13abf04347c30feef7a45e455a40f4cbfad5d313081d6bc949d69f11655203ce

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260420-rcfnhsgt21
SHA256 13abf04347c30feef7a45e455a40f4cbfad5d313081d6bc949d69f11655203ce
MD5 6659fc1c2391685d7eda6d6ce2e3abb7
SHA1 3bee4aebac338c60221d9dc4fe393e722ab55e5d
SHA512 5b173b7f70acd72da2603d140efc7e621de4ce23b804264ab61db34298ac9409f092592061e49f66f0ecececb72a8970e44db9b6dc28fce0a10ad52d9ee127c3
SSDEEP 49152:Cgh8jK3xEPK3Hkcm4L8A5ilefJJnB58MlSKl2HJpcR8OScKGCzLhK:CMYTKXkcmgfJiQ2O9C3hK
TLSH
T1B2E58D6D7AED00D6C175E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5892	alg.exe
5516	DiagnosticsHub.StandardCollector.Service.exe
2708	fxssvc.exe
1500	elevation_service.exe
676	elevation_service.exe
2696	maintenanceservice.exe
4612	msdtc.exe
1788	OSE.EXE
400	PerceptionSimulationService.exe
3560	perfhost.exe
5324	locator.exe
6012	SensorDataService.exe
4164	snmptrap.exe
576	spectrum.exe
1732	ssh-agent.exe
4800	TieringEngineService.exe
3324	AgentService.exe
1448	vds.exe
2448	vssvc.exe
5444	wbengine.exe
2940	WmiApSrv.exe
3348	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4a42cb5c8b62accd.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fefe97aced0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000045fe07aced0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000363aba7aced0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e28e57aced0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	2708	fxssvc.exe
Token: SeRestorePrivilege	4800	TieringEngineService.exe
Token: SeManageVolumePrivilege	4800	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3324	AgentService.exe
Token: SeBackupPrivilege	2448	vssvc.exe
Token: SeRestorePrivilege	2448	vssvc.exe
Token: SeAuditPrivilege	2448	vssvc.exe
Token: SeBackupPrivilege	5444	wbengine.exe
Token: SeRestorePrivilege	5444	wbengine.exe
Token: SeSecurityPrivilege	5444	wbengine.exe
Token: 33	3348	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3348	SearchIndexer.exe
Token: SeDebugPrivilege	4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4944	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5892	alg.exe
Token: SeDebugPrivilege	5892	alg.exe
Token: SeDebugPrivilege	5892	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 5284	3348	SearchIndexer.exe	104
PID 3348 wrote to memory of 3724	3348	SearchIndexer.exe	105
PID 3348 wrote to memory of 5596	3348	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4876

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2696

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3560

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5284
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2864 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 655a3e09486e5ef296a71ff851ac2b638225dcf3c203a753939a03f2a10cdb34
MD5 9693952c4261d9c98105b7fbf4e82a12
SHA1 8b8c3519290ff0d37c231516aaa8bf6a3201da5b
SHA512 0da419032b4a23b9d663450d0051d7fc10ef72c1690841a3e69c263ba11b11ebd04d536a44800fda5fa34081a79567a35302ac4a54980c6c8d278d8a5d36f289
SSDEEP 49152:Fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntR8OScKGCzLhK:b3q6sjBi2O9C3hK
TLSH
T1F7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d54f3248f085a02c60700e154756e3acc854f01fdef06ce38536a2ed4fa4bcbe
MD5 efe39733500fb4212573601485dc8d0b
SHA1 eb75db40b9d2b25585b767b31d1307b4b43abb12
SHA512 5b4be412c3072927ef1aa735ee12317c929009cc3b309d66582faf7738b8e8e193d2c53ecc27a80ecbd247bd0780f1ce24bf30b8c49a0be34a5cfc5092cc4ec3
SSDEEP 24576:HXYfDtczA+zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:Stc7R8OScKGCzLhK
TLSH
T14F65022973E409F9ED67823DC8A18512E77378554360E78F03A8A9790F336D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0ea2980c3ed1960f532cc7f44b3df5f6436708cb9197f2498da4eecbc22af956
MD5 f093afc48db2217c6bb1aecd292a04a2
SHA1 c3fc8e2d981822d1ac384e6200f1b3772970ba8b
SHA512 d1205e744256859433fbdd2166637a245a4166c13146cebc60c99af49d176ff03ccd8fe50d5ac07dafc99eee5896b5c6c54bb48a534e3df348bc3c01e03805cf
SSDEEP 24576:b0Le5ji0hmxxrMFzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:bPji0AjgR8OScKGCzLhK
TLSH
T16B85AE16F6748331D073C0B9C5D2A69EEA71308657308ACB4286D77C6F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 da4e09775b714e4623b9b47f1f3677dd3c4d6021ef2ed3e5f5b9420f85a7d7d6
MD5 483a7fcce5aa60af81668c6e19137a52
SHA1 a088d6987c5cbd3bdaf847a9d671fa72a846f4dc
SHA512 920b4ad4d1e7f0a13bfb23c8a559578b8be0ca6859144843e02c3645001820203aa6718262c2805e534859d75251e17af7f9cf8730526b42601b98214b45cb82
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyurzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:w/ezSC6vUzPveHjyMR8OScKGCzLhK
TLSH
T14D755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7737fbafa561e3b7173091aeaed52de6de081486863bacd6f9c0ad08a77b4392
MD5 c127163f359f8ec852dbc7e9418bd0f4
SHA1 8dfda6c5f171863019776ecfa4ab80bd5624232e
SHA512 872c69ab54f97878e95950b7f25552b74f0206052798cd4082a7743d091562696d80452e4293ee40100129aea8d1802cc56b6f87f5900aefa35087921d3c07ba
SSDEEP 24576:xVbqPb88hv/l+YSzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:xVO88hXl+zR8OScKGCzLhK
TLSH
T12E55AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2F67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fc2036d3608d70e410422c51e2e92dcde64719d42748118fc1a6e95be8c56f8f
MD5 724ac9f4ed7903077d64afa2f543f044
SHA1 3e72f143d9e436c401765d462061dcd4cbfe97d3
SHA512 72cb8dc7cb8147a87dc85e1857c43b4c6e9ab7050ec0874e1d017f75d8f43d85701a6c27937b61ecff0dd64691539b1845abccdae7823ed70b8fdbb92c2589e1
SSDEEP 24576:vLpzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:FR8OScKGCzLhK
TLSH
T1EF45230BB1B886E3EF56863A11FC41F66245BDBD9080434D923CB6FE873D8D9D55A382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 052249e3256d743ca7ae84da7e24f225c5fd3e9b80268f6838d928c40956cc87
MD5 b7b4f0969fe59c1baa3da9df22032bbb
SHA1 579444f1081f60056032edcb42e99ce601b1b90c
SHA512 5f93d746a109dde77c4ac3344128bd16897253edf34a5bc890edd0685c7ead20dbfb69fa9c2dfd8b51cbc0fea2d75b24b6d83c7cd0c066c3b5340d7110b01660
SSDEEP 24576:NJIUqzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:NJIUqR8OScKGCzLhK
TLSH
T11A65CF3BEE38FCE2C27A8D7956918240E77278304B51A3CBD174924ECE235E05E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fc93fbb81e09a29be36597d1a2b3a287dfb7ef24a6e3819b7b2c26f7ff980f35
MD5 276ce2c49d51740ff765891120a79f22
SHA1 6c4c689929fa1e15da4b0b045d137caa54b39e01
SHA512 3a8fa234af7ac5e727086cc9ae946cba58ed67abee8b1ebd868fc23062b94bead68a0fa8c36d5e9f53aa68504026a160aa1e3c6f3faba658d5ee5cd10ad76e86
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THW:4QvGAdlCEL8c/DRNw5Cb2O9C3hK
TLSH
T178266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 44001adf75ece5ed862736270e4af90b691f50e2f56f1d091d14744e5b3d9755
MD5 926bc9865b26d5860cf95be79f6130c9
SHA1 ca7739c460fd5d8fa5d9a5907872955bd32810c4
SHA512 2d16c5212e69ce77e8c9efa67bbc11fef5b010f6bb4e04e831e9f604f4445e0570d21972af3afb9d27e422559f96b4ebac4cc5f9b38b6e4a5b5d3411798fa1c8
SSDEEP 24576:k0ewsAjQzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:5ljQR8OScKGCzLhK
TLSH
T11C75E031FA74E036C77B0DB61B76C716142CB9204B511AC3E3ACAE9E5A342D26376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 32799eaf0201795150ff499260a10da03089f496759216b5654bc7a42fd48492
MD5 0adb9d3269352b8158658ee3404807c6
SHA1 308374586fa86b4005a9e2bed86eace666be2ed5
SHA512 acd191882b3dbb84128ac689201d4563f45744c31faceca7fc8a1513bc974abe752d37df727e4b98db47cd109a4d3a9abfe6ce499b65f8b68b261a3e6ef2fe9f
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHNkC3h:5UEtQevvqc2W1cpV2tI32Nksh
TLSH
T160474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8cb51fb096c87669f60053bc9772466c3e3c9aeb18ba6a5229592149e9f5a1df
MD5 28c89cd4cbca24095f41c177d3e1eac4
SHA1 ac3953968f8375a02118516ef9cb6097554cb1bb
SHA512 cccd342f1e7865658c8f972a620d8d1f1346fd639a6a24715d06e8ee6dfbb87b537c33bb65b0375abdcb7f86225cc37ef417b8d0ef3741276638bc6f7b0bb9a5
SSDEEP 49152:XCbRquA/m2yL5zifFiV+XenmE3/zwR8OScKGCzLhK:AoqHVjnmn2O9C3hK
TLSH
T16CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4565803bcb67ae9cd4347cee66ac22204711ef6f1d729216d7baab7e1b14653e
MD5 0c5a59d60c6dcf03523541432f5e1e09
SHA1 ac4dceff4340582298bb97162ac040836423b348
SHA512 badaec125dc6750b74c9fce24d20965cc8bf0f4a4bb4034d6f5b5787f9eebc39c78fb47f4a2b41effcfc8c52dead6cc23f1b1489b19d4a24e579f0b37b5bf408
SSDEEP 24576:EAhGL3IFoiwtA5l7S53HzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:EAMUFoiq5XR8OScKGCzLhK
TLSH
T12C359D81E7F955D4F5B3AA7859B68171EA76BCAA5E31C20F2160D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dcf2c97a467b04e82cec3f2c4a601e2e36092398c9b3996ab6d2ea38aff35d46
MD5 585f9bb8a6cb282590a6d9bc2cdcc54d
SHA1 f39328d0a28f4ae38c07c278572b8b750062d050
SHA512 6001e5824ff8e09cc09ff8a52c8f062d5f4d8b1040bc20f72ac900070ca89ade43c1667f0a08ba83ff11a22dd09119bbc3d1e9102159dae7b9e6da0832a267cc
SSDEEP 24576:Twu4OWszO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:TwvODR8OScKGCzLhK
TLSH
T12E65F14A72E40CFAE96782398597C136F7F2BC162621C71F1364C66B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cc46d43d40b065f363f94223ee0ddfee9db2ccbdc8d31bec2c640d3903186696
MD5 e689e0a56c89be9e958a9ff4a4937021
SHA1 15f40da13333802e64365611d15c4f81ec7d4308
SHA512 8abec9ac305c98d06d78dbea371dd34c969913009fee25aa3a2a2ea9be8b8b8afdea05d5bbd865293ec43705ea838da2616be202e7bff8c29e2a2ba2e41b9bc6
SSDEEP 24576:OZudzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:RR8OScKGCzLhK
TLSH
T1D755124B32F461F6E663823D85F44695E372786A533143CF122872AA1F37ED59D3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 22e71b3bdbe8bdb0bc69ed1af00dc37cbc7f3f32719a28fbd561c2ea8aabc5ac
MD5 e5a9b3928ace8251fe30e89127f0cbe9
SHA1 9aa748e80d51254dc81e6580cf936625ca27ebeb
SHA512 79964cec936e13e36329cc81ba765acf93698a1f19dba4cdd35fc7518898dcacecb46e3a419d4d877843feafff4b848013df158df84b1f842290134cd6dc3c4f
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3W2O9C3hK:oQyiKa/X+PNLkC3h
TLSH
T17E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d55c77f3e0de37cdd07e020eede2638488257fa91f49b04eeca88107f9312743
MD5 591a6c290f90bb80efa89e7fc5cacae5
SHA1 758de90081cae8fec820f5938c80d863c2cca9ca
SHA512 b14c8fb4945e2827c4760855981b61f50c7374baf3a0a60c6d5237302a8aebc02541ea8f8b4949d93aa73db2c64de098b1b2d46594a1da0119e04f27e6271244
SSDEEP 98304:zQRQyi36YOcPbLvw2gAf+PN3W2O9C3hK:iQyiKa/X+PNLkC3h
TLSH
T1F6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 40c4c1efee5d00f32b1f8a0d1a7916608ac731fb127048764a59b4e7707aa89c
MD5 c8573ca6e03fbc9586924436d2c3c701
SHA1 8027cb6644d0b1a8c1cb53514cab33f92edd2d13
SHA512 907fdccd8a2ef83cfa2376db8004ce348c257e83b3fb507ecbc70d44028f5ae857ca7c176f98d6993e134e535d7b598331f99f1ea06e352deb80b6bef81d471d
SSDEEP 49152:P68Qg55nhceWu7PNU3/gR8OScKGCzLhK:JthLRc/g2O9C3hK
TLSH
T1B0B55A33B2F600A9C44DD1769F4A873196D27C758FE0E3DB8115721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d797cb2b0a129beadb942fabbe77efa9cf10da254f75ccef807d2d1fcd3c39b4
MD5 b901372a70e84a44675ae231755967d7
SHA1 be00646ba40265bb8b75ce93f2368ca751d93de7
SHA512 7f90a968ac1cfd8d421420eb0818da2d5fdf727b27eb060cd66cf0b75fc2bd734897c36a3eed68af29517ea72211b154651b2e14863b35f62bc2edcc72b41e48
SSDEEP 98304:Ly5112gYy5azzVvt69nLKnhZp2O9C3hK:mLIHEWhukC3h
TLSH
T138168B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 899bdf3e2a075676d711f2d3b1bb3cebe25b42c79248bfdd113813916a30edca
MD5 fbaee951986d41acf527a28e746a369c
SHA1 329a3000d7fe9fd4acbfcc2a5c35d079434e9714
SHA512 ed6529ae984032c671e9406fe3f85936bdff77da8d7a750c53c129210f452064206238c0aa2ece1631c19772c1b138681cc29a0ef5ae1915bde5b7ec04db6fd7
SSDEEP 49152:KB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glOR8OScKGCzLhK:Yu6Jmdxd2dO2O9C3hK
TLSH
T169D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 412e0e5b4bf294a07aab6248dbb7d2ea4a2c654cbeb2687f92f67290c6e13fb9
MD5 0a9735a738a789dfba9179313b45692d
SHA1 da601ebf2c78ed76114ba9c6d2dcf3c015a2fa7b
SHA512 0bfeff02b6b1265d2b8183d43ffa38c50481e7963b8e18d2fb4d2a1ef6db456a832df020c0f7ce20be32238a86f42d6fa47db695dc6d2c2239cd82a5cb394b09
SSDEEP 49152:01hpsNoJpF1A63U44CwH7R4xKR8OScKGCzLhK:0mifPWRn2O9C3hK
TLSH
T17FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6079b18fe6d0cf45ea53e19eac234ba0fc0ae708b0e2aa9c61f06aafd3519c3f
MD5 709299a94d7680b7b164241e0de017ee
SHA1 c66e213f5cdc0c38b42b1fe578c2e2093aa4062d
SHA512 e2fab200a3c6a6eb719d9679b675907069f9982cc9074c000fc987b1a313ab6ad15f78209cab82ca5ca91254552583bcc6baaec935a8895b4d34b9b69923e684
SSDEEP 49152:cSuZQIY0Be2KcRVtOnks6NMHqdR8OScKGCzLhK:e5dKii61d2O9C3hK
TLSH
T13FC5BF03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a5bc53e75bb8bfe2c02907946bbfceb8b2f2cdc7308fd767f2c0cfbb4c039c7b
MD5 3408b6db500e1f5a1e239698324996a4
SHA1 d90474d9f0752c500465659258183301e9613dd2
SHA512 8bcf4ac27109768ae302c9cd33eb1a9fcfaffe5f1a5d118ff237720f6d72609fc3683d7588a622168672637e7c0eb4439d1e203efc43b73ae6ee91464745e548
SSDEEP 49152:3htSn8EApI0fig3giDn0AP5w+R8OScKGCzLhK:mX2imphj2O9C3hK
TLSH
T1F395BE13F2D901E8D05EC178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b2f6ade1c37136d5a75e9cec7d313bd041a2bb21dd150516fa2fdbebf1e7e464
MD5 cc3842d49cd1f4cf21bcfe2cbddbf21f
SHA1 a7d76a3133b4a484c8f354a9f8e31edc0621454c
SHA512 66db1b9f5b6d4c7ca77c52ba8865b8ea931e19c2e343eda642a2c4be29bc863006bfe9d5bfa8f477d552db18dd0454932fd13d1cfe8ec889c0218af9eea3287e
SSDEEP 24576:RhzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:jR8OScKGCzLhK
TLSH
T16A45230FB0F887E7EA01833A01F841F6A2497DBEA051435EB32C75BA8739DD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9388f0090ccd68d056f079d44ebf22713a5d7f7ac18d5e181a91463a1621a920
MD5 83cffa87b6757276bf9f430aca816c8b
SHA1 d0d049db432771c516b83ed32cdae60238457ceb
SHA512 4e8aeb08f5f08b90cfdc3eec1d2009db70f9e5203398292e6e1fa4ec2e50483173c6050abf3858a61968eac65365ae5d28904f140536024e57c187c8b93c222f
SSDEEP 24576:VUzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:SR8OScKGCzLhK
TLSH
T1FF45230FB0B887E7EA01823A11F841F6A2487D7FA051435EB32CB5FA8739DD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a1a3d2e8069c51bade57bd3419c65d17784e199f8850ffb9d856c6075ce0cf6a
MD5 14c0462b5c2066cb38ee05903efb2607
SHA1 dad502f799c2969346f0e5d739c7c8b935d1abc0
SHA512 fa0c61a0ff7ffd111cd2747516d854496cd5a163f9863495edd60c089076a77f635ce6d698fe9de4e0764d48d74808f66c9bef562d08917378e52aca3678383f
SSDEEP 24576:iizO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:1R8OScKGCzLhK
TLSH
T17B45230FB0B887D7EA01823A01F941F6A24879BFA041435EB32DB5FA8739DD9D55A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 453e192864facbc3ef9c6b3b59c350a274edb5a71668097f840bb261ae575e07
MD5 cf822f8b6844ad3465c42d45693fbe3d
SHA1 275faaddd5f48a8bf4b49e7808813b6d56bdfa56
SHA512 a9052460690d7b88aaacf508aca442408f8bbca8bd5f1d2c80ae0e09e66dcf023848130e5844cd136ffa7fa320384381c014902d095c8b383e31efb051743a9a
SSDEEP 12288:XVZ5zOQ5IvbFljqpayXyZQuX/9KB0GyR3sKf6FCv7yqXh1v0XOU6Gs:BzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G
TLSH
T1A345230B71B846D3E912C23941F941F6E3A5BCBEA021439FA31875EE4F35AD4D939781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 814497335da5f2e8ac9d6a0cf2fe8367ca7675affafebc166d666a62c7a23005
MD5 7bd4f1a3626740d2aadec08d25988bc7
SHA1 c93e0389c531b4419da5a28e1943f36928e11f30
SHA512 446632355c4e623ed44c3f0c6272de58d6231c52436190fbf21620d50a2370195d826f7182ebd4d500d15285c49a7a03e38a3b725269d71d9fc9a32000d7028b
SSDEEP 24576:sPzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:gR8OScKGCzLhK
TLSH
T1A745230FB0B887D7EA01823A01F941F6A24979BFA041434EB32D75FA8739DD9D55A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ed47b0de46143c062c7a3f86c41dc495980590eb839fa7c9708a5fe71e20b584
MD5 584d876f471feef2419a0730c69e1361
SHA1 befdb0c1e099e7b28198b6507d058aec0f605027
SHA512 68c3bdd7f898a79ee84ca2e5f4199f049e3bcf220e62687d63c9d9690e3910e5fc03f7f96ec6932be1ddea4befd774328621979ab7723da0c2349e6309af9936
SSDEEP 24576:3IzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:4R8OScKGCzLhK
TLSH
T1BA45230FB0B887E7EA01823A01F841F6A2497DBFA051435E732C75FA8739DE9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ab872507cef97c78662a44df47947d9592b7eb366a763b1cd91bb0a55dd625b9
MD5 de7cc90b2507322d60fd6841e39ffec7
SHA1 bb4881c128062b7a5271f93dc43a2b0b7c38440f
SHA512 cc65516077252df233f698c7c80076035dc99b1ae45c1c1df2eeb3994d5a3b540e7fed02aef6b796fc10e497087b501c3a7473e24f634d9fad430d069bde5b14
SSDEEP 24576:C8zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:PR8OScKGCzLhK
TLSH
T1C445230FB0B887D7EA01823A01F841F5A2497DBFA051434EB32CB5FA8739CE9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e9ab7781cd6a8d340e975cfd809cb8c6cf7c097cb1d89d924ad60dd812cdc032
MD5 f8b419390a41131b319b1afc7b5fc7ff
SHA1 45b0c17d29eaa1157749c76c1868d0f912cc15f9
SHA512 abd8366a4fd765b17bb3e8882524cb028737cb17e2646e8545d5729e04990131a2a009de063c3f8ce34413364f1ebaa0032dc36629be5041cf7ece82ef102c25
SSDEEP 24576:SZMRzFVSO0zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:SZMRzf4R8OScKGCzLhK
TLSH
T12A650295B3A008F5EC63823E89658956D2B27C6A0670C71F13B8366B5F333E15C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2e39262f2106d24278c2469c195f655fedbc976dbaca6b4c3b92eeb72a7bc8fe
MD5 569baa26f16e18ea3d5385f6ec7f042b
SHA1 8ca9f184d43f93e372bdbb2df8afa3c76611ff64
SHA512 634e83be99d7d6b129e485559a0cd5d6e7f9b0d7687af0c2cffc0bd87896575ae6bfd694cf4aeecd64be949fde98d1a2f6876a5f182c3aa5da51b57bf9e7cd7f
SSDEEP 24576:uNzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:QR8OScKGCzLhK
TLSH
T17D45230FB0B887E7EA01823A11F941F6A2487DBFA051434EB32D75FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4f46f1e6628934be7b093818f152813914b8913a54fd17500d2af2e9a9bf3dbb
MD5 fa53fb2274546ab6e51923a1429f0744
SHA1 27f22d98b7eefcf92d5e4ae1296e462476d780fd
SHA512 16b877dce6ef7c69a2584c5540f8ed3141c1c50b7e713e2cb8855b1f7edcbf6331109477ddf7808216decdd9ed0f98cdb8f324714369248422b792b445c8fae4
SSDEEP 24576:WZzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:YR8OScKGCzLhK
TLSH
T1EF45230FB0B887E7EA01823A01F841F6A2487DBFA051434EB32D75FA9739DD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f592bd23c6d33e1b6111d9589e40947cdd3913d8d9076701341cf4c13e727318
MD5 b4afbd978f9136fc3bb1e3fd63be3c2d
SHA1 3c74bf0df4212a0b0468e0c13a7b977827156278
SHA512 2f571a49845168cbcbf889154791e468503a65d0827aac07fa99c6600041659375ec595a811244809793590223fd2f80ec980f7cd3254a0c1b3546f7c01c1722
SSDEEP 24576:2zyAzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:2jR8OScKGCzLhK
TLSH
T19455120B72B431FAD527823984A50A52F375783A47208B9F536867BA1F376D0DE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 40176c3dd77aa0136d8218b0aed84486e05cc559a876beb53ec7aab099c9cfb8
MD5 f641f2f77cdb659d6402227d626ce008
SHA1 4d600975503680025af0533dc4d5e3be3c705705
SHA512 21fb9a2aa55efa13e967687ed4a8f636137805291f56bbfb3036c9ae187752fb23fed2aaa94e84a5210c80e23dc2eacfeae5f617244babd677dcc20d066734fe
SSDEEP 24576:tNzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:PR8OScKGCzLhK
TLSH
T16045230FB0B887E7EA01823A11F941F6A2487DBFA051434EB32D75FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 29d2cfac47e6c37a02ac1dba86a1e6fa6ab1acbf141622ba14c0d68cbc7ea869
MD5 9768d6d80a2c35ca49b27caac695badb
SHA1 4084b5d24a4d125cba9985274869f5fee5ad1569
SHA512 b55cdc56e5d0d95596f89669809cef996433e9c779bcc17eed47e4b660d23b19e7935e27c54ef339214291d29209ef4b60ab7019109c4d7cb73599e788dedbba
SSDEEP 24576:sCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAmzO2IfjbyXyZTcB0GyDfrvuh:sCUZPTY+8Wg2lIL8lrIUJLWwPR8OScKQ
TLSH
T16965BE1EA3EC0896D4BB813589518A16FB32782E1B22D6CF2160C37D6F27ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c255715616ad0cbb5f281d6f742e5231df60824c7593bba27e306a4af4627886
MD5 a9891f030fe4d5da4b4134a8669db0f4
SHA1 c63cf2f33c89dd12d4840f1787609b99c4554125
SHA512 796268edd57032507071e81e7f0fa92b28633ebf0c1d377cac46eb9b80a5e05bd199184973eede9fa3b3373dd543b1ef864f70e3ee9091674a40e8fe49ea8648
SSDEEP 24576:jdzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:ZR8OScKGCzLhK
TLSH
T18055F10AE2A842E9C06E9239C7954691B3237C6983E1D3CB53D4F57E0F366D09DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b0728ce2a833b1350dc946b38bc31dc65635fe1d199e45c99b6c6795b436bbd6
MD5 18464dda0b61d53439d6b98953e902c7
SHA1 6eafbbc0f6fab5b843f072c3fc12f68321a38440
SHA512 2c97c8cc468f6e3730b34f10d1505b10bfa1e351d4559e435a7c52a38c985a7231218e09ccad9a79cae8a179a4e578c249429b63f5e3a90505d3b43aae52d853
SSDEEP 24576:vCzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:vCR8OScKGCzLhK
TLSH
T18945230BB1BC8BD7E966833901FD81B5620DB97D924082CBB21C72EA8739CD5DD79346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1adbb188ce5166486ab185f5c8c1c8446316574bde2cf73c21595dd3e4fa9436
MD5 e7d40f076268abebc736b3739ef3e065
SHA1 6fb7cc6d1ce811f7ecf3ece396ef7e73b78214a7
SHA512 59aab2e9b0d58cfaa5c1efd4859600a1f09f0fcd2f35f63cfdfed889bb74464b4d19045b5dd276d6f0f07443b916c744556bae4df4464b184680c64d6dd9db4f
SSDEEP 24576:Y8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCwzO2IfjbyXyZTcB0GyDfrvuQh1v0dv:JRZwQCyiHiQEaiPnMlR8OScKGCzLhK
TLSH
T10A85B01E62DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 fa2e865899968a0a7c650220498031378dc274c26a5fd43c90dcbf7c0824916a
MD5 e0d70124d9722ea66f10dd89c62c729a
SHA1 ee8a8c5443d6766e97ae995759e141052a80919a
SHA512 6d5d763885d69abd603810e8c39da3a027443066dbf078d011ba2f17e158475cb86946ecfd5549a25fbfc48f4a19e907c7c6ce846eb082a53efbdb490262bb04
SSDEEP 24576:ebxA1UGyzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:ebxA1UhR8OScKGCzLhK
TLSH
T14A55122F61EC15E2F576C23D45E58146D331782A532193DF2198A2BE0F3BEE89D36B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6a07f73b8aaddf5a9920e6c9117f05a435f38ff47a4042f4b2e460248f62c9c1
MD5 fdbc2495468b80525102a63edd3567da
SHA1 f6c3b2fbf5173d2e04860b21c8984e4007a560cc
SHA512 7cd7b63484cf7ecfdacc62f86c0a68f1a41d53a228551f0ed9330d7becc8274882176347b2ab54a45e6a47e03e70ce2b85d2a31dc5d4408dbe317fadb6d1e5e4
SSDEEP 24576:AjsmP0yHaqrVqHra44KDzMsrnXzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:AjRP0yHfVqzlAsrnXR8OScKGCzLhK
TLSH
T1E945AF2EF2B910F9D4AAC136454507B5BB71B42D1F209ACB0170C635AF0AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c7729621dc0b510af443b7bb7bed509fca3a54ca9871c64e7cef76bb2f8245ad
MD5 486438481c7936fc656fb08fbd8d68d0
SHA1 0ed5cb98c75d0806158f88c17e393e91ece1c1da
SHA512 58516896a445f85e98ef3eb7a5efabd5a9741f45be044cfcc3b9e81223e7da865176e91b656743ba837ffc085258555ea2640c99743a731acd862f0aebab27cd
SSDEEP 24576:6ozO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:6oR8OScKGCzLhK
TLSH
T18145230FB0B887D7EA12863A01E841F66248797D515143CF722CB5FA873DDEAD57A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 9f5897269d8b44cf721d70e3b13e6f2caaa1a60a7ef8a45516750a42f62a2baa
MD5 e99acb2da0392bc1853ff2489085f9fd
SHA1 eeca2f4aba574af037b1d8bf9f3984899bc53a27
SHA512 bdd6a200b3cfa910cee8634ba47833d0aa0e191895cc6caf148705a21de18549135b6567b63ba3fc976da712867a0152117a8da280512892dc3dc851b3e23be2
SSDEEP 24576:pbLBUT+zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:pbLBUqR8OScKGCzLhK
TLSH
T16F75F159F6A400F9E967C13C85B68626E272B86D0360E7DF036C5B691F237E58E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3fb11ee16c6ba4cce83bd92ca43ae11ad6c805aa1488dbcb90014c7980c6d6e0
MD5 ba50a2fed24e3d6783a7bc5f11d976e1
SHA1 5b3e8f34d2e8f17bc3045a82e5542b52b11f1717
SHA512 62b21ab5a4b828572b102cab8a1f29ebee0e7f6f93a0dc828b69bc1a98399b8d5641817a0d6248df54b6fc5186930f1304a953cb909b98941e0d80f0dfdf4058
SSDEEP 24576:GpYNHTzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:GpYtTR8OScKGCzLhK
TLSH
T1F965F11F62AC0DE5E53B917D8AC28259F2727866131193CF01B492BE0F17EE9BD3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2622ecba406e29e728ec23dae94cb260377480ea1e60bd0e8d7cf34fc056af53
MD5 152ee31fde1d3aabc393f54631da967f
SHA1 215f760880221813d492d13ebb02ae65dfcfbc85
SHA512 3e5a94df6aead8bc789e0b03ed12895a36c597391e28b17f0678b3805af778fa79f2e173bdcff347835d3394e3b99835e7b1a783dc564f149d2cfbda369c21a6
SSDEEP 24576:WnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKM:WnXoJJYH84VVS6AmEOJas+cHBjSSKHPc
TLSH
T1F165BF5EA2BC04E9D5BBC17DC5C24506F5B278661331C6CF022182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b0a8dda2a67586c5a067615e143874d638e74b49a0014327b904ef37ebf7f50d
MD5 8bfd436a4657cfcd2b3213c8dad06b0a
SHA1 69fc04005f0cd9ccb40b03702ba09e4176e82d4d
SHA512 fdd2f9f7d9482c7edda799dc037a20ed95a432b91bc5749ce70bacb3a235ac9fe9f9a08d2294db8dc2d4b8ac8a0cd51715243fdeff043c1eb5090eebe55fd983
SSDEEP 24576:Xv7Xbxd9Tuycf8M/TYlSuxrr2PCJzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:XDLL9TuJ0M/TYj2PIR8OScKGCzLhK
TLSH
T11A858D5EA2EC42D8E47BD6BD85B79046FAB2B855273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c1a00f54b584d4623e0a43992c48a2ffb10b6971654ff8fa8ae78e0acc7f5331
MD5 73a99d178f1a94490502e63f738fcea2
SHA1 64b40fa75dedf481b6ea689ba429606ca38b8930
SHA512 b6f9cc7d7f1b47723ef5155d1258c7adc2fe4b30b336a30fb7802257ece454692e801d372a3f12d29fca173e20817391d3bd2bcae547e929d111dd06fec6b32d
SSDEEP 24576:EegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w+zO2IfjbyXyZTcB0GyDfrvuQh1v0h:EngOJOmPOHz+R8OScKGCzLhK
TLSH
T14355CF3FB7BC15D5E03EC17D8A968916F6B1782603255ACF0160827E5F1BEE46E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 54bac8ccb83d0e654fd65fcf573bcbce23de78ef8c7a6d41ddd68db21a721344
MD5 e4a5b67ca332cfab0980ae1e9a6ebd7a
SHA1 432aebf0905ec780eee2d6e12e8ce7e2109dc960
SHA512 1f278f95449e712a2bf8e0f1c3e6c62ce2e935d90b340abb2370b544992ccea5a7fa7e157e257ffdb3a1c2dd28d9b43d0410ff494c3cd28ee9813c0227fb7cae
SSDEEP 24576:hLJnJiTk3R3waE4JrOIzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:hLJnJK8R304lnR8OScKGCzLhK
TLSH
T1F975E02DD2A810E9D477C2B4815A1796FF31347D2B2169CB25B8E5353F12FE0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4aedb14a93e9bdae885643d5c40c6ed0ac3b3ee3b778fe3caa8fae55e5da7e84
MD5 e26f0b38d98b002754a06a989dbadc12
SHA1 dcdaff695274eec32cacedb884aa938b0c4c5f64
SHA512 5c866fa850c0cabdf57bbd3baab941ee2c7033059690eb4a61d24abd3693fa302811bdb8dca9ef67be5f7e4b862e63af0f9532775907f12d9ef0effa249d4379
SSDEEP 49152:o9mqCzDScAZmlvTcFg8Ph68R8OScKGCzLhK:6z2O9C3hK
TLSH
T1B6955C05F7EA5298E8B3CAF1C96694159B327C509734F7DF0A80CA7A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 3fc1786d2359256cabcf6923d94faac39ed360137780c75fd9c4d3bf25d56cac
MD5 02fb6531c2c4f2de7b76edbc09fbe32e
SHA1 6f926deb1edeaeeec3bf742aac30d433025b8a53
SHA512 f98c98dbe7a177cb1046bf01b477520d3f3caeb1798dec4a17be3891c72246013a39b19a760bc6c42d82adba0d85fdb7f1bc9c0695b097c523596ed7a24dfe07
SSDEEP 24576:VlYJeXm5jUuEuzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:VlYJeXmRUuEuR8OScKGCzLhK
TLSH
T10C55120E71AC71E6E22A813D41E54595E371F0BA130153EF52B4E1BE8F27DE5AE39B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b7fb329d76c817313f49276f428bea25312c21ca9e35c9f46ea3276a8776fedb
MD5 1eb2a1925682a03caef7c5c3641cbaa0
SHA1 21f77994601d88731faa60be38934cae495d6b49
SHA512 c7e813550bec852d16aeede8f029b8ea50e07769a06f26e38c06e04c48ab42c2c412c5e531a815e0db81b3016ceec7d60bec8db03f706f6825e2ce73e2a2a6ce
SSDEEP 24576:P7ty3zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:P7tkR8OScKGCzLhK
TLSH
T13455220A72E492E5EA76463846F241E4AB34BC389B1043DF61A4F67F5F36BD4E931B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 cbeca5978db712022027d6bdce476d39c0a716d08b9512a3103d110475157961
MD5 8208663473e26e3b36d804d49a0ad3e8
SHA1 4e0768b41d7a4803f36e18e9eb647f8e52a5e2f8
SHA512 081777cccd3a67211fd3e3c964d99fca344bd9a76b6f2bf0016c521c76ed36994b698d5fa9b2058ecb53e2de6561b6342c837b9396c788c5efda6654040db38e
SSDEEP 24576:x+zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:x+R8OScKGCzLhK
TLSH
T1BA45230F70B896E7EE12823D01F902F6A259797D905012EF62ACF1FACB398D5D576780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 04f456739304b54ee554231055fb5a51701484056cd9ab125e37481da28cae90
MD5 6bd1f2b194091d9561eebf479fd32dd6
SHA1 115276ba4146cb08f9633e36649c9824c2efc856
SHA512 5a32587479cfe43ff0c08513471b7b6721fbd6a0f2a2d73daa284b1a4fed943d8201e391b104442d583dafda8ebe3b87eb4c156f7214643249a094a0f3e3d224
SSDEEP 24576:dC+TyQIu93VAumZr7jm9zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:d/TfIq+Y9R8OScKGCzLhK
TLSH
T16B558D1DA7F91DCAE276C67588A34493E633B872137186CF2044C07D4A9EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f1d9f5038514384c18d33bbfcf8b5b5de11ca9f9b6525d577d686e1757bd8c6e
MD5 9e1bf08bba2b66b304d6263cb509f023
SHA1 32c972d90008207a875836878fc66a9b4de0c77d
SHA512 67ea3e6ae52b2c2e5baea8bdccd6a4042b25be3ef061ae8159e75a06be9d0f01ca902866494070fa3911190c19c8ffa9ac6bbd16ff85599dbbba34642e8abdbb
SSDEEP 24576:lLQikZ6zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:JQikQR8OScKGCzLhK
TLSH
T14D65F10FB2BA00E6E567C23C88954152F6B37475531263DF02A0D7BE4B6B5E9BD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7c0c5e519362ce36bc811318d218e07209402f9d80f9a3593c9275e75daeb9b6
MD5 37bce26ef7f451f697a2b1a5e46579ec
SHA1 704fcc3d74ca639d1039877eb6254dc89fd344ed
SHA512 d9e4ebfc4f2499384577cfd29e02359b5efab9e2e26948c90e0b4fe71038339ae88dcd4658ce79811ec6d1695199076a781b1a50da149d0bf4fd650d1631dc1a
SSDEEP 49152:0pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP3R8OScKGCU:1pC7b4+80GTkE2O9C3hK
TLSH
T1F9A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 62db1b0684d4eac254e6d18091d7cc6edf552be0de99826fedf6eb637fefd986
MD5 b1add11d42c1e86b60d5ece7d9bea97a
SHA1 b71cf7c43aba48a3af72e288aee6a2e9cdcf5a10
SHA512 f2a9956a545ef1aa030d143d2f085e239ce0bc34921808a22b625c82d541d58b066b6b0d8d037ab7d68a05be3908ab2f7012e835448bcd62b83eaa93e8004a18
SSDEEP 24576:5SAwJPE1IDAo+4Kt+l4413JUQvzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:5qPCIo4Kol4vQvR8OScKGCzLhK
TLSH
T10355BF2AA7F946E5E17AC7749663C611FB723823133163CF9290917E0F169E89E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 82123f5a5d5a96ddf82dd66ae2d92a2986319c8763d6b7e816c97e5c371b1658
MD5 02f9ecc61efc29bd8c1fe876d070bcc9
SHA1 d64a4bb6f2f71c291c0f47c2e66e321021ed2bdd
SHA512 218f3a98c4ac44f2c130a904742018095b6d738b25a5d912bb097a6c955369aecb3f8c6c7916c340591a230302bc33d2810bcd8be9ebd0c51a81ef98e776c029
SSDEEP 24576:dyLXPLcw94tfzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:dy7PoXtfR8OScKGCzLhK
TLSH
T1B975E13EE66C05F5E57AC27CD2A38506F67238AD033166CB15A491791F2BEF4A93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 aad690eb74b8b788231a741d6a309b741c944f9ffde8164708cbcf7934e60347
MD5 732a131468c2a01dc192122e83b10402
SHA1 3632f53ee52726afb618ec7dd6f78df54dd57af4
SHA512 22a8ff3781fbc261b4a5a4a73d64bcdba2c394b08d7ef2fe81ec6efb07b00d62d5c90dd850915e743947df2817b64eba70f6576119821c8209ba5bfbd1826e38
SSDEEP 24576:jWv8qjpKzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:jWv8HR8OScKGCzLhK
TLSH
T18865120F62E464E9F43A823891B681B69171BC7A136096EF71D8F5BB4B35AC0D53EF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-169-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/400-119-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/576-171-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/576-351-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/576-177-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/576-180-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/676-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/676-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/676-78-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/676-257-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1448-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1448-232-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/1448-226-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/1448-234-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1500-50-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1500-256-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1500-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1500-56-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1732-192-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1732-190-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1732-440-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1788-100-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1788-168-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1788-106-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2448-243-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2448-476-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2448-245-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2448-237-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2696-260-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2696-79-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/2696-83-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/2696-72-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/2696-162-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2708-85-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2708-39-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2708-47-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2708-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2708-87-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2940-269-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2940-281-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3324-217-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3324-224-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3324-211-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3324-220-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3324-222-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3348-279-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3348-321-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3348-285-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3348-301-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3348-478-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3348-498-0x000000000B9E0000-0x000000000B9E8000-memory.dmp

Download

memory/3348-282-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3348-273-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3560-163-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3560-128-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/3560-123-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/3560-475-0x00000000008D0000-0x000000000091A000-memory.dmp

Download

memory/3724-496-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-482-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-486-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-488-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-489-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-491-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-493-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-494-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-487-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-497-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-495-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-492-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-490-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-485-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-484-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/3724-483-0x000001EE2B110000-0x000001EE2B120000-memory.dmp

Download

memory/4164-153-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4164-166-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4164-159-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4612-89-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4612-167-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4612-95-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4800-201-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4800-195-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4800-469-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4800-204-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4944-70-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4944-0-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4944-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4944-9-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5324-164-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5324-138-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5324-132-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5444-254-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5444-259-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5444-477-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5444-248-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5516-203-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5516-27-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5516-35-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5516-26-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5892-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5892-179-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5892-13-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5892-19-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6012-148-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/6012-165-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6012-472-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/6012-474-0x0000000140000000-0x00000001401C1000-memory.dmp

Download