446e0efa4a5de1e3193afbdb65476a2a626782b1eb11c993f033dd08ed0af57b

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.7MB
Sample260427-rfp2csds3v
SHA256 446e0efa4a5de1e3193afbdb65476a2a626782b1eb11c993f033dd08ed0af57b
MD5 a9a16440693ff9e277240a138dd95c58
SHA1 a29ce21fb774db46af045d3ccf55ebc67725a3d0
SHA512 9b673550d04ebd9be72a8812ae5549149ba46460b41e692488671e8626ddcbe67ee94a7aec7804ac7dc44896ce477d8072fc19e9494e7549ed9f5c64cda83b1f
SSDEEP 98304:1GU4WAJ44EHeTD9QHy+diKHcpm6+U023W:1L2XEHe1QnAK8L+p4W
TLSH
T10A06E187E66C41E8E4BFC1F4CA16494FEBB27C678520824F329576971F932519E2BF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
328	alg.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4876	fxssvc.exe
4224	elevation_service.exe
4680	elevation_service.exe
4360	maintenanceservice.exe
3960	msdtc.exe
2988	OSE.EXE
4104	PerceptionSimulationService.exe
2080	perfhost.exe
4688	locator.exe
652	SensorDataService.exe
2020	snmptrap.exe
428	spectrum.exe
4000	ssh-agent.exe
412	TieringEngineService.exe
3280	AgentService.exe
760	vds.exe
3592	vssvc.exe
112	wbengine.exe
3536	WmiApSrv.exe
4756	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8dbb8a127932a944.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\java.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004568b0e266d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c835a1e366d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a18c1e266d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ac34de366d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003d136e266d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4604	DiagnosticsHub.StandardCollector.Service.exe
4604	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4876	fxssvc.exe
Token: SeRestorePrivilege	412	TieringEngineService.exe
Token: SeManageVolumePrivilege	412	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3280	AgentService.exe
Token: SeBackupPrivilege	3592	vssvc.exe
Token: SeRestorePrivilege	3592	vssvc.exe
Token: SeAuditPrivilege	3592	vssvc.exe
Token: SeBackupPrivilege	112	wbengine.exe
Token: SeRestorePrivilege	112	wbengine.exe
Token: SeSecurityPrivilege	112	wbengine.exe
Token: 33	4756	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4756	SearchIndexer.exe
Token: SeDebugPrivilege	4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4340	2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4604	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3232	4756	SearchIndexer.exe	104
PID 4756 wrote to memory of 2044	4756	SearchIndexer.exe	105
PID 4756 wrote to memory of 1004	4756	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_a9a16440693ff9e277240a138dd95c58_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:328

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2860

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4360

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:652

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4000

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3232
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3052 1656 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2044
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1668 1664 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2991a0905df62119ad403cf4f218a8ed6fc8288d8761024f70f8a5934c2e92ee
MD5 cf7648f7d7cbdf04267adfa84a5def9d
SHA1 30de39a4daa8771a89861f99b29b466017127c05
SHA512 95f9c8608999db3dd820d14aa6680a798a2b9977e35a61cf1f06ece84c587d40788528547fa7aacab845266e5ac50997e770cd968ab72969e674ab2c246fff0d
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5e30jaNf1TWbdz:n3q6HjBEU023W
TLSH
T1EFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f1dd1d1bcca8db4b826ddf04268b5f8e8ab4d52d15382c09fa0ae0cd6938dfc0
MD5 70f61f02b5879b7897d67612e681c146
SHA1 c02345bf5893ac5ed304cb1ff50e9ac835b606b8
SHA512 41c94561a211856878a286eab210ae2c3d19d8f7ae01362bcde61733d894835b9633ac53c2d0a8aac3603575aae2fd57f1e13a43ab44e6f68af596df9bcb6717
SSDEEP 24576:iXYfDtczAtgXe4i7ojhsP5Lgrk1TWb4AN5:ptcne30jaNf1TWbdz
TLSH
T19065F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 35e4bca6f6e1c67f686735818a8d0e7e3fa451764945c8c51082208bcdce481f
MD5 b1a39e2bb5bcd0038e5fb54608325ae9
SHA1 ce8df31ee9143b001c1b0b46b2b5bb93107e6568
SHA512 c750995e6610ed1bf1a0182634ff599c76f03d612db8515cc953c21d0ce009fb132e8b6de2354c0329544a5fbdc4dbb8642253ea0f91e643befd99bdb97e7330
SSDEEP 24576:00Le5ji0hmxirMugXe4i7ojhsP5Lgrk1TWb4AN5:0Pji0AcCe30jaNf1TWbdz
TLSH
T1B285AE26F6748775D073C0B9C5D2A68AED71308217308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 406dcf63041968ab7c719c89c4c57353a6fd9955c494bc17885689e4538018b9
MD5 9b060e275b13a6199c55f7cd74312101
SHA1 f4422f7f536a87b238664b14cf7abaf6e00e8a88
SHA512 e15b3fe5f8f6a8cf6b88bad26ebf90538f32aa8b1638a9db16a2ff4cc8605f98dc1e433e9906ffa6f23be6383c88364ed1633f44b57433584377b3fffef22b97
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuQgXe4i7ojhsP5Lgrk1TWb4AN5:L/ezSC6vUzPvxHjyme30jaNf1TWbdz
TLSH
T16D756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6e281cf9cb6c8209883b9f9a6b70988a72d67f10d4ee5c673459b995968e779d
MD5 aba87dc94659842484a418ebca7ab9e6
SHA1 eaeaf2a71e68ace9aa3fe6094819ab1eeabacf8a
SHA512 ef4314a39c7dd15586ae81061f490623a9f0d7a6dd315499c6ed9d4de1a5ab74e9ab51b87b4f1fcdac9d69d14aeaf41d52e100262bdc739d9ef8ff9c514fdad7
SSDEEP 24576:XVbqPb88hv/l+6pgXe4i7ojhsP5Lgrk1TWb4AN5:XVO88hXl+Fe30jaNf1TWbdz
TLSH
T1E4559E66F5748331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1a03cccad5169877ef0c585b0eca4fa2be1420d4b62e8f09cef50ef25e7de13e
MD5 7c5a064a4b35d685f264231f259b9f21
SHA1 1fe8386a49ddd130e5cb5b48d62ad5d37a0e400b
SHA512 99e7b282ab3144af5d599067bf3b54fe037ffdb3fbfe2b2e862c8fc950d54e797db0f7ccdc1dcb17e1a336f607b1c6183965f547131503df4eaa7e5622621f25
SSDEEP 12288:6RN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6RagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E94523919F5409C6E38BC3F0A0F7CB91F9E11EC025448D6B47E0FA9358BC999EADC469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 69293d6203a6d15a78eedb67c57d665b699a274e2f79e65c858df20edceaef16
MD5 cf19a30250bfe3a0565e268a38ccf91b
SHA1 c67186200b8b1454e7daa51a83f596cdd8df4929
SHA512 41f972f75169e25463dbc4b4cfd67655463c2d513438829518dc22e73284cd050f0ee2032bb519877691f3e17389cf47d16083cdf5a38960e7f7c0f0813a8e6b
SSDEEP 12288:KeBNUbTVO86Ug0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KJIUhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10465CF3BEE28ECD2C27E8DB85691C740E7B278704B5193CBD1A4820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0f784e06d7860e9e7952906acbd4c8e07f0c171d275a8bbb89be20dd099bc47a
MD5 54d68d77bcae5e4253de132a7182a999
SHA1 c94e9a5fdc48c8318f98d482b3509b5629935885
SHA512 9b740ee22078c117972e87b843ded6563e72e0caabec31b7cc4c52a5424f221de287f2c4f492876ad59b3c451591c24a14f935b103b2034c81dc93f5aa162ba1
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:YQvGAdlCEL8c/yRNw5CHU023W
TLSH
T178267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7ca9dd53b95c3111850d6e8b4da0c4c245478d6452970ebf7f351333af0fb3b5
MD5 c3e2818b8442484f0926a5d09c44d93d
SHA1 2243622646307ad9f911f295266bfac35ac143cb
SHA512 8465c4634d8adc8dc6683192e3fbb694490273dd5b97c3a09a02431f2d0c93d9dad976be419eedc5f5d9770ff651bd6ae700cc62df5c07243a934ad9700173ea
SSDEEP 24576:MdewsAjLgXe4i7ojhsP5Lgrk1TWb4AN5:UljSe30jaNf1TWbdz
TLSH
T1CF75E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ada6024ea39ef999f45108958b480bbaeb68b127907823f380d2f93b4c2319d
MD5 76cce36008ae11d893de54455b411e6f
SHA1 85586af166ed17cd0d1c95337d2f533c7a1a4ee3
SHA512 bd820244ff0f926a8b8c7eabc8b2e8aa9bcc9e205c4e8db56e3e21e1dc25915ba9c3149c75ef645fbb18839d318433986771f9e31328193baf9546b4a290fb73
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqp4W:MUEtQevvqc2W1cpV2EI32S4W
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cec72791c4e95bb5d11431259bf12e5c82f1359f606aa5323b16850e944379d0
MD5 220d7b38504d03cfd11fd7ca7abb11b1
SHA1 500ba0eb71df25023bbf93abcfc96511b0075f1d
SHA512 5d97c0d44a2d65a84ad45db8f1730384d43c1d6fad27a579a1289cd79879eeb43b4d68e1065f428c590c0eff1cd937ce4a19c0a8ca582faae82d30b255cf2c90
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/zye30jaNf1TWbdz:eoqtVjnmbU023W
TLSH
T13FD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a46e067300129ed295f067c395e5844b3c95caf9afe9dc94908688c1a0063f74
MD5 ce25111a8e69463320862efd7cc78537
SHA1 cd4ef04ffe548e6464b6080b22f7b3d4fd53a94e
SHA512 ba46c99a55a5edb55125d1d1c1dfd5615444dfa60ea79cf799bc8e635e7a8f3205c829e3f4ee7eef2fe3aaec91c33f483287c3866412b96d54aded4428984621
SSDEEP 24576:2AhGLJIFoiwtA5l7S530gXe4i7ojhsP5Lgrk1TWb4AN5:2AMyFoiq5re30jaNf1TWbdz
TLSH
T129359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9eff97646b7fa03bf6d183778ad3c3d3a08dc7f5356e5f19cd8409e21b7f64bf
MD5 15a7e84d4fff207533f4343dda8fa04d
SHA1 20c55e343de7e72edb596529a3ecd560da225c89
SHA512 c192ca527894700c404adbbff0889f966714ce111513982c989b3cc7bba2b43209f5717d5609ee2af0ac0c8cbc3aa4d62ab010ebd50e3ad0298207c9f458aebe
SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+Cz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:rwuoOWPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DD65F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 90e16a6d7d700530253cabc3c966e6e57bcc54f4d612f1092b9af01a256aef5c
MD5 a0bc67f3c8d60b9889ddcfb1adce0fe3
SHA1 c48c0f05d7630ede0d3c42a0b48e83d461f99149
SHA512 72b7ae0ea2edea95235083ed43f344508591befceb999b537305825cadc6b16185ddb7e5598a17c9cfd3c8f705f611913a01ed5fa13092bf91f9c5574f33ff63
SSDEEP 12288:rBZ1Iyi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FZuGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14255129637E420F9E29782B8D4F68741E7B13892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 72ca8aec42b7374fbf69c5452f5af7378cd4ef49c48136169deb7eb45bc653af
MD5 ef47ec126a22edebdc61c7a8027ff388
SHA1 7e78ba0cdc2e56d33b147423b05df8ee9d55232b
SHA512 56e630b0ac90d8bfbdbde53f6e19ea31005d371d2e29235767bd27120ae6db642117966fb50465344bbaa77b8375daf40607a54a9f9ecb8395f7cf5e182e6b46
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:hQRQyi36YOcPQLvw2gAf+PN3QU023W
TLSH
T1B4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a951fb5a0c64b35623dae5a397beb2a8fa417a1447b6f9fa9f48654bb71f45ab
MD5 55d734483a98a2da5e1e222a2fe1d70d
SHA1 61de80af082181bd956da873d0728aebe85969e8
SHA512 c5ab66660ab7c2fe617a2e72610fb1af45882d8160298f3de9d503a9ca076eb8dc6c4fd12ab41992de000f9ffa25a9191e742ac6c74a964ed40f00b82685ccd2
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:0QRQyi36YOcPQLvw2gAf+PN3QU023W
TLSH
T110667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c990879b5ef6d5d7ea69dee3976c8e0f98c02bcd3e44b4eaa083d5b8541f8fc
MD5 1e6d2e877ba228cfd901f5832dc2d116
SHA1 642cd2751bfa4050d6ff844482a0a56772c0af2f
SHA512 4a1b6e9ddbdc634f9ce9aa064c5a39ea03fb20c2b6cd00639c2734569d0e11e501f60112eb42a56483bbdcaf17db53c755c458af9a13142daee468eb61833812
SSDEEP 49152:f68Qg55nhheWu7PNU3/Ce30jaNf1TWbdz:ZthWRc/CU023W
TLSH
T1A6B54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6c55adaad49052e934a04ae3d8e4fc777cf04c47e5f438f1c22a6494d9e8a0e1
MD5 e6d1a9e6fefb0ec46f906fa8d6dc63f7
SHA1 ae69103e65eb04cafd648e67a681403c1c6f2993
SHA512 169042fffaec7e115cd312f79806c1ae9876927618dba946af8325ea615c5690e93c9e451a17682de05adbeb8664b708a1fdf31656ba30241411ae2ef3f891b3
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:ky5112gYy5azzVvL69nLKnhZdU023W
TLSH
T119167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3b9ddd6571c5b1204f2a69c880a6b50a5288907bd6f7966344b5931c51810ff7
MD5 a9aa5b8036fee3b34369b4142bd2dfba
SHA1 517b3a3566758c87fcbc402dbfa8800968b6df82
SHA512 6d61d3c59db60a87bc79bcb2135cc44c909b488342e3ab9b2ac02f663aa4bea8a9e30025477c411bd343a5fc32ae63a9f93fb6a95ba722ae3a98020df2ddc9cd
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glYe30jaNf1TWbdz:/u6JmVxd2dYU023W
TLSH
T110D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 072037b0b0795befd5e67bd396e6d5e58b8248bb23ae42a42e23655c2e9565bf
MD5 3e91dd73f6197deb545573978eb679d4
SHA1 72e47f779fcec38ba4ab009bb49404b6d2c0b3e5
SHA512 b843c9ed67dd1b7a498828c6dfd61edded9f76ba71133405c9f12b3f9d4252b5db3660b46ba4fcac7a361f470e1f77c72da9fbe917b8874f16780fbc17451093
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4x8e30jaNf1TWbdz:omifPbRbU023W
TLSH
T117B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 937c9468bd6b15b0d564c0f11efbb57d948da3857ae21c43e27d1ffb32a39edd
MD5 a52042d5f08180e287757d6575ef58a8
SHA1 5baa6e74e8465682c9da2d6ccd17f312e52b2882
SHA512 1a5987fb512a30c8a0f4cfea27b249341a1e0e0513f7bbc5430288014caa7a5bc58d69960eca7743177a2362a26988458ab46c4b75353845a23e895e2f4c0e0e
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqJe30jaNf1TWbdz:e5dKTi61JU023W
TLSH
T1C8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 09b141f53d8f8b70de4aa67e325eb81f721ef9d63a038333dd86789688f3960b
MD5 ea002823a861b9bfcbfa02f4754291de
SHA1 2767f543d31aeaffcfdf5adfb8e5a4dc19e69492
SHA512 8d22d7f41f5801400b285b089a606daf3c7e1f7c6472157ba2567ca727eaebceff403d58f1b062a59c27c823e7c004dbd95168d6bd03ccf55734cf1cd36c0c82
SSDEEP 49152:4htSn8EApI0figngiDn0AP5woe30jaNf1TWbdz:pX2iyph/U023W
TLSH
T1EF95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b998993e0f27a0c3ecef3af46d2bb45ebeb51ae6242485bacebdf364be09399b
MD5 8bbe792a875cf32a57b5dbe4dc0b5bf6
SHA1 f1a327fb4ef6dae6e540c857ffdb976af0c4fe6f
SHA512 1cf9156283ce0ad06bab9ad4a3fb8ef44cf4cbdba99b674203cbef5e35b79e3ce36c8253cadc123730b1ebd8871c0ee7203d70f3e698748ef6bcadc8a3ae1541
SSDEEP 12288:el0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:eSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T190452391AE5509C6E34BC3F0D0F787C1F9E02FC6724049AB57E0B5535EBCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a04eb9cbcc9bdacbfbf7344e7dbe03d2723f96968a92bdc20378ea380974b42f
MD5 552771e14533b32d4cf9b9d36f57ffe7
SHA1 bdfd64d0b0afbb520aad6698c091c265bab99e01
SHA512 7e293ae158543c6d30595e61f673bbcb9453141abfae096dbc90e5bd5aed3638dda7e9a1bf14306a9c3b9c47dfbf58de0316cebe5065a1c0deb219f84f3ce849
SSDEEP 12288:Ve0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T182452391AD5509C6E34BC3F0D0F787D1F9A02FC272404DAB57E0F9535ABCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dca3d7510d8b15389c7543ebae7ca0bf1e7b0010a8db0d26b52cafe353dcd41e
MD5 ee43414b643b70aa403bbb543bd9e8ef
SHA1 3403a9f18ae2e24f68cc5aa115b7edcee7db05a8
SHA512 7588341284162a10834b3a4ca31437af42c234e0f977e38148944600f6b788be3fe9720e7e497b858cb71ef4dbe001c38b27fe7dbcd179491b60df0c4edd0904
SSDEEP 12288:X40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:X5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A7452391AE5509C6E38BC3F0D0F787D1F8E01EC672404DAB57E0B9535DBCD996A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 00f4454a7620a9e39937509d6f3354b340e24d4606092480e80501820e9eb723
MD5 4a3399a8e796e55fa59870f1d76c64a2
SHA1 cd674f20bfa0d69243ef463d20b46658d6dfe64e
SHA512 753644f8e1b89fc0d64f5a340c407f25f3c73fbe8e747095bf413e6713507e477210b3dbc901b0c1bee0168753c9510dcca74a46c8214d107c57f49dc5d62f50
SSDEEP 12288:kVH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F04523526F5505C6E28BC3F4C0F38791F6F13DC173118AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ca2a1473b988b9338fdadc4e9126ea04e6bdc6b874232f964b19c95105bdc60b
MD5 a3f147788faeb3e25d56bcf8621c38b7
SHA1 e99430af3f5813069331e86c7ae7900d6df847f6
SHA512 8cbff794e4cf53070a07f6b1c66e7bec574a0b7c2d4e8d6ca3f9606b02eb0d3614a4f054b9658e32a1760303d88d257e2ea4fda4dc1ead103be1ccf973a6f03c
SSDEEP 12288:5v0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:58gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19C452391AE5509C6E34BC3F0D0E787D1F8E01FC272404EAB57E0B5535DBCD996A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 18ea2d4958df015bea4a8f65de085c4986c4534fa7978d11ab14e286e8e43380
MD5 03be3e8726ecfae7f41c0ce5eee63c3a
SHA1 a21a80ca99d4d9d92412267a964615883e443022
SHA512 bca7a93ebe9b2efb6eea979e4fb346a42c9ba49f43cd2ab4f28fee7c20de8221199d257da115f9855f6db0ab36fee44bf8cf0dd51a88a7ebcd72e93ca12d7138
SSDEEP 12288:zK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15D452391AE5509C6E34BC3F0D0F787D1F9A02FC272404AAF57E0F55359BCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 81e389869374d634175b01f9ff3db1a4e3799bdcf6e2dbcaa4d79403ba63ccc4
MD5 1ea7c733ca5a686a5b9cb263fd292458
SHA1 389694649ae5716d700fab0398fea31370b8a7f5
SHA512 1def40ccacdbb57b9fffa64c7b3089f6a46b299e542c7b222e1d904aab2957ab7e3c9ff5d515d9fb5dbb6ffe754609abbf0baaba49bf9a6c957de66fae6f19cc
SSDEEP 12288:8G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8fgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14E452391AE5509C6E34BC3F0D0E7C7D0E9E02FC272404A6B57E0F5536ABCD996A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 58a422fa04ef8b903acc3bfec543ba40c5ab6a23334f6cb63bcbea7b194f463d
MD5 7b0b5831594e513cd9c701e9b8a3ac3c
SHA1 43914dddf74b268b4ab8303eac8366d896fdb2fe
SHA512 61ff757f5f989feff927c707ecf901daee456bdfbbcb64225bb3bd6757ce7ee0b3bf0543da08701be536c55fec660092633360a770a6412297d9fa0e6cee5ac9
SSDEEP 24576:5ZMSzFVSO3gXe4i7ojhsP5Lgrk1TWb4AN5:5ZMSzfKe30jaNf1TWbdz
TLSH
T130650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d9fd5962c57d3a3f8d1c9a80b169eedc1b7046bed23dfd9b5b5723a29b125450
MD5 dcf0b3bbc8669cab8c9d694621e8689f
SHA1 f07ecd6bab0723de87b0e3cbb476dc12fc019145
SHA512 fb02fee35475c43ef91bc0b251ee0c9298b3924e5220cd51218fff86a9b4b9f69cbf55d29954dd0ea9e9af5541777549e5f2e4f07a2bb8b5150e08528e05b397
SSDEEP 12288:Yp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Y2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T131452391AE5509C6E34BC3F4D0E787D1E8E01FC672404EAB47E0F9535DBCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4807e74b96c0fb6bca607ae075845616959ed2352d0010a55149bf6cba3f6e5a
MD5 4159249ca8df8e87fe708c10efa7fc90
SHA1 67d099e0b5f3a70cf431f7d13a7e435fb8a7597c
SHA512 6a1e34eae3d629586b3ea7870442a2a6f8bd803d7f7bd940027dfa394e8966ab65377ad5e2f97db7f1582949e64a5cb25cda7f0e60cee64fe9ac62fb4a583c51
SSDEEP 12288:Pd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T182452391AE5509C6E34BC3F0D0E787D1E8E01FC272404AAB57E0F95359BCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d22eb1f4f8f3a08527a96b577607e2d377927e2e396dc29db30755ea02237158
MD5 c7db9be656ef26ea7532c34e8ccbfaff
SHA1 ac07a7aeb7953bd011ed15e1b284c45828c4a9bc
SHA512 51aa4f3f1693cbeda98cb6fe3619cde1d957e3c4e1ecd4c5b062761b4a2b6ca35c74fe4f95489818b36ed10691510093a26f1b1993ff21d99f3bf6251cc4eccb
SSDEEP 12288:gyPz5L8i0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Rzy7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CF55015777A120E9D1678278C4E24B42F7B1787217208EAF13A057772E376E19E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c98f5cbe713c5336b1b4d108e4a65e69fc2a37924bb797435a454e55cf46d641
MD5 de1a1ec382efe8e1cb12d4453128acb7
SHA1 8098a6017f616c035c66b16a9e7b46a2c4c4c174
SHA512 82522dac17df0f65aae0a01c9b50dc924e491b8a13454a8993a7875899da7e373b4314b89de5403e526cd20d6202ead6ff5a3066d9baf689b461d802d209de24
SSDEEP 12288:up0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:u2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12A452395AD5509C6E34BC3F0D0E787D1E8E01FC272404EAB47E0F9535DBCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3de926b72d720bf7ba570d26c2fdcf7b3ef77fc42665f197e29a6ea028b7b615
MD5 cb65410f509d535a4fd3a27c54a75a8f
SHA1 349e086843e27c52365e2e037c4297304346aeff
SHA512 75b8df342e16566a984e120ba04638622bf790790a79126ee0a56ed494c64b6279edc9d9f57c3086d3c836b9af521a802072ff98fdf286554615ea0d913ef7e1
SSDEEP 12288:5p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:52gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T174452395AD5509C6E34BC3F4D0E787D1F8E02FC272404EAB47E0B9535DBCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 49e488c971440c46594a70275aa0a48b32074e9b4231c3468053314e0533883a
MD5 ed3e7e54ea5a62e55073ef69096386c6
SHA1 08daa75c3c6748892c4dbccba667dc1532e28e71
SHA512 bb5ac8b65bc3b68eb24f1a7b08f3634bb12674c5c3a9fc78d78ea1e7050bf57fc84b6aca2b0c6e229f941fe3e4b3d8db8d4b31a709260c364f32c04ca0050c3e
SSDEEP 24576:PCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAVgXe4i7ojhsP5Lgrk1TWb4Az:PCUxPTY+8Wg2lIL8lrIUJLWwTe30jaNw
TLSH
T19065AE1EA3DC0896D0BBC17489918A06FB72382A1B21D6CF1160C77D6F67ED95E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 af06e14679b659d5c52d847335277090a3551bee7b8fac53764588ea28b87403
MD5 c69feee1cb20e699d2db23ea47027088
SHA1 a36eaaf05eeb273dc301903504960f4432cc68ac
SHA512 f7f85eea665182eb75d166555629171d5f2b8e5f8bd1bcf8b1b7b63969f85ee69c4051b9e4a1561b40e2746810141c14867a94a672fa53d4f7c66f633c4e2e92
SSDEEP 12288:aNsfZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13855F15AD29802D8C16E92B4C3968A81F3733C5193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 35c8c15c8c7f50ce7088a71aa6696634cacef5c0631fb449279c02d714088e56
MD5 23c6c074fda7694b9c7fed51155093cd
SHA1 0fa70c016fa93b870974ad602c44809c862bb0ac
SHA512 3f7deffaa91dc9f2f79d7abcdc0b49b131c4276fca4cbe24c1c58dd36780783a3697b92ab5e6f5515fe6b39f50a071b1149be85eeaeeab34e9ee203761c37106
SSDEEP 12288:TY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A74523619B580DC6F29FC3F090FBC760F5A53EC02B0089DB56D0B6932978DD5AEB8919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 aa01be66405a4f273fc671ba64275584a7d8a00b1b153875b603e90c34befa92
MD5 212ea94631bbaf1df384602a2b893018
SHA1 c4e7cfc3546b8249ff920a41b728223f02044f7b
SHA512 10cf7375a96a6f4f18c6665f955ea66ec46da98cece9718b45fe9ec9ca5305170985fad37c50746b5936c0291683c154149fd09db33a940cbc69a5ea1ef1c8b4
SSDEEP 24576:d8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCrgXe4i7ojhsP5Lgrk1TWb4AN5:iRZwQCyiHiQEaaPnMBe30jaNf1TWbdz
TLSH
T13785A01E62DC46A5E0BAD2B8CDA74407E6B27816573197CF0290C27D1F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 af72de5fcee939efcca5c047fca9c76cd0b032f355170564790e28c94638892a
MD5 288dcf0f0854b15c040fe56055929e25
SHA1 7a5b3b7e55ec789fad5e145cd48a13f6ba52ae22
SHA512 4e4acb5c36add3fbe2f24e4cba8687da68ff9b13faa867beeacdfa9ef41be33afda221cf63b1c67b5ceb0a1a3238c94bd918ce4a6485f3c1ed76665635fe13de
SSDEEP 24576:tbxA1UGJgXe4i7ojhsP5Lgrk1TWb4AN5:tbxA1UFe30jaNf1TWbdz
TLSH
T1F455126E6AAC18D5F2B7D27884E28201E7717C56231087EF11D0D27B0F3AEE95D39E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cfacb1a44ed5a472df2f9a75a4d5d3d24cfe5adec42ac6c274a8bfab7fd181a6
MD5 4c30d3823159ca326d32fb8d78ce1866
SHA1 6d059849e65e84d4ad0094261c4be42e57f4084d
SHA512 e5a510226c24688965b5b92fb9f1c8ae9eabdde65e12743d5929d90100789e52d23c3d7f9c3d64156b2dec30e91fb92da0e50ac6423960e657d7b2a981f0120a
SSDEEP 24576:JjsmP0yHaqrVqHra44KDzMsrnEgXe4i7ojhsP5Lgrk1TWb4AN5:JjRP0yHfVqzlAsrnre30jaNf1TWbdz
TLSH
T18545AF2EF2B910E9D4AAC176454107B5FB71782D1F209ACB01B0C635AF0AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 be9e46b058852074d3785c83da12e2f29815748b224b19a8dd718f1439c97adc
MD5 926016c449e46880f1940eb58b1b52fe
SHA1 779f997d4c7afe756fd1223c3cdfec4f266a8b54
SHA512 ec3992533b1a2cf9dcfcde52237cf8bc9f1c86adec120a327eb41d986ec558b908c1887e064aa4a2e493ee64b68c257185cd41e071a98b0c92fd0a877c8fb3e4
SSDEEP 12288:Iq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14C4523A5AE4509C6E24BC3F490E7C791F5A02FC133004EEB56E0F6535ABCDDA9EB8464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 6f3ac0599aa91e00d5e875d2bded5ed0d8ff093f5a0f3cf5c802882efa1471d0
MD5 598a4b891a2725895d1c0e66520a8e31
SHA1 2bd796ebac1864c31f638ca392455a39a7565cca
SHA512 b8b25427dd3898d7fedc0f5aaa44f44dcd8056e0edd686cdc676ee2b61437734f1333be4c92d419af7ae69d7cd5264ffd33ba0f53bfa33457ff229c343f42555
SSDEEP 12288:ZOb9A4LWO+vAYFTM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:OpLBUTtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE75F155F79400F9E96BC27CC4A28A12E2B2789D1354E7DF03A84B661F637E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0182c7219c2e7256d7f19443719cb302fa3675f9f67e4f0a6522ee7d140fd22f
MD5 26835f3119651526ad1f3f03aa33918c
SHA1 aaca8e83370a89604eeed89f3c0d454b843de063
SHA512 9ea612d0c442ef9d556821aa18868b24109c8f15746c948da885104493a9575ecc34be4901222e85ae74b55efc75fcdba92a0a8f883ca78d29172d494cad32f2
SSDEEP 12288:v70VmvIYNvUyBpV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnANt:4rYNH4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16565F12EA6AD0CD5E17B9179CAC38205F2727896131196DF01F0C27A1E27EE9BD3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a8f7ffc376dca3c7ea8867019078a0c73d75eafbb5d9f9769cc962b0f352a100
MD5 2e5b19efe385438c966b65ef7c95c185
SHA1 8de1889b6727afc6161087f840ca657c96961637
SHA512 afd77f2ada8d4f35d7ea14c0466cd6ae311567b83d460808d1af94596119e3299b203b84afecee6740405cd7eab8c29d9fa7972c1a30dac628a9b8dc703e8a00
SSDEEP 24576:AnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKq:AnXoJJYH84VVS6AmEcJas+cHBjSSKHP6
TLSH
T18265BFAEA2BC04D8D5BBD17DC5C24506F5B178621331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 68375cd10f63b4c61b72c861e0f80486b0e4ecc568476078ec59f8c51be5e055
MD5 01ee2b790892d38e55742f75c9c33720
SHA1 722e52805c97748c16f28e1c4ed9eaeb5610356b
SHA512 aaa3007d470c3cca1b53740c6ad6375436a8d0e50542e8619cc566cd6613dd48fdaa36cf26bf172f81b7ca3e6751c0aac42f0f69079f173397e693cb1bda5fb1
SSDEEP 24576:Nv7Xbxd9Tuycf8M/TYlSuxwr2PC6gXe4i7ojhsP5Lgrk1TWb4AN5:NDLL9TuJ0M/TYW2P6e30jaNf1TWbdz
TLSH
T174858D5EA2EC42D4E07BD6BD85B79146FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c7d98ce4328f9c70c999d86654bbc598471c1b3ac7731a2a20e734502f1ac23e
MD5 d0eb59c42ad49916faea47d2f0604083
SHA1 4b1c86b89ae2e85b9b3b9e5aff6f7d6a0323d3d7
SHA512 432454730897d8238d683f2a6fb3f4a718884016f5f23989badd30b916fde1c261a2ed4b3f3bbf502cca90582fd4268a1aa73836a537a284525e8985398fbbc7
SSDEEP 24576:tegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wtgXe4i7ojhsP5Lgrk1TWb4AN5:tngOJOmPOHhoe30jaNf1TWbdz
TLSH
T12155CF3FA7BC05D5E03EC17D8A938916F6B1782613255ACF01A0827E5F1BEE46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 191b7376b396536ca21b30117d6e90bd08c9080b363ceb98e40756f3db9614b7
MD5 6717f7ae44a417a3cb1ad38b81e21213
SHA1 9d5bb3692b639b923b964e8dcb185ef40da8cff5
SHA512 3a3caf8a46bfbe0d5a8f2da0c965cedb5f5fd2e7ee2477f0f135ba822ff985efd785f3a2406e2f4270d965938ed334afd8eb439996baf143295076168996697c
SSDEEP 24576:HLJnJiTk3R3waE4JrODgXe4i7ojhsP5Lgrk1TWb4AN5:HLJnJK8R304lbe30jaNf1TWbdz
TLSH
T1AA75D03DD2A810E8D0B7C2B4819A5756FF71386D2B2169CB19B4D5313F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ec650c462dfe7b74027073771e5ec4b97cdac6141b9858c8b7c9fd9aebf5d1b4
MD5 c51970c9c585ad6b4668b17c012b42f8
SHA1 66083f953c74ffc2620a7f0a4b58a90136d695c2
SHA512 8d876781ae0312d35cd9a8b2a2f3b27bf859a60131834b25c111b050a9bd990dfbe3d7ce4b6f18712b38bdfc304765fe69c620d1a198ce4dcc6c0989c07adfdb
SSDEEP 49152:09GqCzDScAZmlvTcFg8Ph62e30jaNf1TWbdz:evU023W
TLSH
T1D5955D05F7EB5298E8B3CAF1C96695159B327C409B34F7EF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 597e93bb9fd67e4b146241b36ad7af643e6df6e3277dafb767ab7186eae681e5
MD5 814bcab5a7a69ebfa39d0da654879e25
SHA1 a745d1e7d1d5288bcae957093b07142a63ae37b3
SHA512 cef53866c9ac4610f07584049ccfbaab814297dadc0418e6c4bb5fa077b46c0c20542d9f7ca968abe6da2cf4436b583ef173f41fe6bd377c6abed9c2122a514a
SSDEEP 24576:8lYJeXm5jUuEdgXe4i7ojhsP5Lgrk1TWb4AN5:8lYJeXmRUuE4e30jaNf1TWbdz
TLSH
T15355125D7A9C20D5E25FC1B9D1E28B40E3B1B4A1230157FF42E0D2764E6AEE66E3CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b4ea5a93ad3e8f9376bda01493a4853ca5ba6f955966564eb9184f54a258ae7c
MD5 2d13c2858763f34ebd503b84ff75f10a
SHA1 4290661a5ae897a153ee276c2fed5f0eaa7c11db
SHA512 92d52dcdb47c4b877bdc7a87b075e50d2fb0848e8fb21df090c91553e2b6ca98fe24a64b3185de92271051bd60a068c77f74a9a163bc57dbed4a47a10291f6f5
SSDEEP 12288:+wu6ky30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+VtykgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10E551245679415C9E2AA82B8D5F38390EE707C506B0087EF42E0F63F2E79BD4AD74B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 89d7fe477d949378cb00e50e592938d7d8a5ca6941e0e4e5fc5ca50c39394e8f
MD5 9d88b825bc6d82d97e1fbab2c68b2be6
SHA1 e1c0d387532386e9145f652314ecd3d538f3957d
SHA512 466077ae4d56dd97fe533bb64b28b51d3487ae225f5a2f8a90b1b6085b1ccc1ab7452e5b5103a076b25ebab74ca2ff3c6e579e87fb9c455e048cab19f4f31f8a
SSDEEP 12288:mPM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:itgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10C4523A95A5519C6E24BC3F490F78791F5B03E90330049FF12E0F5739EB89D6AAB8C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3cf8d2b522f85f6925c6026795806ad593d6523e651a6b32a0316499d69b1faf
MD5 005e756a376b026592fabb6522b7344a
SHA1 34249c3d8be0f220bc9953b7756d0a577d55f660
SHA512 64a1d5323ae1464d41b07be85f811d46364c87c63b194019ae7c9aa3562fc5e47e339723c6ffabce33e49d7b925f9e026a3a569982280223d0981aa092d61a19
SSDEEP 24576:jC+TyQIu93VAumZr7jmmgXe4i7ojhsP5Lgrk1TWb4AN5:j/TfIq+Ype30jaNf1TWbdz
TLSH
T128558D1DA7E91DCAE276C675C8A34493E6337872137186CF2084C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f0e7378b82037e51f2bf6cd6d47a6dd46758b971cec8c5145189737c0d176eb6
MD5 16f428f92a6c3869f987d12c515f24ed
SHA1 667442f157aab69c0e9cd9671821eb1472cdc054
SHA512 155e4990f6b7cee1c13994793c779f6dfb26c89eab69afee4ad4b07a0224c726e61e4dc4574e426eb954229e7854a4f2a0af253a50552f73d68f3acc0f402988
SSDEEP 12288:ccyrWOstaa3kcsQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnANt:ZLQikZxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17265F10FB7AA0095E1ABC27CC4964251F6B37461531267DF02E0C77A0FAB5EABD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a1569ee24d2cec1ac1de10a4ff1719cce5624f4a33a73e4f9cc1b546c384f4b8
MD5 78d01bb63227b385b426544898bc6857
SHA1 534a8d12ce1cd0af7910fa207e270efca743e916
SHA512 b4ebec479dd1289b2a6bdf8475977346021a914b185af5b8674c5503ecde36054f2940543ea0c532df659704816c16a36946fd53768c2305aab7c4b85717b815
SSDEEP 49152:cpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPLe30jaNf1q:dpC7b4+80GTkuU023W
TLSH
T16BA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c121feed296ececd42c4d525600668fa96e2ade9533c4bc5662d92c9b19b1404
MD5 768262f2b4b304f2d58c76b70946ed3e
SHA1 638e219146d612109e03115472953e9f3ee7fc39
SHA512 0ff592f2701a07b9cb674b8dbe04731a61e47aa98ad47319fc5b8cb7e8bf32fc7ff4f4d42d8b35f0ea9b0b2f4522878b8d0eb1a07b550f90f535639e4cccfd38
SSDEEP 24576:nSAwJPE1IDAo+4Kt+l44135UQcgXe4i7ojhsP5Lgrk1TWb4AN5:nqPCIo4Kol4/Qze30jaNf1TWbdz
TLSH
T16555B02AA7F946E5E17AC7B4D663C601FB723823133163CF4290917E0E169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 d3d3c7c0bb183e72b574a44c8b663289c0252ee53510b839a9e495af4718dcbc
MD5 e29d8a5a584d45fbd08ad41d01cf4041
SHA1 3fb0c0c06f412107152cc874ae8712e16f343792
SHA512 9d3b879045965e24261cf8a4c5b315697aeca3e32cd0e8f188958ca11585d7c0cb75b017237ea67212b3b3b3d99aa11bc2264686a492240dc5a363c7e36fb876
SSDEEP 24576:6yLXPLcM94tMgXe4i7ojhsP5Lgrk1TWb4AN5:6y7PoLtDe30jaNf1TWbdz
TLSH
T11175E03ED76D08E5E17AC27CD2A38A06F672389D032166CB15E091761F6BEE4693DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 02ccc764820a532ff8033a5b5094a2e6379fdf2c6779c813ea731a1f178bdfbf
MD5 e3acda0304fe0b137b30355b85bb8589
SHA1 512abec2d0b60a0c2c14f12e1bab83abfb20b164
SHA512 325355b8472b0461a6bc2836e537af630a4558af723855a82aa7bcb20728b85bf961a738f38219c81a47326b862f806e1dbd47e1a0c4b56f92cd6881db72feb7
SSDEEP 24576:4Wv8qjpBgXe4i7ojhsP5Lgrk1TWb4AN5:4Wv87e30jaNf1TWbdz
TLSH
T19B65125E5A9418C9E16A83B4D1B38361D0B17DB223548AFF31D0E9B74B38AC5993EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-175-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/328-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/328-129-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/412-178-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/428-365-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/428-127-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/428-121-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/652-366-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/652-125-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/760-173-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2020-126-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2044-399-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-403-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-410-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-411-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-409-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-407-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-408-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-400-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-404-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-406-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-405-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-402-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-401-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-398-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-397-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-396-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-394-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-395-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-393-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-375-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-376-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-377-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-380-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-378-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-379-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-381-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-383-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-382-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-386-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-388-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-387-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-390-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-389-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-385-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-384-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-391-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2044-392-0x000001BE636C0000-0x000001BE636D0000-memory.dmp

Download

memory/2080-99-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/2080-104-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/2080-367-0x0000000000A30000-0x0000000000B0F000-memory.dmp

Download

memory/2080-130-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2988-82-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2988-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2988-75-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2988-364-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3280-149-0x0000000000680000-0x00000000006D6000-memory.dmp

Download

memory/3280-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3536-176-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3536-370-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3592-369-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3592-174-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3960-363-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3960-73-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4000-140-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/4000-368-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4000-143-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4000-134-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/4104-86-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4104-92-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4104-123-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4224-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4224-32-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4224-291-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4224-38-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4340-0-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4340-10-0x0000000140000000-0x00000001403B6000-memory.dmp

Download

memory/4340-6-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4340-70-0x0000000140000000-0x00000001403B6000-memory.dmp

Download

memory/4360-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4360-55-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4360-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4360-69-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4360-61-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4604-128-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4604-22-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4604-16-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4604-23-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4604-24-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4680-348-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4680-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4680-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4688-124-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4756-195-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4756-216-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4756-177-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4756-179-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4756-162-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4756-168-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4756-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4876-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4876-41-0x0000000140000000-0x0000000140136000-memory.dmp

Download