdae1e6c1f2630d1654317dc2c
SHA512 c1755140c00c3a4ead12cce96fcefebe0743fe64a7b26a7a5bc01faf9c9bb70f9249d98b839ce005304fa2474b2e4d97690ac2a12aa554ae75f6dc28c4b06dfc
SSDEEP 24576:HC+TyQIu93VAumZr7jmjtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:H/TfIq+YjtJqwYB+IZY0nGMAl6I19X
TLSH
T1F6558C1DA7E91DCAE276C575C9A34493EA33B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 22ec51946d190dd57a90d9dd753338d6427fee1ec39b055a7c01cbf22486d1a1
MD5 21960e25138090df6d40c545d8e46ac3
SHA1 b7a4c5a877cd61cf6fe8b2b6d9c3b478350d2a4b
SHA512 988425bae599d3e3303ba684b2acbf153eb4862d9f00ebf1c69265a4c2ad524a6aadbdb3d7621f102f1fe112f800c40ad7e52223055cadbe76fbec1f54bdd3e8
SSDEEP 24576:lLQikZwtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:JQikmtJqwYB+IZY0nGMAl6I19X
TLSH
T1B065F10EB3AE00A6E567C138C9854152F7737874472267DF4690CB7E4BA76E9BC38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 898d6acb0c63af359be4c9f181755be1edbf73a1f3faf77fcf91c821f5159bfa
MD5 94a8caeb17445f0bb9ea94b999a037f5
SHA1 3bd771ea298f3884e84823670c98721a4bbb5482
SHA512 61c63d6127658afeed3eaaacdefff944b226dcfe2685e9314a6058cdf93af7a69d30093962ebaaebbe070e2c3366839647f23daee0ecf8e5fb1de4c77409ce78
SSDEEP 49152:BpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPNtJqwYB+Ik:SpC7b4+80GTkQJqwYB3ZY0nGM3o9X
TLSH
T1C2A57C3DE2B800ADD9AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3cc435112f9bcc0d2569f45a840033069130e47fd49f3462b4e789c95332123c
MD5 995ddacd4cbeca970003373f125dafcb
SHA1 99e8610ebd253519b56d996ec72315de3c97a672
SHA512 95e2e95671f838a27fd78007d8adf2f01fa6c7e4b294ccb4f13f2302c067f1e1c99bf11718c18729569c183c5ed4aab2d89bf0d499587bbe06d36f314ca4c30f
SSDEEP 24576:MSAwJPE1IDAo+4Kt+l44135UQ1tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:MqPCIo4Kol4/Q1tJqwYB+IZY0nGMAl6u
TLSH
T1F755B02AA7F946E5E17ACBB4D663C511FB737822133163CF4290813E0E16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 d1f6408cdb471b7f8f5ab88129dd00b1858b1b4d97fced3906a9b0380436a8f9
MD5 b0bcb223888d664bf8b432e483034dcf
SHA1 9ce8c624347fd4da0745533c31b5a7bde7629d19
SHA512 7cebdd2a5ccb9a4208f45274046bbec26f29f527ec3807f0668357ae96955c5bf6c1ad0e6e41ff4582c44016c9a00d9fd89f62acf49969206ff771fc938d1d2e
SSDEEP 24576:YyLXPLcK94tltJqjcYYTI+IZY4jxBRvc3cAl6I19G4:Yy7Po9tltJqwYB+IZY0nGMAl6I19X
TLSH
T11975E03ED66D08E5E47AC17CD2A38506F6723CAD037166CB0994947A1F6BFE4A939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 5e462bf124a369a98313719281c09b70d907e06703c27fab047e427d02d1f63a
MD5 bca6581e2e4451112a67114339387d17
SHA1 760f10f38c46477d8062503366d03d55be7ef4a6
SHA512 080738536d037212b4fb050243d48a9550d75fe25677abfd8a899effc0334a6e3d3f7783e4892e369f08ea3c0f825c8a2decdbac9fd161fc951b55a97cf5643e
SSDEEP 24576:yWv8qjpAtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:yWv8dtJqwYB+IZY0nGMAl6I19X
TLSH
T1DA65221D93A85499E5394570E2A180229273BC7A17B49BEF76C8D87F4B35BC0E43EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-363-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/564-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/564-85-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/564-82-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1252-127-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/1260-179-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1292-9-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/1292-0-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/1292-71-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/1292-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/1364-176-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/1656-161-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1656-180-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1656-167-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1656-216-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1656-182-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1656-198-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1656-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1744-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1744-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1744-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1744-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1744-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1792-409-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-407-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-406-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-371-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-372-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-373-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-374-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-376-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-375-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-377-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-378-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-386-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-385-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-384-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-383-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-381-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-382-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-380-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-379-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-387-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-388-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-389-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-391-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-392-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-390-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-393-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-402-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-401-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-400-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-399-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-398-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-397-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-396-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-395-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-394-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-403-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-404-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-405-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/1792-408-0x0000023AD6700000-0x0000023AD6710000-memory.dmp

Download

memory/2008-17-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2008-26-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2008-25-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/2076-72-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/2144-133-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2144-139-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2144-175-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/2360-364-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2360-93-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2360-124-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2360-87-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2568-177-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2568-367-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2664-178-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2676-125-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3092-149-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/3092-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3168-365-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3168-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3168-122-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3168-116-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3640-307-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3640-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3640-34-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3640-40-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3656-100-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/3656-105-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/3656-145-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/3996-126-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3996-366-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4040-13-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4040-143-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4404-52-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4404-348-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4404-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4404-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4932-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4932-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5092-181-0x0000000140000000-0x0000000140147000-memory.dmp

Download