446e0efa4a5de1e3193afbdb65476a2a626782b1eb11c993f033dd08ed0af57b

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.7MB
Sample260427-rfp2csds3v
SHA256 446e0efa4a5de1e3193afbdb65476a2a626782b1eb11c993f033dd08ed0af57b
MD5 a9a16440693ff9e277240a138dd95c58
SHA1 a29ce21fb774db46af045d3ccf55ebc67725a3d0
SHA512 9b673550d04ebd9be72a8812ae5549149ba46460b41e692488671e8626ddcbe67ee94a7aec7804ac7dc44896ce477d8072fc19e9494e7549ed9f5c64cda83b1f
SSDEEP 98304:1GU4WAJ44EHeTD9QHy+diKHcpm6+U023W:1L2XEHe1QnAK8L+p4W
TLSH
T10A06E187E66C41E8E4BFC1F4CA16494FEBB27C678520824F329576971F932519E2BF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4692	alg.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
5004	fxssvc.exe
3824	elevation_service.exe
5988	elevation_service.exe
4520	maintenanceservice.exe
1824	msdtc.exe
3232	OSE.EXE
1884	PerceptionSimulationService.exe
3676	perfhost.exe
3268	locator.exe
612	SensorDataService.exe
5728	snmptrap.exe
3848	spectrum.exe
1788	ssh-agent.exe
5516	TieringEngineService.exe
3792	AgentService.exe
3488	vds.exe
5420	vssvc.exe
2572	wbengine.exe
3960	WmiApSrv.exe
2808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9130c26bfd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031a820cc66d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e7ffacb66d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030bed6cb66d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e0a04cc66d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc1fd9cb66d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040f52ecc66d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f46682cc66d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
4636	DiagnosticsHub.StandardCollector.Service.exe
4636	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	5004	fxssvc.exe
Token: SeRestorePrivilege	5516	TieringEngineService.exe
Token: SeManageVolumePrivilege	5516	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3792	AgentService.exe
Token: SeBackupPrivilege	5420	vssvc.exe
Token: SeRestorePrivilege	5420	vssvc.exe
Token: SeAuditPrivilege	5420	vssvc.exe
Token: SeBackupPrivilege	2572	wbengine.exe
Token: SeRestorePrivilege	2572	wbengine.exe
Token: SeSecurityPrivilege	2572	wbengine.exe
Token: 33	2808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeDebugPrivilege	4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4636	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 676	2808	SearchIndexer.exe	110
PID 2808 wrote to memory of 1736	2808	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4820

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3676

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:612

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3688

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:676
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e5f5f98124766c445ef0fc73d712990a4936f45fc97dba50244b659ed38d614a
MD5 b196018424c8de4e31c8324d195022a1
SHA1 d84a7f95579f72cacd8514187f6ff083a62c944e
SHA512 e69dd2560f0ff96caff680d29ab7b5df3a04b095cb4f7187ce02abb7bd182badd635e52dd031481e53481bb05d5c5408cc54844bf09b99dacf88589fbe210375
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/e30jaNf1TWbdz:03q6HjBiU023W
TLSH
T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d01b111d799260d2a2d849a979112ebfab3d5d10759012a8ad54585b4f781cab
MD5 21e7f068b85dc0e645e7673e84e37ae5
SHA1 e47e148bb34db1656800738b09e298447bd34902
SHA512 2b562678f5021f7ca00273aa614fd9cfcf4eccc30f19dd40bf1185eeb5417c6733258f8e1e96cd980ccc71d9bcff01dd51bf72d9c2f6fbd46c296cc48389cc88
SSDEEP 24576:vXYfDtczAfgXe4i7ojhsP5Lgrk1TWb4AN5:atc1e30jaNf1TWbdz
TLSH
T18865F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d46a368e53f9b1d0c48710cc3abb98c32028f438a957f59192b18a51448bad66
MD5 04977867eb15a9a7d4f85b1cd5f195fc
SHA1 6adc27a145c4aeeffdb9bc5e551f7f0a894050e7
SHA512 8aa16b3a208a159e7b2810d57f35f45e5535eff5c4ff496ae778aa34e1422a09688214fc73cb4a3c7a8b742dd8f1ea85e7d9effd80f0ed4e2795850f9f525121
SSDEEP 24576:40Le5ji0hmxirMggXe4i7ojhsP5Lgrk1TWb4AN5:4Pji0Acoe30jaNf1TWbdz
TLSH
T1F885AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 858411a68afca61bfae092ba16018e1da28032a84b000cda9b6b6f460dcd4778
MD5 6e7f378e8cbbc171d1cb69a311a837a6
SHA1 0fb6afa8ed9063bd7a9bb9c0dc23056c097b93c6
SHA512 263824b7c4d51c9b3f57501ac0ad0d8cccedd5a5e72e641686dc228e2e0773947e7f5683398877273d1614d911dc32b3235757e67634edf37f487ef1fc6ea937
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyuSgXe4i7ojhsP5Lgrk1TWb4AN5:3/ezSC6vUzPvxHjy8e30jaNf1TWbdz
TLSH
T169756D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e88a8e1b2dd1d935b49d90ab9bbbb7d3cbe3fe041a4f6c94bfcf65e742c9e8d5
MD5 2fafffe2150a860c60f87085ab47e86a
SHA1 dae8518f285215048f3e5a455f0527b4ad2df3e1
SHA512 10834bd743a01f12d7a8282c6ee973e75304cb9663a6bfb60337e844356e85640ce33a1896c0a345689aba447c8b3dd304e490d6fb0c9e262a888d61c0b83ea4
SSDEEP 24576:6VbqPb88hv/l+6rgXe4i7ojhsP5Lgrk1TWb4AN5:6VO88hXl+7e30jaNf1TWbdz
TLSH
T1EE559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d2a56b3fc37a589db7d165a9e5c514645de65a6f6046423e8a5d32d63f2cd8e9
MD5 f195e4ef38b514864a7d9a64186f913a
SHA1 c9f6ebb466f2cfa5f40d030b1cc1a0b7b30e5baf
SHA512 6e093570134fedd315bc8706cd56011008cc9db786af0d4978565596fc35859e4646e2a731eacdc81999d06b5b52ad22df5998b4a480ed4f38f2060368c39b52
SSDEEP 12288:yRP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yRcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1304523919F5409C6F38BC3F0A0F7CB91F9E11EC065448E6B47E0FA9358BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 77e99b8ba17c63c26810331b0c015a700f14a65cb27076579b77666aa40f9763
MD5 9ecbed8014801b035101963ac5db06a2
SHA1 c0f25ba7b7855afb80c044658fb4a2b1bf6f6744
SHA512 57ca235c213d5fbf092a86a76127e0a18fe0ab06c95c803ef47c9bab35c29be675b1289f3170cbf1c4c60e6f68b120c31b75fc3cc89e0cfa7b0b88010d8f7a75
SSDEEP 12288:4eBNUbTVO86Uq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4JIUjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FA65CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4adb7bdb2bf86c485b7940af937a6256c5f65f847df5ba9fc4f19069abd43b03
MD5 b2e4282b99b89fb776d782e7577542a6
SHA1 e26ad28feda3d4e2e1c4257e35a482852ca76c33
SHA512 69dff6d9756e4b816c51d2bae7938686ded76cbe25e1516e781d228307061c6366e245b1937e96c91896ae6e459b465682456384f4240f7bf7b0cc1cf7a4f139
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:eQvGAdlCEL8c/yRNw5CVU023W
TLSH
T183267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 78b1c11f7ee9bc84883b9b35f38fd1b05cc746b4f894e88ff66221f000e2fe33
MD5 29e162cbdb04ae6f598f6da7aaa40e02
SHA1 fe80dea49a3a49bf2538415e78ad63bd96fa1140
SHA512 180711f2ecba84302e6c150a2d6991dcb3011616b13ed9bf445bec9c1f962586608788e6996571ceac4877a2d6c6b5ed83e9b4712a1e8e86b272e6b17c1122bb
SSDEEP 24576:vdewsAjdgXe4i7ojhsP5Lgrk1TWb4AN5:1lj4e30jaNf1TWbdz
TLSH
T13F75E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 392aba5e2008c2dedbec779f81ce492f456d8b74f9af3d91d172bb72933d08bc
MD5 c90ee4157b66f15687de2fc07c856750
SHA1 2177342e3cc53bb221e59bc480ccfc9629a1dff8
SHA512 de301a9cb65f5f4737f1bd9fdc8c52feb84f2e264320b5ad9c0bee527ad86bf4ef669d3f923898878feba6db1ce57adbade05a072f1373ca7dd7b6e69f26e564
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwp4W:EUEtQevvqc2W1cpV2EI32w4W
TLSH
T118474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 85dc2b5d28f272781a090f46a16d1a5ce8e76dcc6a5cb354bdab211608cf7313
MD5 06aaad1d100347245e3f69f4a263224d
SHA1 60541cd13cdd63c56b5248db35aa539d68ed8562
SHA512 7c58afea144bd8510101ecd0dbbc826ea5fb68d77bd97f80a9ce1a03d52fcc22ec3b2ad00c8de955224c53fe8189be67d93774f1c5e565595d054193bbd76935
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zYe30jaNf1TWbdz:foqtVjnmpU023W
TLSH
T1C8D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5cb04228c6f3aa6fbcf1d5c508eb3599a45b3299ac058b7b4ef4bf2c2e4160dd
MD5 4150d4e15f9fbe0b40a0a1d65193502d
SHA1 5bd305a41513c6179e202a3f4745d35133a3d086
SHA512 3bf71d06c656641fe3c479f57661d2b14f941aab2b8d3aa619205bb261f8f0d34d421c0773279cb32ec875967397af115a2f113582919c88ac1e01a46f2a1251
SSDEEP 24576:zAhGLJIFoiwtA5l7S53GgXe4i7ojhsP5Lgrk1TWb4AN5:zAMyFoiq55e30jaNf1TWbdz
TLSH
T197359D81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a2545f43d98f56029ca88995a4cc584671d8721b50e440b784e8b76666fc62a2
MD5 f2979f49b9348d696ffc877c8d9bfa99
SHA1 125f2973cc50bc1d469b82dc6c38e5e0bcce138a
SHA512 4fda70004063742094cabe52499a152372c5a8bcab32ab873234e77c04f49c39a68d6fa560394c0021382be86b16a4b7f91e64863084d14d20695d4dc9f12d50
SSDEEP 12288:cmw5HEjsChNVBFgl0WDm+CF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:ZwuoOWhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16565F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b3f41fa656c0740d40abba1862beaeb1ce0399df0ce5329757ed14b8cb1844ae
MD5 8a6f0a3d6826202b806530858419e6f9
SHA1 bd3800405daa1c7df6815e8ca29eb88bcd72c4bd
SHA512 2f0dfaa3859c423dfe1d9bf9dc6170ca91662c56dc1a8461443fe3ba155f7710c8179633e761a3d75e8c843c5ddb46b35cc218c39dc9821e179197543ee35667
SSDEEP 12288:4BZ1Iys0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mZu4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A755129637D420FAE29782B8D4F28741E7B13892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 da7c61ae5c987a000ef46bb8e51acb33accb3ac84369cb4b8536d78526a6e21d
MD5 b890420f5d10846467dd5bbba8f02cde
SHA1 16090d39bd86a24b7a409f14b3f35d234dcf1cc3
SHA512 b1958c6af5a42bfad54e83f865225bab7d3e2d624b80f0a0e5e0efc85eeab432002f934054fb60a5fa72505c8a02dacd236b04a22ea5ca7875969be2b3d6d226
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:kQRQyi36YOcPQLvw2gAf+PN3+U023W
TLSH
T1EF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4904be0fabdc5e8497310591ef21a0dc6a2e8f533d811cda9eca5a72fb25da92
MD5 78d9fe3cdee996f15dd03b66a9ec279b
SHA1 b7cc84f748cc653993e513a182d11940c1559a23
SHA512 d91ebc917eda0c61b219124837cdbbac7a95999fe0f1a3004610ec04c85bcf95775f7e67a6879551da8ca3b62c803226c392a687edd9a9d6d7b16f57f7fd3f7c
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:VQRQyi36YOcPQLvw2gAf+PN3+U023W
TLSH
T102667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c63dcb341751d20cc4ccc2a66fa99a8b6d11cac7af3fb6f60030dbdb8c8f085d
MD5 a9c1d19b9631a3b3a0918e90c9e610bc
SHA1 1f67625b68799f6217d56fcb87691dd9b41ba1f8
SHA512 994adad22ce4b22f78178d66b1c936e0abdcfed7e4de39d43199085605f735b09efa3c7abe4e51a8eaf787bc5ac1fd6c6600af3a798679daaf3efd3629c7cc58
SSDEEP 49152:H68Qg55nhheWu7PNU3/oe30jaNf1TWbdz:xthWRc/oU023W
TLSH
T1FFB54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d1ed4c24459fae99cda308b0f80b22b1c0bec712bdd67c234cef194f013181e7
MD5 9b8a45ac388b86e08f0ec8ef79e9bc78
SHA1 9a0b9f1b88f269e57e1151ce3a5def7d468e43b6
SHA512 a4305f12fb7a640ad2d156bef62127132016021904799830e2d4b04e6473dbb047fef828d0415a96e884be2a3ee43c67aebfb93476eec601ae7d02b40b5f6227
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk990:my5112gYy5azzVvL69nLKnhZzU023W
TLSH
T138167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1de25028904bec36d9a255ebceeb6d59885550e227f266c8de1faf99ea530a5f
MD5 e9650193a3e6996f5f751a02735ae868
SHA1 7d7dc50b040cc1fc020341a6c2a44a4ae8764c53
SHA512 670530d874495edadfb76d07ec98493d86efe1dda8072083721420659507e68452b58c8e4262edd41998c68cb035e77f5bc5dcac23a0d611cfe040b714e9163d
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glme30jaNf1TWbdz:Su6JmVxd2dmU023W
TLSH
T18DD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 880a3f37b5a34b224b7bc1b088cda0a4f83032ae7c98c84422f014cc1be6ead2
MD5 9042dc48226ad4aab9134280b69a4b23
SHA1 fda26cb1749c32c3fc25e53ece745fd4199f22a8
SHA512 55ad76a42d92394008db5a094b756e52faeac099c0d4ce3648cb686003dbcec7943629f518c7a960e01595e1953c365ab6bdd82aebf7743e7efef36d443b0fba
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4x6e30jaNf1TWbdz:YmifPbRpU023W
TLSH
T1E6B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 969a532e401a4ea49925d121b54d29f40e71c56ee0b6f391bf4f05c41e62ced3
MD5 c87b766f9813afba15c911f14e5b57c8
SHA1 a86a9f249db1ca1d18be107bc815bc1cdd2c3ee2
SHA512 7ad1c9d34526881667283b78e700aa98ed18a97e93eb8ec5395bdd2d64c3d6b31f02c02be5ecbc9c146c50f80eecd9efa16790073a1aae5d678e243e264aad97
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqPe30jaNf1TWbdz:N5dKTi61PU023W
TLSH
T1BBC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f1c39e940e4f5cbeaa1f6a156df7f7bf03632d7940c9376e80ed8ace85650d4
MD5 4c21f4697afda6d01c15933475762c9e
SHA1 ef7a8e4d11b835a453ac285d095e1fce20afb088
SHA512 5c115efdfd28ce2ae9e3c0c1c406af7838de13b423265fb92fa051a7fc2f5f768ffcad73040e49deeb8d2d5d7f1a7071140601b37f0dd5c9e48423e6ffdcb0b4
SSDEEP 49152:9htSn8EApI0figngiDn0AP5w2e30jaNf1TWbdz:sX2iyphtU023W
TLSH
T1D695BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6d9132b83cf40c7e6e997ceda0780b423a5f7eec977e80f73c7449cb0513901b
MD5 6d91d5258d993c9154cd84c191a41fc3
SHA1 0372d819991d5ba2312538fc991b59c637c61122
SHA512 fa8420563b6a22c2fff3d9bed4fa4ca774f5e2f1494f0b2569fbd86cfe142ba86ee1ccfcfd2fa57bb09fb6933492b5e7867c7a5d139b39d69fd1fb631a6cedc4
SSDEEP 12288:rzn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:n0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T125452395AE5509C6E34BC3F0D0F787C1F9E01EC272404E6B57E0B5531ABCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 984b79f920edd6f6251f336680f74328767af7809cc346346188eeacf6966cdf
MD5 36e19dbb8705d509ebca06bebf0ba40d
SHA1 4772a910ebcf228cea28d50009d51ec05a1216e8
SHA512 f73c6ab0453986d7d3290d3461ecc0e9c92caa1c909b31dbcb5b84961e6394fa0e2f8b39073166709fc443217b962b23b0cc0f9643c21d30834007374b1ba3aa
SSDEEP 12288:Uo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T124452391AD5509C6E34BC3F0D0F787D1F9A01FC272404EAB57E0B55359BCD9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ff6047805a483b4f23b19559d96630d2d0b4209510c0e242f687019401a5cc3f
MD5 c9f3495630c38f1cce44a39fea30293c
SHA1 c85e5bccdfa9a7f4e7acdda5a77f37253ff61718
SHA512 6ffca80bbe0723a2aa69744accb9957c0899add0e47b80c39203c72fbc3e9ac15bebb1024bb81f802e37485a3b15f02e9b84f17aa0cc5e12d398411b38673fd8
SSDEEP 12288:Ci0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:C7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13D452391AE5509C6E34BC3F0D0F787D1F8E01EC272404EAB57E0B55359BCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4c03509c6d3801c3584a6740944c2a7737752b1152ae010071e58d60e928ec85
MD5 65b5dd1e7e885a3468803f4d9d34eb6a
SHA1 174ba7d94b1c12bf1a8fc1b825d9d61b04326a0b
SHA512 6557de9d2837707959f2af77f1566c0d9147dc32aa699ea43da0cedf4d3eb5ba193bdb00afa7b9b9b372d617ea14db0f1b052dc5bf52af75b5cc7283235d86e5
SSDEEP 12288:iV50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AC4523526F5505C6E28BC3F4C0F38791F6F13DC173118AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eebb4d10b63410f0ea611d0401bb52cf5a06b5bf2596ef668f9bec828a7c19ef
MD5 c2868f54db8d89bdfa9d62dd76a9cc16
SHA1 1f9e19a3d7a0e5a2edae7ce07734383efdcd47b8
SHA512 c197b96dbfd7fb41929a44b4e837cc3cea1acae4be6e7a5cdd5cb995e402bee0c19a0289503fe017c16b6637408b0544488455a2457e22ee4833d132c15785b1
SSDEEP 12288:ih0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:iOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T131452391AE5509C6E34BC3F0D0F787D1F9E01EC272404EAB57E0B55319BCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 282b2960174b551a4cc9c2e968b6b7a93c7aeec3f2c11e0fa58b67b8c9e8f6d4
MD5 63812f96e3057bcc3b1cedd138852fa2
SHA1 0d0f8ca2c35334b5376599e150302edd2b72e8e2
SHA512 345ba95abba147112b5f60b0def8f10adba303b2d4fd654614a04c9039926a6f78b045739f4d3cbc295560f1e3be29b802aba3fc27bed929569f1012590d8f7f
SSDEEP 12288:A00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15E452391AE5509C6E34BC3F0D0F787D1F9A01FC272404EAB57E0B55359BCD9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 373d2a789c6ec0bd6f9ec1d3427843bdde0a48e9f0bd55738ea7f987917c23e1
MD5 46b83132a5ac0e5dcf5e829946a4652b
SHA1 ac207da52fd379466882008f38e7ceb790a546d1
SHA512 7bdbaf975c7278229534859b4f2cafac0fa1ce63626a1b99f3561619a88bd77ee4bb23e669d245d4152300f89d7d14006802206f1b545cbc4c9a11e3c07af12f
SSDEEP 12288:xQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BF452395AE5509C6E34BC3F0D0E7C7D1E9E01FC272404E6B57E0F5532ABCC9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2361f47a1f3fd5ab14fc8375f405471b513f5527f75298f730eabce5388a1f70
MD5 1d9851c5cd7ee5d60b51dce88e042e0d
SHA1 91aad0082920fac23e40c29bf2e788d536569e41
SHA512 2d29bfd2a8f8753c4ee23baa7813fb19f724a02d72a5202b245807e04cf55c11383a6909d88ee9c40288679b20e8f78129e74cdf5cb583f6689abc82188542f9
SSDEEP 24576:hZMSzFVSOpgXe4i7ojhsP5Lgrk1TWb4AN5:hZMSzfQe30jaNf1TWbdz
TLSH
T17A650195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03E436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bf29f6fb898463786ff1c3fb91bcf873ddd88c45df57a09a1d432061f9378f27
MD5 b5b595c44642b6c28342da50146e6504
SHA1 19a02417ebd57a28554c373b0f40624ac16cc7ab
SHA512 f5b03535a922d815129be319f507111af84b55466a1eaa60905f3d9f8f7efeae83812e089c6339ce051c968d52ebefeca027ba70978a1849c52c3418243d0586
SSDEEP 12288:mL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EF452395AE5509C6E34BC3F0D0E787D1E8E01FC672404EAB57E0B5531DBCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0698d8bd8248e678e5d01265d8945a5de0a74c183de3abba9914f6fd4caf42d1
MD5 d53d24ea56565bb97f1e2a096cac4019
SHA1 d7289571243cdb678e8d6db117f88ed594913d64
SHA512 60a04cbf57eb13bcd111ed867a54a64349284594e4202a3c0675e615724be522aeb33b0246353e2e84a198776fa03a1388ac61b80da538d7c54ab92589aea0db
SSDEEP 12288:+f0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+MgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CB452395AD5509C6E34BC3F0D0E787D1E9E01FC272404EAB57E0F95329BCD9A6ACC868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7978b786affe73191af01edcff897434809b3fa94a3ed0411181e41a7e01ed0b
MD5 8701aa841addd993070b4cdbf93df5c8
SHA1 489c711c9745e339bb85bff6f6b7c1a8885363b9
SHA512 eee6871f6ba76cb04dee3a201b00b2e22d4d217989af0cd3232798185b318d455224380c077af217cc2fad8e1a5655cf900c67e0868ccc3b542a656f908cbffe
SSDEEP 12288:OyPz5L8s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TzyNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F055015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 05a57c3ba9b98e217fc724416682aa92ac1c3145ff9d1c0e908bbd001788a1a3
MD5 aabb0c6491fe19126fc0d4a8d5c25554
SHA1 4ce7ecf561796cf58874b71c857cce68abb45472
SHA512 12b3be9ae0d6da34fbf9934ddd805e50fd58cd7c4fffc710c3b0b0971fdb84a7922ace80fe22b72d12a0d679f124dd939ec0bceca4bf38ff46f5e581e6707395
SSDEEP 12288:6L0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6ogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T120452395AD5509C6E34BC3F0D0E787D1E8E01FC672404EAB57E0B5535DBCC9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 55dc69256b011ca60ff39f6cfd159685a4121372b2feae15b39473782360e033
MD5 524165281770d96e513fa0240feba9de
SHA1 92104f6495c0b784e05de3e59397a22dc81bacb2
SHA512 17af1bf343d66aaa5f9dbf4001c877c40178026fd3685bc2ce778fb32bd2da3fe5a3a34e56cdfade49514ba040338e30588dc698c7f7d13d24fb79d3c6b6373d
SSDEEP 12288:fL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C7452395AD5509C6E34BC3F0D0E787D1F8E01FC672404EAB57E0B9531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d8480d90de4b7b41c8f454a99492fa39fc5c951280745a88ee2ae65b79401fa2
MD5 b4d6fe119b7b7269999abef762da337e
SHA1 4f172d1cf8a6ebaf299ca766a9248e64c9b60220
SHA512 fde5e89a578f54c678015db568a8de622a2e9e6b26e1146210c35b26fd0f5791039335d34f810669ba5f2d1669bda99db0800e0c3ce3503ee7fe8406994b9077
SSDEEP 12288:syPz5L8s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1zyNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18855015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 eeda68f384aca22f298c1ba59d0824f29cd124653ab0e344c6af53cc56782cb8
MD5 fd506eb8a98c87f0bd3672b4798dafed
SHA1 0f058cc3c62d70c76e5e275e766d97be12dec22f
SHA512 ea0a8eecc30b96d33e1446e77800b587aff8056ed098aa5c713e147708af27fb554d6066c44e968cc38cdc124fd58b5db38253491f80a0ba81eb3d41202948bc
SSDEEP 24576:bcP4mcvIjkGOxhKP2l71nNKbrh/8KBwgXe4i7ojhsP5Lgrk1TWb4AN5:QP4m4IpOO67W8KVe30jaNf1TWbdz
TLSH
T16765AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c2d253949e93735beadf314a6911508aba4a1cac7487021687261a48ed184ccd
MD5 ff326cb8a65ceff6ac1126b8a32472be
SHA1 20674223e2298be84839ad781b607d20b87b3f56
SHA512 61c8119cfcdbc86527dafc307f336eef674a9e87ad902e0466f9efd86eff3ae10713a6589dc748250e96213123eb9a6056c2d0aed5d89c71a8e4f5bced26ecff
SSDEEP 12288:VNsf70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:q4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19A55F15AD29802D8C15E92B4C3968A81F3733C5193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8b9fb3d66eb6985a4c937c44158a4d11aab681ba8a755fcd513a90d2e88f3b53
MD5 a1e28d145dc59b6d614b24e53010e3fd
SHA1 7b5a18b5391c8ec2a1e28f616f8b5c61ee620fe6
SHA512 02981f1e21f7df64651d15d9584f78243855c2d61cd300e547951f27bbeb8eb2e75936649da2dd78cfce34cd4d391efb42f426724409b0e66daf637f8346ccb8
SSDEEP 12288:Mb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EB4523629F5809C7F29BC3F090F7C760F5653FC12B008D9B56D0B66319B8CD69EA8929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4c672b93c26f7b90b439a83bd4e10ee306b0e6177c7f3aae9896c57eed359d32
MD5 14d9ff1b8e09f77bba4ab0d29a85980b
SHA1 9b67aa3d947021835e94b86c8d7646664b14d97c
SHA512 1cf378b21da973b1e2dd1284bef316640e4c18f33337012c5d7a769d058194b5164c5633af6883cbea56b20e87f72bb4500ec6fc831712de79113ab2358bb684
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQBe30jaNf1TWbdz:Ra0hNYG4JwwU023W
TLSH
T1D585AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 015b3c790d57c4c3ee181790db9c9b44f028571ffbe372e22461d4b51fd35b5a
MD5 6717e7c01fe2daea3d0165213f21b8e1
SHA1 022c6d85eb0e2b5f575f7f64a8bc3601b3e94084
SHA512 6b83627cd1fad3e0294b9b6c5d0c417faf848eacaa52fac0439ed7771593d8a99b3254e92a04acef73177bab5cb78c15dcabc1b2028420a34bac9a9517b6707e
SSDEEP 12288:ShbHjfXY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ShbHjPZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F055127E2AAC10C9F276D2BC91E28646D371BC51271187EF13D1927A0F3AEE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a7f6c8b1cb86a8c61dec7399607a53561ab7e4025ecfd27e2cf3d071778439db
MD5 c4f2bdbfde68ddadfe5f523bd77eee06
SHA1 750f01c73bc249bd3349c0d0753b04528eb542b6
SHA512 86d10b696479f4e423fb5d9d821aac5d45b9775c6ba5b7822720e8d9a729c15cefb06a3c4ead140055f7ee6ab2cdf237a6b98bd27ae60dc0ac1d4d38b9bdd319
SSDEEP 24576:O3YgnJcRTk4yti+R5dBR/hgXe4i7ojhsP5Lgrk1TWb4AN5:OIgnaTk46pBR/ce30jaNf1TWbdz
TLSH
T1DE45BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ce819e4077bed669ee29ab03ad41e6f44935cd48646c593f7322f594ac0fc066
MD5 e93554ffae82d2443570af27a89ce0b9
SHA1 9f99b0d6de8c457004659ef88653dbdb271217ea
SHA512 5fd3cab4a2448a94b9287e16fd7a90e2ffbfc445c8cfd313d7e4d6b4440e5e666e80f14a15c440caa9dab2c4dddd58f6df79e94872e3d05d0aff46475c98872b
SSDEEP 12288:qv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:q8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17E4523959E5509C6E34BC3F490E7C791F5A02FC133014EEB56E0B5531ABCCEAAEB8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 75597758d2098e75d01f530be8159bb30caa0782bda76569bb2cc650cab9f721
MD5 9943278ccad893e76a6a4e5ef1a4d8d2
SHA1 125eb091444c8038a610eb8b71ab31d4dcf051cb
SHA512 0a8fd8584f4a41266409b3dc9748b89edc02d9670f0fb4a4ccf00b370c2996c7da3646e3132fb127234362673b3c2831aff9f12b28917833a0afbb2c1deaee76
SSDEEP 12288:YOb9A4LWOsvAYFTG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:1pL3UTfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CB75F155F79400F9E96BC17CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 dae8ed06e85b66e2dfeb8e3d00d132a8efe2b3941d999661a082707c52c6c022
MD5 d58297c6c08b90c955cceee18d30f61d
SHA1 5728ebd1aa467482e95e9b9ed47d403218939578
SHA512 a259d2f1ec8336596a5d6bb3401e13be4b3fd807da9803ca4e2a18e271c3c13d9913457b79bbba1f4a9b2e64e85cada288f945ed2bad08d5a1b8de169852d278
SSDEEP 12288:ApFtpOK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CODgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17A55022A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 362c341024db117e8daa2957a3c5ebe3eacd52e61d1673863573442f9a27aa6f
MD5 0f374738d46747b4629fbc9bb0300e2e
SHA1 e0850ff0aa57943db4b422e0260c534a58f67d72
SHA512 da20275d521f94d9e8330d45d1a5765ed942463e115aba002f581f8c0b05615f9ea264ab47abd6d73196a33552f43a4428d67d92ac8d59d901e970eefb68b9f1
SSDEEP 24576:y7NM9YqZqmWMUkPjZM48Mv6bEhsogXe4i7ojhsP5Lgrk1TWb4AN5:y7cBWMpPjN8DbEhEe30jaNf1TWbdz
TLSH
T13D659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4e019b52f38ad37d28091cff6bea9e1cae557348cfa7e093f31935e31036d974
MD5 48a22501f41843df94f977a2745ffe3e
SHA1 cddea290b1a245554d6c52bcd945c5a84055ac64
SHA512 03fcdf98e5566517e8ed1a53ef319198782d6100dad6620a038913d582a309ea1d1743cf7e75fe8fa77c634933145fa12c2199946f388b72c181b97c2c5e9493
SSDEEP 49152:tF2YuHNETovAvNYf8km/e30jaNf1TWbdz:46BCf8k6U023W
TLSH
T1FC857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3e2313622ea6150135e0ec53c1bc6c28ab4ed4f7c9b8083b82035d51fa3b7840
MD5 a58d7ad17a52efe548eb7286baa77c50
SHA1 f931fbed25ae8ab0b67eb34c4f26640bd7584b12
SHA512 9b77dce673905311138dd95d96bca916ffc4a2b27ff280a9972f36ee7b7e3fa1a2189b587ce588448a6e9f115d3769c68d642e6152a8b54eddc5d4b86cbce4b5
SSDEEP 24576:kAFs06+Omlf3NXEbToXgXe4i7ojhsP5Lgrk1TWb4AN5:pFs060lVXuhe30jaNf1TWbdz
TLSH
T18065BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 362d92fdbe0c7cbabd61257f26c3252e228e0c58586c4a98ab530e108b99f3ac
MD5 d65cf44a390e587872df50068ac9c516
SHA1 7f48b2bcbcdd204994f657d28ac55e5686c7fd86
SHA512 462afcb3eb9e3e7db140ff75e5dc906576fe57f1e4ecf35a1d656c25a871c846d8c2fc0777e8eb60a010b190de5e9898c134bb9fd7c703acd4e6860506d7e439
SSDEEP 24576:jJnJ5D3WXugXe4i7ojhsP5Lgrk1TWb4AN5:jJnJ5DGXhe30jaNf1TWbdz
TLSH
T15275D02DD2A810E8D0B7C3B4819A5795FE72386D2F226ECB14B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 654e2756668591f0be65471d61c6eff22faafcf3c3084d48841d49da3443e690
MD5 30f248d83c418c6b6c1df365f2549019
SHA1 a7c49728877acdb865147d90b6984642ec4f7686
SHA512 c683dc1007ae0b3802e1eacbfdd0b35a15020e2ff29e8ae9efe4374fa1196c1eb15b5db853722c9a46d41ddb240b4f1133c83706615678bbe0a422891a79f306
SSDEEP 49152:kg06DIKdwc+eQnSt65aV7e30jaNf1TWbdz:V9U023W
TLSH
T1BA955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 eb68e10b2e3c3fd9f82d597f8ec924e099740a294d535aefdb43b3ba6b05cfd6
MD5 c31efe7ae706a8baaa9061740082c556
SHA1 e72f6dcbc42b0cdfb7c0005d0f0de8f6abfe4074
SHA512 a51f177143474f288901a47cad63b88d68792e79860f62f32d9d3fc69b6b5312f402a5f6c63a10849205df18435f939cb0fea0ad7ea5ca0dfe0111f00a108e1d
SSDEEP 12288:CEP3RnF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BnygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17755126D6B9C60D5D16BD17C91E28741E3B2F4A127011BEF02E0D27E4E779E96E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 d4f539444c86f7a65c6d362d1f75655cbffe670234590adda88cd1023a98ea2e
MD5 956f58176e52eaae5f563d126b46496d
SHA1 6400ccae3e4145b5965871e729bd4ae101932389
SHA512 81cb1fdd22301ede0dd82bb4f60b10182e0d1e3ec4b919300a24f54f88040e2d82b0ff24ca720a45687bd77aa01db30783a3999ea4c758b5eba767c42c2fa4e6
SSDEEP 12288:Cjkyo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CIyJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T100551204679454C5E2AA82B8D5F38390EA70BC602B1087EF51D0F63F6F7ABD4AD78B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 460f3424bf4072de92f6579fc7403e579fc4a53c03e0733f9a7225fae12248fe
MD5 dace193bd3f5e274cd69e0fb32862f33
SHA1 0142295c766666e450351248efce82f969ba4b1d
SHA512 444409f9625c2494f4aca7e271c13610b09031618f981c5b0a6c5f1820d4106ae7a9b2125f5bbc267e74281e18ed01ebc4f0d2321a9e7adf0546b5bd227812ce
SSDEEP 12288:mya0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1574523595A5519CAE24BC3F490F78B91E5B03E9137004DFF02E0F6734EB89DA6AB8C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2bc9a0e4f152cb581d3d8886b5403e8424ae56aca10f8e5cb183bc36a90b405f
MD5 877dfd01456055f15e041c6ccc5c7415
SHA1 f047ddc4a37dc98671ae68ecb266e62a57bf7f54
SHA512 36b493efe8951a73efdf1032788ee03f82f8bd45a5a83f9121596e14f65acdaa00eddfff8c4c90ddd0c96efa4df449eeab449697ae63e576140c8890df67e440
SSDEEP 24576:8Q9MxZKdcz9dw3AgXe4i7ojhsP5Lgrk1TWb4AN5:8VKZHe30jaNf1TWbdz
TLSH
T10B557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c492c0aa818ec517db0230ea2e7eabb7eaa9ae096ef6da356d0668e1e193257f
MD5 3a53ca25dbe8fec3762a0f5f265d1bc7
SHA1 207ff03d06d5fe184b861730780b29c216859fc4
SHA512 07005b3436d8f423e8e835f42c55b29a638eaa00f30c3bdbf58bd3af6a157fe85dfd86a62d502fd7beb4d92f5c5106171dda80063db21e18f4185d6370211ce7
SSDEEP 24576:DyocDApdgXe4i7ojhsP5Lgrk1TWb4AN5:mocDAp4e30jaNf1TWbdz
TLSH
T19365E01FBB6900E2E166823C88868745E7B3B4702B5257DB52D1C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ca936396377a737e75977d4f591c9a1bd947a2fe0cd12de15d5c29501b3743af
MD5 e69ed29acd607737555bf35d02f4aedd
SHA1 adb898a4adfb7f829914a49a63c069939fe1a9e5
SHA512 6902748a696380fb666c04161b741f821926990a04f22379f25823e4ca481d6e89f942141b7f659f938557e6aa2554b48a6d7c248cab2bbc68bb7e7d04ba6a4e
SSDEEP 49152:ZWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4e30jaNf1TWbdz:B0zuNI2U023W
TLSH
T15BA57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e07bace1c16fc8a3d3bd5acbc80c4bf355f94f05b5401a17119d927c11fa0f08
MD5 07c7410cdb3b7824f57c24ead8e04b56
SHA1 4a49d867d57bd792d170130b624af51de35817c0
SHA512 a6f01387cc10a38bb88867603dd64caf50d16a264bd0f213fa5fbb5ebb7677f08dc2c64dda0414c148b52eea29d44a254ded9ecce072c39c3e5fe500f6cd438d
SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYtjMqbygXe4i7ojhsP5Lgrk1TWb4AN5:CTDxR+N5YzTfjMae30jaNf1TWbdz
TLSH
T16055B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 70ba449fadf8bed06f956a7de8ad5a0a80f35b5f4df5b68467959be7f2d5b89e
MD5 53c114e601e026444f307faff91e7566
SHA1 1e4bbf20e0fc3ace48c4f87c2eafe53388140074
SHA512 b7c93ba17e8c17a44d05fc38e203f0f3cb4f851ebf170645cb3946c1698068055693167b225e7b0c18c14875812d4044f4b2e0165ef8f39c0573d9a1fe62e1af
SSDEEP 24576:ATMdOz0FFS+imSLmgXe4i7ojhsP5Lgrk1TWb4AN5:o0K+imSLpe30jaNf1TWbdz
TLSH
T16575F17EA76D04E5E17BC27CD6938A06F672386103116ADB06D0C17A2F6BEE4793DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 8e870d2bcc18fe49b68576e7ebcc62cc1849c02a2eb2a8bec6d735ddd3275811
MD5 bf0572d7c3add8f546e575a174d1db83
SHA1 4084e2677452de7aeb5b89a65659e9b2b24e711d
SHA512 ab35d891617bedd3d5ca6e8e68c4b486f1bd7074e7ed88336fadd889f89467d16be170eb2b7b54388e90c96e340eafa2049f205cb9821fb9ccd17b62c95b0df0
SSDEEP 12288:64KG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13755121D67E824C5F167C2B4D2B78341D6707CA223104AFF26E0EA7B4F7A9D89978B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-158-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/612-351-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1736-366-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-357-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-395-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-396-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-393-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-392-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-394-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-391-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-390-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-389-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-364-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-365-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-367-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-368-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-369-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-370-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-371-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-379-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-358-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-359-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-361-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-360-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-362-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-363-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-388-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-387-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-386-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-385-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-384-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-383-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-382-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-381-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-372-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-378-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-380-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-377-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-376-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-375-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-374-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1736-373-0x000002675E470000-0x000002675E480000-memory.dmp

Download

memory/1788-122-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1788-161-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1788-128-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1824-173-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1884-82-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1884-88-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1884-155-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2572-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2808-171-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2808-354-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2808-349-0x000000000C8F0000-0x000000000C8F8000-memory.dmp

Download

memory/2808-176-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2808-208-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2808-192-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3232-154-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3232-72-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3232-78-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3268-157-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3488-166-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3676-100-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/3676-95-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/3676-156-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3792-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3824-33-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3824-348-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3824-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3824-39-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3848-160-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3848-117-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3848-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3960-170-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4520-65-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/4520-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4520-61-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/4520-55-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/4636-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4636-23-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4636-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4692-14-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4692-333-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4728-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4728-250-0x0000000140000000-0x00000001403B6000-memory.dmp

Download

memory/4728-0-0x0000000140000000-0x00000001403B6000-memory.dmp

Download

memory/4728-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5004-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5004-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5420-353-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5420-167-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5516-164-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5728-159-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5988-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5988-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5988-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5988-352-0x0000000140000000-0x00000001402D4000-memory.dmp

Download