7ddc21337e770cae28bb900ce363536e595cb16911066ee13e848ecf9d596163

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260423-ce81hsf16s
SHA256 7ddc21337e770cae28bb900ce363536e595cb16911066ee13e848ecf9d596163
MD5 4afbe349cfc0ef2a094259242fff1064
SHA1 546a575a048f966aa9090685949142de0f9a11f5
SHA512 d841825cb5c6e70a7dd24560aa8b0715ea2651a843aded8d357387fc154d6c13d697fa2a20669caa209044698c8f14ebb28553293af7aeacc09c0eaa664402ba
SSDEEP 49152:IvmHGcnO2EvU/bMvo/SHEif5YL8NnjSVjNCWTPp8N7s8SJGXS0wcwCnnnTssNyit:ITvUko/SzEj0I8Nirc7nTs0t
TLSH
T1041629ADA6DE00C6C070A4F4CD164795E2F2F854833249CB15E81A1FAE7FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
804	alg.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
1556	fxssvc.exe
4800	elevation_service.exe
4944	elevation_service.exe
3952	maintenanceservice.exe
4424	msdtc.exe
4340	OSE.EXE
5016	PerceptionSimulationService.exe
2012	perfhost.exe
720	locator.exe
3800	SensorDataService.exe
1768	snmptrap.exe
3936	spectrum.exe
3376	ssh-agent.exe
1376	TieringEngineService.exe
3132	AgentService.exe
676	vds.exe
4888	vssvc.exe
1240	wbengine.exe
1284	WmiApSrv.exe
5032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69adacebcd1bad80.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaws.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1f14407c5d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea5b7108c5d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067063907c5d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2174c07c5d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069d9ad07c5d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000022a5f07c5d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1c69a07c5d2dc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	1556	fxssvc.exe
Token: SeRestorePrivilege	1376	TieringEngineService.exe
Token: SeManageVolumePrivilege	1376	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3132	AgentService.exe
Token: SeBackupPrivilege	4888	vssvc.exe
Token: SeRestorePrivilege	4888	vssvc.exe
Token: SeAuditPrivilege	4888	vssvc.exe
Token: SeBackupPrivilege	1240	wbengine.exe
Token: SeRestorePrivilege	1240	wbengine.exe
Token: SeSecurityPrivilege	1240	wbengine.exe
Token: 33	5032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeDebugPrivilege	1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1364	2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3424	5032	SearchIndexer.exe	104
PID 5032 wrote to memory of 4588	5032	SearchIndexer.exe	105
PID 5032 wrote to memory of 3876	5032	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_4afbe349cfc0ef2a094259242fff1064_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:804

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4248

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3800

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1528

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2788 2644 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2776 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 88efa2c81acf141ce47c19d1a83086b6f78ddc0d0dce3fa0a58723d33912bf1d
MD5 9653a7ab439b8473b58ce68ace90d96f
SHA1 0b3da32a6a4784b7c69e2e146669bff7e3093dce
SHA512 8003245553e3188b019c3904c1046d76004445fcb4c65e4ec26a9c39705468f9817519677dc249b7f6fd50e67d922a3ec3ae63297a66b65cfad6b6521f17991c
SSDEEP 49152:wb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnOS0wcwCnnnTssNyit:a3q6tjBuc7nTs0t
TLSH
T1EFD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 07047475b2e28758bdff1c41cdaab4b152889beb9c12a4117decc82b5c60dfc9
MD5 eed6a6f780884b2aea587e742e6d820d
SHA1 72f52241c1565a0059e9d4eaef6734c211c5a07a
SHA512 8103f614772edb92643b23754d21fa704b06f3d5930ab8b412e9d3d37caaf140bb1c4a88b2618255464bffd90815eba385a8d16b8ee49fbb58876007c0e0e6ca
SSDEEP 24576:mXYfDtczAHrO0wcSNoM9ECOCmnXXGesNTmx7yit:FtckS0wcwCnnnTssNyit
TLSH
T10A050128B7D508F8EDA7913CCCA28511E633789547B0E78B03B499661F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 698868cc196610d2c8c0800c2e0758ff98c2e83fa0b3e9ce53b39fe5a3946c74
MD5 fd0a9f6a308e321880befb77d9413bba
SHA1 ad634dfc59d6771bb44e74e6bf6d6630edd7a368
SHA512 d971f19b8b8514ff856aa274dac337ac894ebfe1829833b1b1ad2ccd3750698248b6b2be47027a1ab66fe8c201a85fcfe91131c1f12b0693c08b6e2e3e3c47dc
SSDEEP 24576:Q0Le5ji0hmxnrM2rO0wcSNoM9ECOCmnXXGesNTmx7yit:QPji0AxpS0wcwCnnnTssNyit
TLSH
T1D035AF16F6788331D073C0B9C5D2A69EE97130865B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7d9e75c88ccbe69cb0a831394edde35c9d4b5d583c3eaca1e9c610f0ef789afb
MD5 ac97a7e38edee498515cf1cad62ea8c5
SHA1 a4325ee9544ef3ebdec008efced18c97a968c0fb
SHA512 db04d77c1ebbf9b3e9b9f783c30740a49c42d04cb634d9eb5d73b1f6a93d6fc9f235178d2894ddfd7fc9d2c61d894fc2e21cad29039c7ba0534d4a4c5bba0958
SSDEEP 24576:da7/ezSC6vUyDZaqgrvWx6q8wyuUrO0wcSNoM9ECOCmnXXGesNTmx7yit:U/ezSC6vURPvMHjydS0wcwCnnnTssNyY
TLSH
T110755C15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 768a7e2f4342d61fe5c89e7b4a88ee20f69999e3cf04f8c0eb6316ec88c5d80c
MD5 d4750413f5aa92a4cffa402a444b5e36
SHA1 ed2a79c491cb86672e6ec87fefb130790598233e
SHA512 fdbba81e46e9a33594000feb36e46faea7bb6d5e92bdb64457aed05289f9049fa323942622afb276cdb500ff677badd9b9e08560cc10ed771e121bc4c6633d7a
SSDEEP 24576:ZVbqPb88hv/lV7DrO0wcSNoM9ECOCmnXXGesNTmx7yit:ZVO88hXlV/S0wcwCnnnTssNyit
TLSH
T1DC559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3F67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d57a3a9d1bd27f67cedd55427630a623aaf3aba83c543ea8734a5eb1ac37247c
MD5 f405c60d4e2247c7f288d26525254602
SHA1 1690919a5bb89fd8f252de9423e7096f8bcff3db
SHA512 fec1ab7ea90324475c20aa91e41a958e08a74bba2b0c068a332b8ef38649f4685d2045db4d13cad15355376295f56be82af7ed11429846a24ef73f78914ea232
SSDEEP 12288:4G/IX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:4GSrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T1F5C423029B5F1050F3DB70354CF298A1A1254EDC79F5AB0ED231AA977FB8891DF4226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 54fdef421c2a2b4b0ebc0190bc478ab3aafbd36eccad1b1ad07a110358f524b6
MD5 7b0cdef38812c34496f0f8e94777753f
SHA1 b10597f9fe0bf1683b6a78979ab0cda7894c68b3
SHA512 6a7ae5a2e38358883084390dedaf36dc20eb11ddf1884dcec3ec78307a67123e9f5d7db0dd04d29b845c3ed25dafc2d07e94d1af107a55bf01bf3fdeda13e445
SSDEEP 24576:VJIULrO0wcSNoM9ECOCmnXXGesNTmx7yit:VJIULS0wcwCnnnTssNyit
TLSH
T19605CF3BEE28FCD2C27A9D785A918600D77278704F62A3CBD175820EDE235E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fc8ec67bfda643ab1806b5a0ada886819f513b7098ab68259b7c32383e8c8919
MD5 0df38b4722e31bbef80c64fe98cd8a69
SHA1 59e87f66500b5c4eddb186b2036c1d0d61532749
SHA512 31279bbb8394e8182f477c4229d5d98039b4c6ff3195d2086a40c937d784797348393a76a82d96ad900c24df32ae2bd036d2e7b2afd8eae5e135292e26c7d435
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THF:7QvGAdlCEL8c/pRNw5C/c7nTs0t
TLSH
T1AF267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2925ccce821de6e8d02ddc0cd8bdeab5ca44675f5e087ea463d0e88629e8d978
MD5 a6e8515f02e59dee1819fc10fafe36fd
SHA1 d39b11e6995659882e1cd5f9f1a5139b545c0284
SHA512 be609e84a382d580c2649fb1016cdf3667a3c42a80615acae75d63dda725f5b09be411cca47a84f356be41b3589d37efae2adbdbc0f2b9fd37eeaa414c1ab574
SSDEEP 24576:fwewsAjZrO0wcSNoM9ECOCmnXXGesNTmx7yit:YljZS0wcwCnnnTssNyit
TLSH
T1DB15E031FE75E032D3BB0DB61B36C716143D79604BA11AC3E3A88E9E5A701D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d2804c70109e6c7c68cc7fa98a236a893c0807dca3e2900ed99ebe05a5b6ce5b
MD5 3fe67e1c86e290b342f40b529e3456f8
SHA1 f89349d9b8f06a223734057dc337de9f46204f4d
SHA512 1a4d584e04cfc619f4ce03be5b4cead6849371005a13d23d4144044d170294c987542e61fa68149d483485e04ef458ffbb3097c4d572c47ada1430d6bc3afac7
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH06T:RUEtQevvqc2W1cpV29I3206
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 452383a8136e66a2d7c750b9feb262008c8e097cfd57e22121091131412395da
MD5 8946d376da44836f8711c3619e6df0cf
SHA1 8f682c35a74742cd7c7af9afc39b0ec23d8fa3ce
SHA512 8a65b1a5c92e4e366913b0aefaaabf48e5deb70d0e559bc90199ae244313e62e22b3f973f6e68e2ccb8ac5d3111e65624b8978ab95c96ef7a04b602ac007f1f0
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/z5S0wcwCnnnTssNyit:poq2VjnmLc7nTs0t
TLSH
T18FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 78fb06b815b447dc3658545a7acbd800e495cb2964932c5ab9096b00338ff0c8
MD5 efadfad9bbebcfbd41827e78b309d8a3
SHA1 774785901162eeb91e1f5800558c8c9048f0df04
SHA512 b56a137817ff7d13f6574a8e3b578350949d4cbbfa3879c15c5168e309aae8e05d72524bc713413744d95f3c7815022a99c99dd5a3746666aa5c7307b4a04a90
SSDEEP 24576:hAhGLmIFoiwtA5l7S53IrO0wcSNoM9ECOCmnXXGesNTmx7yit:hAM1Foiq5YS0wcwCnnnTssNyit
TLSH
T1F2359D81EBF951D4F5F3AA7899B68171EA76BCA95E31C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5faa62546119ebee0b189319689cf9048e334e158fc60f735c2430057a6465b5
MD5 ad7aaabc0d3e4ffebd5eaf45329699a7
SHA1 b76ecab93d66773c10a46444dfcb8151f5a17cf8
SHA512 cf28fc92d5342486c63d6953864187a3aef690ebfa1e4eb9b65f4f0f93335f35c0bb1e0536aec647cc79b8c38fd3ab81ff909c70e056dafab6631f90819e5690
SSDEEP 24576:gwuXOW9rO0wcSNoM9ECOCmnXXGesNTmx7yit:gwQOcS0wcwCnnnTssNyit
TLSH
T15605F14677A90CF9F5A791388597C536F3B2BC452A31D70F0360C65B6F37261AE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a02741937c4d029f499f7450e258858d95c62040dea183aceb98d0a76ac576a7
MD5 02bac24c62e1859033e9eac576b517a8
SHA1 b13dc65cf0ab8b88f18a56230929d34b209867db
SHA512 01f58490ace2a1b33fd15c0309ff013a4ac6af4c96878ff44889f67ea0ed3abbd4b12c2cea894fdf42eceb4a578690236fb89f59d6a51a2b1fd03ca1c37c2059
SSDEEP 12288:2bZ1IymIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:2Zu+rO0wcSNoM9ECOCmnXXGesNTmx7yY
TLSH
T1D0E4124623E920F4F2D7613CCCF15945E33278D927B693CF522586AA2F729C25E36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 35354b7c68eca609b182010783117d91a16716e8aa81c8d5dbe5d4779227eb3d
MD5 08fa0800ff0f48ba9a0159c3979afd22
SHA1 70ca47cdec21eb6622d1519acd173ae7dee09dc5
SHA512 d9185069b23bed1e8ed8a14b6f8a7718354806e016dfba1ecdcda0bd9a1155818ee5d6dc7c1c6cb06734a517fa5c98294083996c4cce09966e71d8b58005e969
SSDEEP 98304:IQRQyi36YOcPuLvw2gAf+PN3Cc7nTs0t:fQyiKakX+PNS6T
TLSH
T1CB666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7a299d8a1a96267e03c56ae6401ac2ad6befdf8019c997124c37548cf031b3cd
MD5 c6510581b9a10b5208ecb82a6cf5c9cc
SHA1 33a85ea6cb095ee15cba0a7927917220554cb0d9
SHA512 70b739b0014d0910d2b3ac5f406b38566e7ba4129984512dca2a9fe035a393e987d82f9693c675d4cfbebef600c3ce47d4fc030a09163bc8a5f1117f33be468b
SSDEEP 98304:2QRQyi36YOcPuLvw2gAf+PN3Cc7nTs0t:9QyiKakX+PNS6T
TLSH
T18F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0a58b4237ad59310daa7751fae344141f0497a09724cceafbc8be37e755019cd
MD5 6e54148cd0c892e130e7351d394508dd
SHA1 f365956d2cf25bd75400e502194056d0dc7d3c75
SHA512 aa12a437449a8d127aa8d803ca472ef4948b40cc1f287b082faad987e50ed0b6cc7a0d400afcddd44efc8c536e820905aef6eef42fab2030d4ff5a5160a6c1ab
SSDEEP 49152:868Qg55nhxeWu7PNU3/pS0wcwCnnnTssNyit:2thGRc/cc7nTs0t
TLSH
T198B54933B2F600A9D04DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cf489612a8140d2ec29e0f5e3a925467109b48b6dbe5607d6942280f1d4acb65
MD5 a8e015eeae44ef8ee4278e9e9010a2c7
SHA1 533e7cd8e39a058d439b8b14531d52c7e497efa1
SHA512 1124f28409f50aa3a5168fd7f43b1c0f913b715eaade5f99fee8193126efadc1adc02e81c435e1d16c3725d41facb2b6a541075cae6556b6bbc21c0c5249ebb6
SSDEEP 98304:By5112gYy5azzVvD69nLKnhZtc7nTs0t:cLIH+Whz6T
TLSH
T174167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8b8ec5b53e0fe66a89ff89cce222fb495467d75524712ca5d334f9519ffe1b54
MD5 1b193b20c5a45c902c36852f38000e5c
SHA1 aca04eecbad0dce94f69244edd69b18dd34e0cd9
SHA512 2d3b135c89eefcd40443c3060c35a3943748752b48ba4267e02b008b85dd84662af8351212a81b3d62795e86284044c997438db520e6d3f30219977c7db095f3
SSDEEP 49152:QB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXS0wcwCnnnTssNyit:Ku6JmQxd2dac7nTs0t
TLSH
T1E7D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4ccf5af19ded19d6470ce6f02fb2d185e8bb6d6ab4dc9e9433edb44e70f28946
MD5 a1da4a8efe7409154a58607bfe732fde
SHA1 fbd33c5971e3331a3efc52f584669f91e84e2e2f
SHA512 bd920eb2ff17e00389207c7a9034b6497a6679079a83c4c0962c2b3f092914f368716ca02c38d1cc85372a37cbb887a16b497fec49d71943ea5a72c383429620
SSDEEP 49152:o1hpsNoJpF1A6yU44CwH7R4xrS0wcwCnnnTssNyit:omifPVRLc7nTs0t
TLSH
T196B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 02d5be3e5d3f3e32d69660b8ed702f9d29671f7891195a587d7ea7386ebfd709
MD5 3b3d6175a83f6576086dbb9fbbd837bc
SHA1 5fe41705e4c4caa2222bb794ea57a46821812f77
SHA512 744cf22207d319297933ce81ae816aaf8a0fb1724ac81e1868ad65bb81edf7ceb6fd633b93cbb024c7d712203dd44445d5c47f465da7b0523be93a0b44ab4e1d
SSDEEP 49152:QSuZQIY0Be2KIRVtOnks6NMHq+S0wcwCnnnTssNyit:K5dKOi61xc7nTs0t
TLSH
T1B4C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a02438b98e4b9f66d2f666f4a3e16149ce453b212813e5c0bd04c71df510219f
MD5 d03888fd53187d1cb70fb83f0edf64b2
SHA1 e54bbafce3fa1f11d188a2137967a30365d7cbb4
SHA512 19eead36276a1a77f0a95103a140b2d273402663432f405d468c4a461089fadafc09ada2697f13ecba54afa2bdfae59f375d826cf9beedb498ab6163bb5e35e3
SSDEEP 49152:nhtSn8EApI0figGgiDn0AP5wHS0wcwCnnnTssNyit:2X2i/phnc7nTs0t
TLSH
T1CB95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3a78636cb977803d73bcd98f8bfaa3915b00bf0387b63d20153ae5f8c98a670c
MD5 0b7960b4779919dabc6a5727490366a7
SHA1 9c01fee7982e171a506f8ba6d442dd5c7bee6594
SHA512 27eb15b012a1c13d8d4879f92cd000760ca749dfdda96608fb0625e2593d9390c0192bed42ff654a86880f94de9ce364a1349b2006792bb884d50754c02f1274
SSDEEP 12288:uXIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:uarO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T108C42302AB9F0150F3C671358CF294E5A1255ADCB9F6A30EE33A95137FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e4504ee6016dae20eac3e99d58fbdf99563725e5a2e91276309e794ffd38ef73
MD5 a98b6fbcce24177abaaabb1fb7723915
SHA1 4a0fe48cef23e8fa40ccef4a32aa2ae5f4a0c5d3
SHA512 71c7eb9e2eb18f53d27d45131b52a62d4388f28def34bdea71722f3c6b82438eb345216116025d4767ccbb1c8f9a2ae38ed3b50face3a3c0208e017125e087c6
SSDEEP 12288:uKIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:u1rO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T143C42302AA9F0150F3C670358CF294E5A1255BDCB9F6A30EE73A95037FB8C915F425AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 35597fcd9cf77e0a5d466e20f5da6e1cea13a63a46f16d55122f7440539ef988
MD5 2382b4e01a9f467131222463aedefe15
SHA1 dc841caf3ccde810695c004ff3e95c93f6fd05f2
SHA512 5c6c918ad18ca71111ab11666f3604fa6e00a990fd157007de6a0019207f8df38dc4d947c73eaf22702732e5980d99ba0b8dc57e37ce5c7f21cfd182980a955d
SSDEEP 12288:VAIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:VTrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T1C2C42302AA9F0150F3C6713588F294E1E1254ADCB9F6A70EE73A95037FB8C915F425AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 66a18a318c86d0776c8e57e5fb79441d4d186476c909330bf82e4a0a5bf56572
MD5 74de2295bd3282249d4dab7697a7e53d
SHA1 0307b399ef225de58ab9fc627661c1d2d42b1fab
SHA512 0d97c14360a58fe05f7da8a743c7a881c5f6bf706ba530015c7ac28e62cde514e7804538cd1844ae37dd1d69f89db2a96b824f836f06ffd8cd33384829889768
SSDEEP 12288:dVlIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:wrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T108D423026B9F01D0F2D7B139C8B294A1E2357DDCBBB6A70FD72145472FB0990AE11B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ec86a066592010b4ab32027629b56941e37941b7bb30f0551dd9def18fc664f6
MD5 ac4c263ea8c864c1ab72843c75a63c2d
SHA1 c0f0e41d1fc2f390a18fba3ec9796904e0eddad8
SHA512 0e2e2d5fd501bf61b2b66237042f0e976d54d2341e8dc6184dbae108295d66c616e8462744a529f9ff10fda08747932ce399fd0d2418aed123aea553d197787d
SSDEEP 12288:GtIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:GArO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T164C42302EA9F0150F3C671358CF294E1A1254ADDB9F6A30EE73A95137FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9a2f63c24ecea4882f4fe618ae3f9a270e8f6609671bb0d22765e42ad9693bd5
MD5 5c04b244ff3e1d84ee0d77f1814c9638
SHA1 46919a906ade3de668999437ac3cb71b91d8aa82
SHA512 6c9450204aea07b8e42d6473029a04a308f7e8884ba2d15b79807dadc50b13a7172791690648006a431c3f5a073535d1055d405b1d331519bf881ffc46c5501b
SSDEEP 12288:VOIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:VhrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T1F8C42302AA9F0150F3C671358CF294E5A1255BDCB9F6A30EE73A95037FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b5c6c440119779d40b6b2d3024140bf490498dce51d34628f3a8e8df5f1afe01
MD5 b58de284ea24d84163cf881303a99d07
SHA1 76d67342a98024dc8358e32d342ee06060b66be1
SHA512 2af6d2c0c57347d2906afc5e5dcce68e2d8353dedee7b11a880ce0a4d977956582a24f16ee6602fd8288a369a34527e08aef8cfabc4be07cd2a0fb1969df877f
SSDEEP 12288:1SIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:1NrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T1B0C42302AA9F0150F3C671358CF294E5A1255BDCB9F6A30EE73A85437FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b7b7fac3786e1e3fcde8ce1330ab3e22f09b02b385ec6621298286c7decac35a
MD5 39b325520836b322ea8e504d266251b5
SHA1 5133cb48ba6c893736d305aee5aa3c9f6f91cf7b
SHA512 10df513a5da19ca901c91a5a40faac9bcdc41e318fb0270f23917386d9ae5730aa8c994bef843c319f9dbe8afb9db7e6df6e49e3899fea5f86c50c2b061f0426
SSDEEP 24576:PZMJzFVSOVrO0wcSNoM9ECOCmnXXGesNTmx7yit:PZMJzfRS0wcwCnnnTssNyit
TLSH
T13C050255B39518F4EDA7813ECC618916D2B27C991BB0C60F03B436276F733911D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 56de3402d179611b7b69df70378d3fc200a36bf38d3f30aa72ea4093de8b0c7a
MD5 02c6be170c589e81c51e22be9428ae88
SHA1 07b0c2c5f95de72120b9eba7087354dbf7b783f7
SHA512 92bd4b852d74b61bd405861f5bc116afddf3095afe2aae9e44a9bf4cfed422feb1504de697da53621de486d2d4b49dc8dac12401fc61d5009f494984a7358495
SSDEEP 12288:kTIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:kurO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T161C42302AB9F0150F3C6713988F294E591295BDC79F6A30EE73A95037FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 905817eacacc85709aa28e1efe0a9c26c9b3221eefc0f69577c36e1ae9a7f5ae
MD5 044353aae16d6d8cff2b2e5d2a768505
SHA1 2b91c1b134f1b9f0663b24677cd29eec2d7c308f
SHA512 86da2d786b08f5049e0c94f7b7460e7a71bb243364e624fad91c2e4c6b9fd78ee5f7fc7291cb00607af4c82fad0e39887735570fb53f434b1a92b87ce26175f1
SSDEEP 12288:DPIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:DCrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T12EC42302AA9F0150F3C670358CF294E591295BDCB9F6A30EE73A95437FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 cfa686e46f406a3283d5cc28b7fd58b5deacf19faff0257a65b824b65d4dbc50
MD5 e67fd19435c5f2d09cf89120a5c6a539
SHA1 f8244486e584896cbe17c53e6105381672330822
SHA512 e09e395ba6398aecc91203fce40341a8ea9b28f01f875afea60d9c63e4abf443622cc39d42b81c68e9480b068ee9b061ef77392602a247508d446594526e5f31
SSDEEP 12288:lyPz5L8mIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:szyJrO0wcSNoM9ECOCmnXXGesNTmx7yY
TLSH
T17BF4020373A620F8E1A79238C8A21952F33278B51B709B5F536447772F376D19E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c32df4dc786f65b49c3824b2bcc3c89787506a48f71f10f1c890552e98a51b95
MD5 761086d73e49400095503a5901b170f2
SHA1 cf02f69dd881a54594ff32fd39528755a2d15fa9
SHA512 954d06bc35c564afd253b36a2a4bcb6b9a3cdf3a79aa04a10478682b83f246a3847b9f2346857c38fe90e23a29d1fa5b8f245faf39af89ec095fa242494b5198
SSDEEP 12288:GTIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:GurO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T1A9C42302AA9F0150F3C6703588F294E1D1295BDC79F6A30EE73A95137FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1edfbd697ed74b71ac5b33bf1661713743e1b89273de205a233ae6d2b1a3b1a2
MD5 2cb25207727855314f462e0cc564db19
SHA1 5f8ddfc7b7ebf58791290300f8ddb6de2fdba15d
SHA512 52c7a3b488f250aaaef54a6cd229745eefc1f943cb84d230d3216bfa1e5738bf216cdb2abbad48a4aec9d5affa3dffa8488553c1128f75c001fc58965f1bad68
SSDEEP 12288:rTIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:rurO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T1A5C42302AA5F0150F3C671358CF294E5A1295BDCB9F6A30EE73A95037FB8C915F025AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 10446e8680db576d3fbb1d96305f7a5484732b7160e53f4133ee7be6d4d4eb2c
MD5 aefcee1be81e300b060c1cdd697ba121
SHA1 eeee49962ae712cf857195964781622ab9f508dc
SHA512 caa033a0de4fd81df4e45e44b8adf8cd51e337eed6138baa1e8b171614f5fb98ab28b8fc63c5d7e6aa2fb6756576db081ff1055b206e2bb50343fded1c6c0c32
SSDEEP 24576:MCUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAfrO0wcSNoM9ECOCmnXXGesNQ:MCUMPTY+8Wg2lIL8lrIUJLWwAS0wcwCr
TLSH
T1F065AE1EA3EC0896D0BB813589518A16EB32782E1B32D6CF2160C37D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 472e2c4c9d061d7d00d9c25c4e72a246f5ba8153e419eebd64a8de0e8f6cccd3
MD5 2004b62db5de8e3ee18249c3597f5264
SHA1 9fc46d00aa297bc81307875e39dea609c8bf8105
SHA512 9d2ccbc710afbf48b6c30f40db68e8ab24cd6f68f9d390247a8d2bf0a8e76a193bcd137d354aa6a8197a94dad65c66c9bab124feebeb20e2ac0be9b5bf63db8d
SSDEEP 12288:pksfDIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:5+rO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T134E4F10AD29902E4D1AE6139CB924A41B3337CA897F1D3CB52D0F53E2F755909EEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f37724b084198612b6016231813d353cc2987779726330be249faaac931f092a
MD5 91f17ea123aae22f44ab4c6eaa8ad079
SHA1 534774dfce3b5c0a354bab5077196faac710e3ed
SHA512 b27c335b99610535bf41ecd2e7695f0da0d22169e13b0404748f98166523724ce0b5ecdafb23f7de4ffcbd6f6f269973c6504dc6069f5c96f9ec75deaa9af546
SSDEEP 12288:ugIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:uzrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T130D42302D79F1100F2EA713448F69470612A6AEC7FB5E68BF22592877F74CC19F2166B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 be1cd3a376b09f99bdf1e15ba7442a070398d460c2396624b1b21ab5dc9abb71
MD5 ada2d40d9180bd6de30253db252c2874
SHA1 b2d068232bb273ff0fc031526bd81e048e2f5068
SHA512 365e597213ab300396a43599955691be2d4985c1591c0ee83bd11d572710a35e17e094fd77372e4993e8759c94e6e3bbdaf97eccc07350b781341405433ec5c8
SSDEEP 49152:HRZwQCyiHiQEaaPnMWS0wcwCnnnTssNyit:x9xvPAc7nTs0t
TLSH
T15785A01E63DC42A4E0BAD278CDA74407E6B278165731A7CF1291C27D1F27DE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 9807ee77abd87e190039f463d4aa32ae716133f6b1ca73156be4818907621eef
MD5 37bff814a3058379e0aa6ed8f2274362
SHA1 7e89b9a900121bdd0773d0694e71fa9d84457fd5
SHA512 c9ba6c4dff225b5714c53d742595eeb8a4ba0856267d471d3e6b88f2ac505eb5667fd54e5e2714223f63b52cbbf272eeb7d187ee2880eef29bae4be11f731f2b
SSDEEP 12288:wbxA1U7KwIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yY:wbxA1UGjrO0wcSNoM9ECOCmnXXGesNTk
TLSH
T1D9E4122E66AD10E0F2F6A13D88E28105D33178A9277193CF6191C27B1F3ADE55D36F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c1964e8ab463886cabcf4b69badfb54c659de892c332c43bec4f69a2712687c0
MD5 af9238a4a189b8c5c67068b11c7aa802
SHA1 a82279586ce2ecc6470113ec4d7393a219d7b766
SHA512 6716a3f48114b71173ca83e8efff65834d18acc8e2d1a4ba3dd649fc434caad9ad5309e4c5ce71ee61898bee4982d911216a0e5f17035a52b00efb7c1f51c32f
SSDEEP 24576:tjsmP0yHaqrVqHra44KDzMsrnYrO0wcSNoM9ECOCmnXXGesNTmx7yit:tjRP0yHfVqzlAsrnYS0wcwCnnnTssNyY
TLSH
T18145AF2EF2B910B9D4AAD136454107B5BB71B42D1F209ACB0170C635AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 10206745435bfeee16a68863cccfa68f8a7b34d99f9a3f5d633f0c23e66e1078
MD5 f9d4ef6dfa8c526b9913fae5bb97fbf1
SHA1 8e57674e77f969479fc3958431bbab0d8dc5994c
SHA512 64785f5cdbc43d661d98f13e2813fd6a0f258c54bbec7d658f5922137b9f243695170520b0d10bfd396362d2284eda35a3b501f04b5e2a11966cc85a50dd2e89
SSDEEP 12288:2uIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:2BrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T151D42302A78F0140F3C6713948F294A1A1255BDC7BF6638BE53692537FB8CD25F226A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 c5e4c3f21ab6f273bf5b568c63dd87222263e9be18a36c05e6469eaff4867647
MD5 4a6feea6a44e0eba1d82d95b99a4bfbe
SHA1 78f4deec739b7a33e77c8be4e3f496d523e9dad3
SHA512 f476e3e829d14706f377dbf653d0a66e36e8372e3d49c172b05c85697b770255fd585a5e44a4e1e5fd13c88b6365bbbbdbf0b5b2f63d90f15a1b75aa064056ac
SSDEEP 24576:otLBUTHrO0wcSNoM9ECOCmnXXGesNTmx7yit:otLBULS0wcwCnnnTssNyit
TLSH
T1D8250115F79900F4E9ABD13CC8B28916E272749C1764E7DF03A84B662F636E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 de27fac175508ae48fd9172b9c16ae4d47fd4a62bcd574bfa7fa2378b18b8416
MD5 fea8a4fb1da6e07903375945baf0d7d6
SHA1 ae56d64688b86b70baacce6bb7fb072a6e9ac2aa
SHA512 f8bc28c415d649a5572b5f6b624416bed1dc39612cf76af5ebec6e93086c6d60d40e42e9b888f5048f8d620c37369af389a4102b215d4585dc3a979339594e2c
SSDEEP 24576:9WYNHsrO0wcSNoM9ECOCmnXXGesNTmx7yit:9WYtsS0wcwCnnnTssNyit
TLSH
T12B05F11F62AD08E4E17BA17D89C38519F27278A6176193CF01B0C27A1F17EE9BD3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 74a9c642ee0099f0f65220817d5b0f9bcd000f019d8d9468c48e8977d15d8651
MD5 c6fb84d4ac4acfd1399a90cdf12583ae
SHA1 2ec481add061c89db2049d5ffc1b9c79466b7382
SHA512 3ec8e847de17eb0a2ad18aaec5b72bae369b5f507458c408be62baf788a94e8f683e1efd4dbe1c615b7eb0f7b95b7f5fd9f2746442cf51bb089a4476d0ec13e2
SSDEEP 24576:2nXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKv:2nXoJJYH84VVS6AmEvJas+cHBjSSKHPf
TLSH
T13065BF6EA2BC04E8D5BBD17DC5C24506F5B278651331CACF022182BA7F27AF56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c14eb07ba85ba3906d1d0fa927d3d3a457362d436d75d2855aee47161fd42732
MD5 1900de6a71d73b8370193486c5093a04
SHA1 983cc97a70b9c81bfa08cd425b76264729d403b1
SHA512 9f2dbe7a5e3f5b827c6d66c5fd074c4efe127e215c1c6478767286350d40c4fcb60a15a49706f1145927f84aba271a89e7a7f644cedd6961147c1bd7aa379aee
SSDEEP 49152:jDLL9TuJ0M/TYW2PhS0wcwCnnnTssNyit:gfc7nTs0t
TLSH
T102858D5EA2ED42D4E0BBD6BD85B79046FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7395ce549516759567f07b9c924d71c9ade897fb103cc15855b52fb07b304f37
MD5 ad85d19498b4a2afb3651558b2f64d2e
SHA1 81ce1f7d4ea317f1837ee91a51960abc461531d7
SHA512 2ba62648bd1d7e6c25dc3329ed0f8ddeebe7063b78cc37069785e2b2e51e1bd82aeece21b501dd59e3d718951ef82fe3f70186f09f58f40049ab1aba68c31dcd
SSDEEP 24576:SegJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wHrO0wcSNoM9ECOCmnXXGesNTmx7yY:SngOJOmPOHEHS0wcwCnnnTssNyit
TLSH
T1ED55CF3FA7BC15D4E07ED13D8A928816F6B1786613355ACF0160827E5F1BEE42E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 dbbc190b6e01d5a43a9a9a041606bbbb69b10cb5e8d41e62d5dd597bfb3f96c0
MD5 595febed81b124b9788573bb254aa6ce
SHA1 f5d131166c34c8ede145cce703c9195f1b286d5d
SHA512 42525e7d6de92b27f13203bd2728896a37b4748475f3507339b09059cdead000749c0c36e83a66a46349b6030a4aa4baef110da681a4cd958e61544ddaf4dc72
SSDEEP 24576:6LJnJiTk3R3waE4JrOhrO0wcSNoM9ECOCmnXXGesNTmx7yit:6LJnJK8R304loS0wcwCnnnTssNyit
TLSH
T10415E02CD2A910E8E0B7D2B4815A1A56FF31347C3B2169CB59B4D5313F12FE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a22204b9eec692448c710de9bacd8c5da6aab13d7a4156fd918f45697411ec19
MD5 7c6e7bfd914013e0c480a236ab17b91d
SHA1 b83229da4dd77c986d2e14412490493d760008b0
SHA512 4286fbfd9f02ebf9c6f4d74db5d55e6081c97b0caf1dd1efd8508170e1f38e8f2faf9eb59e224b92a0e03095c246b26a5ad538b0469f134f6e126ff7005d4ca0
SSDEEP 49152:y9GqCzDScAZmlvTcFg8Ph6NS0wcwCnnnTssNyit:s3c7nTs0t
TLSH
T1FD955C05F7EB5298E8B3CAF1C96294159B327C409B34F7DF4A80CA6A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 d78010ffa69a77d562e9af170620d68bdbaf0d18f00a8b561a65b0730a23f2c0
MD5 cb7bb40961f9ef13417d8423e3afb4b7
SHA1 c735db485f336c3bd5da94293b5b8d4ff093fd9e
SHA512 c9afed073e7be3b34d3a7c55b4824e58f81857c52ccb12df93a9002c74510e7e6a69d7810cf8f071855ddc74c5236d15e478b6e3c6ddaaf3187e6855e9f78478
SSDEEP 12288:plYJeXm5nkEUuE8IX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNQ:plYJeXm5jUuE3rO0wcSNoM9ECOCmnXXr
TLSH
T1BAE4121D769D30E0F2AEA03988E24954E331B0F5276167EF91F0C17A9F66DE12E39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 b39fec634f2ae4f347157aa639bbe3494f6aae35fc14458ee7030c476a2ca342
MD5 df38e836dd646ed86fa9b2afc02c4ee7
SHA1 79b3b8e9cebd155cafdd5c355f52eb3077e58b0b
SHA512 80c4a7abf4ac201d2cdf52022dc8f8df44d1bbefaf4f3d1fb82bb75657cd67fcd2c2c0dbabbbdb4d75d0a66722d144f0150ee597ae17f0f4b84d5a41fa0c7f92
SSDEEP 12288:2wu6kyVIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:2Vty4rO0wcSNoM9ECOCmnXXGesNTmx7l
TLSH
T178F4120163991094F2FA6538CDB381A09635BCA46F7193CF91A0E63F7F75AD0AE31B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 c3834da6c1c1e5289ddd4648388366a212b52565fe5ffa63a936674209013d62
MD5 ebb68c90baf7466eb870cec2a67bf3a3
SHA1 eeb41b9e0d62d07e2274e2d36376ea61379d343a
SHA512 7552000fc2baf0939e81849ebd3a859415b8b74424a6a777095e1554acc24de1ac6ff4bde7d976e6b70564d5f6923ef2357ac861df218c070f70af96121cd081
SSDEEP 12288:pPsIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNTRox7yit:tHrO0wcSNoM9ECOCmnXXGesNTmx7yit
TLSH
T19AD42305675F2050F2C6703848B254A1A1357AFC7BB5B64FA1B1D173BFB88C29F22E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cf285b0665d0d9bd29106a2bdf63c3467506c1813f8f6618878fc7cef15e6d36
MD5 4614d28a0b8a90a001b29389b34d712e
SHA1 612a8d08c6e377d720296c06e2acf79f162a5ec0
SHA512 4fd16767ee2b2da23fab4e99d0256c2b0e0f8369d6faea3dc159983f94e0c495a0642cad5c563c203f144700550ff353051ac381d982acc8ec134828698dbf1d
SSDEEP 24576:OC+TyQIu93VAumZr7jmerO0wcSNoM9ECOCmnXXGesNTmx7yit:O/TfIq+YeS0wcwCnnnTssNyit
TLSH
T1BF558D1DA7F919CAE2B6C575C8A34493E633B472137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 a20d64ee2c515fe6e4036c874ce077ace650352f735e2a81b20297ae75b0eccf
MD5 f115afdd9e255609773b717a678d3747
SHA1 aab45d30e87b9a4aa04d74e63d85edf9f8e24820
SHA512 32e8ab7ff71cb1888aa6619931513222a92f127592663759d8dc84f7110e5695cc75e320e86ee7973a5903ab04ba0bf31a0e76fa09c358a809a03f2f93590ec7
SSDEEP 12288:LcyrWOstaa3kcs4IX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNQ:6LQikZbrO0wcSNoM9ECOCmnXXGesNTmf
TLSH
T14FF4F10FB3AF00A1E1A7913C88914152F67374B4576263CF42A0C77A5FA75E6BE38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a39a349562dbd3848da152b4ef09c73fda09d745853cb25893261dd3d7591ccb
MD5 03d1db6d22efca4a5e8dcc9393a8da9b
SHA1 0c5b7629071e306e20eb8d80287055132b3977e8
SHA512 36b92bc25446073c18b44f9531a6568327b9f20a3b2e5538d0825e71d32c72636ddc39ddd7fac9074945ffb61c0fba170c0fb97a7cd73c5342e48cca09d38c0e
SSDEEP 49152:7pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP4S0wcwCnnr:QpC7b4+80GTkgc7nTs0t
TLSH
T1E2A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e08af61266d13144211067ee2df9a684937e92a8a6cadff3938b365ff1024c17
MD5 66050fc89eb7362f29c2f407f885d0fb
SHA1 8fd4092e0a4b54c3aa94326e718e1e30175eaa51
SHA512 522cd71f5bcd48e68a840e755147e50a12a6e42464f4c864f71a584a672c49ea9f22a7c795fe93c5600c62d1e2ad73e036d4860b22fcec7d1de4703907dfab2f
SSDEEP 24576:OSAwJPE1IDAo+4Kt+l4413kUQgrO0wcSNoM9ECOCmnXXGesNTmx7yit:OqPCIo4Kol4WQgS0wcwCnnnTssNyit
TLSH
T15955B02AA7F946E4E1BAC774D663C511FB727822133163CF9290813E0F169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 ba91e78e1e821c12c94f242ef6d0062bf04132ae24f116303173357a5f843ac8
MD5 e5d033e00e888beb0b71b98039abf068
SHA1 443f134ad7e9d4d90ea19bd725e32767b8f5684d
SHA512 3eb05644bbe03d7eb0f52eda5a57d3c5d5ca247b6bc0f49d84e8a6337018ebf8e3daaad14dc021c1e4d988414f6c9fd35ea70ee2175796ddce47431731e21943
SSDEEP 24576:ayLXPLcq94tQrO0wcSNoM9ECOCmnXXGesNTmx7yit:ay7PodtQS0wcwCnnnTssNyit
TLSH
T18F25E13ED76D04E4E17AC17CC6A38906F67238ED037166CB15A0917A2F6BEE46939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 57c2ef2c0583d519c7c53db973afda7855ee91531a5a332afa95c312fac01e1d
MD5 3e74b3e347725361b5875070793a2e4d
SHA1 3e991ab2f2566f1ad53f2cb99659798cc4636bae
SHA512 662dea7db0d15559a4b3c1b4789311f563aeb3a1daf9f939a41054eea50c2d415eabab40c60df121186d8ac94e49114ad765793a086bbe3e3fcc491cb744c875
SSDEEP 12288:59lyvj3IkxjbBzoIX/rAap0uFS504FcStWKoJyom9EC7iKZXXgtlUEbzXGeAwwNQ:5Wv8qjprrO0wcSNoM9ECOCmnXXGesNTk
TLSH
T1BCF4120E67D92094F1BA5234C87281658031BDF927B5AAEFB1D4D57B4F349C0DA3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/676-179-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/720-366-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/720-112-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/804-98-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/804-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1240-213-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1284-214-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1364-9-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/1364-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/1364-68-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/1364-0-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/1376-178-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1556-41-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1556-42-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1768-369-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1768-120-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2012-365-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2012-103-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2012-108-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2012-102-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2516-27-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2516-17-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2516-26-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3132-149-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3376-135-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3376-299-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3376-141-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3800-367-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3800-368-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3800-116-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3936-123-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3936-129-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3936-177-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3952-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3952-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3952-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3952-63-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3952-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4340-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4340-82-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4340-76-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4340-363-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4424-71-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4424-362-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4588-402-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-377-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-395-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-394-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-393-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-392-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-391-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-390-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-389-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-388-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-387-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-386-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-385-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-384-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-383-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-382-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-381-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-374-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-413-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-412-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-411-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-414-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-410-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-409-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-408-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-397-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-375-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-398-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-376-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-379-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-378-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-396-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-380-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-405-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-404-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-399-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-400-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-401-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4588-403-0x0000026B1D1D0000-0x0000026B1D1E0000-memory.dmp

Download

memory/4800-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4800-38-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4800-32-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4800-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-180-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4888-370-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4944-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4944-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4944-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4944-176-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5016-90-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5016-364-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/5016-96-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5016-99-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/5032-160-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5032-217-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5032-181-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5032-406-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/5032-197-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/5032-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5032-215-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5032-166-0x0000000000910000-0x0000000000970000-memory.dmp

Download