4037e0cc6fd32b63c33500f9017912538e2ca977e09643bbe913e51735f99b8b

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260504-nc2dfahw91
SHA256 4037e0cc6fd32b63c33500f9017912538e2ca977e09643bbe913e51735f99b8b
MD5 7fbb45760d38921222a4d6cf2548d8e0
SHA1 2db29b535bce212af719022f5d4bf980e57498d6
SHA512 76c283cfe4d25f52c7594ef4a67e5ad4089cfaa9e3a5927da0a347a438224a70677d32aa0e38ed4c6edde0a9bdcfdd07e4f55d5bde0188c2ac52e4daaa7789d3
SSDEEP 49152:Mgh8jK3xEPK3Hkcm4L8A5iltfJJnB58MlSKl2HJpfaF19+OOsR3aW:MMYTKXkcmjfJiLeg
TLSH
T18CE58D6D7AED00D6C175E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2568	alg.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1820	fxssvc.exe
3744	elevation_service.exe
3180	elevation_service.exe
5224	maintenanceservice.exe
4772	msdtc.exe
4764	OSE.EXE
2188	PerceptionSimulationService.exe
3912	perfhost.exe
5180	locator.exe
5944	SensorDataService.exe
1088	snmptrap.exe
2600	spectrum.exe
784	ssh-agent.exe
5540	TieringEngineService.exe
560	AgentService.exe
5544	vds.exe
1992	vssvc.exe
2740	wbengine.exe
564	WmiApSrv.exe
5256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74158d8a3bf04e52.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c7a9b6eb7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c44246eb7dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000163dbf6eb7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080a6266eb7dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003481006eb7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1104	DiagnosticsHub.StandardCollector.Service.exe
1104	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	1820	fxssvc.exe
Token: SeRestorePrivilege	5540	TieringEngineService.exe
Token: SeManageVolumePrivilege	5540	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	560	AgentService.exe
Token: SeBackupPrivilege	1992	vssvc.exe
Token: SeRestorePrivilege	1992	vssvc.exe
Token: SeAuditPrivilege	1992	vssvc.exe
Token: SeBackupPrivilege	2740	wbengine.exe
Token: SeRestorePrivilege	2740	wbengine.exe
Token: SeSecurityPrivilege	2740	wbengine.exe
Token: 33	5256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5256	SearchIndexer.exe
Token: SeDebugPrivilege	4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4584	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1104	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 3796	5256	SearchIndexer.exe	110
PID 5256 wrote to memory of 640	5256	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2156

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5224

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4772

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3912

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5944

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1176

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5544

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3796
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 55242f8e7619f8096e63ffc38d09dc0be8a46178e078e25249f777082e4e2897
MD5 d6c89c91ab62f6927f06d8ad328c134d
SHA1 02fd1dc94523af981db7eaef9e280b19b1d89a1a
SHA512 e1ef1e08bda43d996b29a4b606d588c140f73b9dca85001d015c73b4f863fa361e437c0a0b89b4dbf0596c963de68fbf7fdda4b9d6a93b1aa94ecc37c82b8a27
SSDEEP 49152:/b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnDaF19+OOsR3aW:93q60jB+eg
TLSH
T1D8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 527f79220d1f2a979c683dbde2e204adafd6c23463535c280261c229603a39c9
MD5 30529f56356de80be2dfaf3acd887b13
SHA1 21d19b27d0ec21c08aef01735960725cd32afcc2
SHA512 178720e9d7adcc19198a1bd1c937cc634bf383ca5f68860e597cd1afd553f55f39b2079fb60587a3898a1553f695d5940600ede0f7caf1945ab1ecddaa49069a
SSDEEP 24576:uXYfDtczAya/dHVnN5VWW+MAOOEUPsxLisaW:ttc1aF19+OOsR3aW
TLSH
T17065F12973E408F9ED678178C8A2C511EB737C5587A0E78B03E499661F332D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ca7036a26f2e3c247629ac2189981bf2621086f856e16363cdb44c53d4f3d674
MD5 4f3d13a9ab0c3eee2329e14259c9ec0f
SHA1 d6b9166d26c83c942df2715e4115cf96fec5444e
SHA512 398228e5515e5faf8f56202ae3abb0ed84da395dadd4c4cf086d42322e1fd6c58ef5ff6c917c413b71a5f5ceedbf0cb107c6411c1e42b8c439f334081b54a136
SSDEEP 24576:d0Le5ji0hmxzrMba/dHVnN5VWW+MAOOEUPsxLisaW:dPji0Al4aF19+OOsR3aW
TLSH
T11F859E16F6748331D073C0B9C5D2A69AED7230865B308ACB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c89a1a922ce4e1140617ebce503c437b6cdb6e3ae48a990f5b848dd42deca20
MD5 0b0d4aa6bd3be90d489f30c0689dd225
SHA1 b4e2c55b86f03a0655e215aed9293d99b8626ab3
SHA512 312ccde0760675c5893944f744484e1ef6b14c8612fff158c61efd6d3b409f1bee0d5c07926c817fa3a0b49176aeb42bc1dddf040f5632d1c13380d717b53aea
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWr6q8wyuFa/dHVnN5VWW+MAOOEUPsxLisaW:o/ezSC6vUzPviHjycaF19+OOsR3aW
TLSH
T1A9755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 86d7aab04a3ccb24f817aa4d8e6992ed7be3b787692ea3c19cadf17e0924363d
MD5 fba6f749147baca4d1cec452075f7b2d
SHA1 9ec7b5e6b7c0b7d1dc428311aa84e75c043d57f8
SHA512 f761d2b9c564fa8a76811a9651373a38ac1c70c0abb4acd3d6d7a20ac536ecd4c5c486604df124a830c73bd2c9512b44e2c63ac6e12694ffa7ae6ce23b2c90e1
SSDEEP 24576:3VbqPb88hv/l+bOa/dHVnN5VWW+MAOOEUPsxLisaW:3VO88hXl+6aF19+OOsR3aW
TLSH
T13E559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 781e298bd4bfc3166198687483671d1d906ddc1cafe9af4daa06b190e6657f95
MD5 81980972f40e454c9ea61083f43bb20e
SHA1 fb2e305bd078c7b9751a5fb50e27535b74702d0f
SHA512 138486aabb4206f8bea94352596ea8e40c4bbe5d322a9338ec3418a4596c3e37f55a44f3619eda3bc6253c01d67781974fab8d4fce8ecc6bdec1314c8aeacaa4
SSDEEP 12288:b93LW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2R:b93a/dHVnN5VWW+MAOOEUPsxLisaWR
TLSH
T15145232B177890E1DE7B85B1F4AAE9D2EF824C19D8A0DA03729475C7427D590CFAC48F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 48ba528ec7ea713bb17d1523f6290b938fb7461cd967ef04260a134a4bb40468
MD5 76dce1dcde4fcb8888c5bb3097630492
SHA1 7b329ac925d21fa4fa54659746c4eb4c57691b8b
SHA512 7a509fcd2e47a6173a98fe1a0968128cb24550146165ee4bdcb9bd7f9d7444078b0f816945c9a95add9e6bceda75a4cc55017bf253e2b6ac6bb69bf872bc1309
SSDEEP 12288:ieBNUbTVO86UmLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGsP:iJIUma/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1DC65CF3BAE38FCE2C67E8DB85691C640D76278304F61A3CBE165824EDE235E05E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7eb520ba938a4b4e62cf4c32ff4c66bf17d1692d4bc7f085864c5a1161f67741
MD5 247e841f184190ea3d1e464007311081
SHA1 10cba606eccc25756f3552242caaa2d204ca74b5
SHA512 9fd2fdd4e5ab0d3ddaaa37651c2a93a79dc8161085b6611c7e7da8cc25b74164ed211ea8328fdbb4412b9371b6685bec6d023c9372374cbc78476e41d24c1fb1
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THX:UQvGAdlCEL8c/RRNw5CVeg
TLSH
T1ED266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 62abbe1b8e76d7cba208e522f3d4134e30e62ed7e9bf727b315f98fc508f45fa
MD5 eaf5059c880303e99ad3b80f07097cf5
SHA1 1cb5cd34cc1d40e75216a1caef0e034ff7a554f8
SHA512 88af56a5a743eaf777d9c1dacfb3cdfa64f04ec88519b727430ab539374ffc137a9717340ab16d6bb52e58bdf6a2f89d5b831418435586d977f9d8857c222cab
SSDEEP 24576:3sewsAjIa/dHVnN5VWW+MAOOEUPsxLisaWx:cljIaF19+OOsR3aW
TLSH
T1C275E031FA74E032C67F0DB21B36C716586D79204F611AC3E3E85E8E59342D2677AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0abedcca11024d5d36f846f0b58013e5c172ce950e6766b4ae6a0ac00c863dd7
MD5 a20f32c23acf764fac46c963528c8649
SHA1 c09b8787b3f1e92844d77a4135b4fd336f4d95df
SHA512 1d44a4efe3a4492cf2589b71b6784cf36372331ddb9eebe407c675c4b6ddb94a24d8d5ef4004814b19dbe2237d4c4f55fb1907413506f41bf92f6aa1d3e94881
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHQeg:uUEtQevvqc2W1cpV2RI32f
TLSH
T18D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e0a9a59cacb1c3eeea83799a70c9da0f6a0059b6b409bbbd1ae1aed1b9f5986b
MD5 852b0a63a90c79125c14d94999d875fc
SHA1 1fde4488b69a52eaad771802734c8bad62e2d29e
SHA512 c6ba605719a8a0cc84c8e48494c032275149209933ab85da889ff5efa519df8151342f4ec52d3ebb0f40029d7ddbcd57a120d862efc0bda4ac38db874f7b33bb
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zoaF19+OOsR3aW:xoq2VjnmZeg
TLSH
T16AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 57f8ffb0d583b649a134a0ab9ab7dc5810a05ad47a3b04bdb00238868d749e89
MD5 8257dc31c46a833df805bd73b9900c22
SHA1 e80a412d9bcf618a2a38f4262df82f92639b2f8a
SHA512 1d65b270f9f849814276ed219841766684296db24b865390c3a919f64f8e441fc62130c2e4e46a5d381360b3ec3fcfa2afd79562c22e5f5eef7511f5f9063e06
SSDEEP 24576:jAhGL2IFoiwtA5l7S535a/dHVnN5VWW+MAOOEUPsxLisaW:jAM1Foiq5paF19+OOsR3aW
TLSH
T1AB35AD81E7F955D4F5B3AAB899B69171EA76BCAA5E31C20F2150D10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 98244ef0f33ac95daa3c5fbea6f0f9278b0c813003e6c85184c1b34ac2f24524
MD5 8184182d090ef09d6c6630f5a564aca1
SHA1 178073e54b2fb51075a859f5cffbfdf4d94a5cc6
SHA512 4a47fe43deea42eb171fdd15a308db3c8fcfe3a4e691bb28d388fbe9d888812b1370ae82c1bc895d2c7a75235cdd890eebb29f4461fd63ec655f44b2d9c4ec31
SSDEEP 24576:jwuROW8a/dHVnN5VWW+MAOOEUPsxLisaW:jwuO9aF19+OOsR3aW
TLSH
T17965F14A36A41CF9E9678138C597C532F7F2BC162A21DB1F1360C65B5F37261AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 51551043fc4db52144154452d556c0f0bb4a5c63b22d6d03489e358c29ae8a47
MD5 4684bafe6934b27240076663380c896a
SHA1 40f4eb60c652c34846676e4a02edd254d8bf7ac1
SHA512 57e549b0108ed44a6a711ce488aa61936611f6d68def8b094051cf85a23584848dc38c75fd314fd955a62cccc0e8b4174ac462741fd620f51b756e399b69111b
SSDEEP 12288:dFZ1IyYLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlob5:/ZuTa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1DA55125A33F460F5D5A78278D8E69641EBB27C16A77183CF226442971F37AD08E3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8930a3511dfe9e60abfffcb72b75ee8fb372663740f5192a26253e1f5ac5d54c
MD5 df8eb0f4ef0fdc688ac1f24718dd8b8e
SHA1 f75bd0db495bd95ec0c46777d749b92e4465d3e3
SHA512 f7045bd76b20a15261308a62253c2c3c7027dced58704fe3c5b2b2eb73786b527d41848b99c9093e78d938a637512cd06b2fb2a7a48fb0910da6edc348d81d92
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uz:YQRQyi36YOcPhLvw2gAf+PN3Keg
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3597273f696850a70d845628dc2b1b8e433235a61210cf8199f1de2e817cb9cd
MD5 f05decbd9d1158dc7d4f525034a26e0e
SHA1 121c2c077fd48ab11628e951c1853e45fca7d381
SHA512 7edbebf117be2083b69b1d78e0d3c90bcd52976d1a41397d5ccabf4a631f6c985323b9baea34d8508939a55bb11e90ece8690c289297eb9fc1713e0f60991f34
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uz:YQRQyi36YOcPhLvw2gAf+PN3Keg
TLSH
T1AE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d6301cd48efd98717fcbaf2122c00495d13c7725ad122df3040cde538d0b4927
MD5 e86cdff88830c0464fe528aea4ee5908
SHA1 5bea59a80be81c9ea2a38d44f0b82d99e591648d
SHA512 b697db147a2f51ba6226ab24caac47e128367d3b69f642d78b23b701b84be80190435b2082af256ec273a0dd3d6d3055d61867bd72ce6fa0ad1082a3d39ced83
SSDEEP 49152:s68Qg55nhceWu7PNU3/4aF19+OOsR3aW:mthLRc/4eg
TLSH
T1DDB54933B2F600A9C45DE1769F4A972196D27C75CFE0E3DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d238ce63f0a4f3cb0e6bef156d012564b7552cd70cefd4669e4df8e54efb6d43
MD5 31f31599a811bb5a46f40a5ffa5d4213
SHA1 b939ae62670cfa15f2a5aa34d9118c2706f5b369
SHA512 d093cc2934d3f0b356d9bd97407cc2cddd495ce4a47fe7e5785a75bee9ecd85b86d30704423cbe9152969a36fea3b4237389491780708575bad1c0791565c7a5
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99V:iy5112gYy5azzVva69nLKnhZ3eg
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c214bec985766a4c1c7cd73e4d7a289d28aab5127ebc7902f365fc310d2dbe3b
MD5 b6ce222e2a74cf4598c4cc30efdc4506
SHA1 eec07bdaffd1add0a07a5fee8ce82478eb845d41
SHA512 7c169b35552e09619a75f156e37da9af2c71d1e2d072ba78ad6b77ecab4889e19bffdc36917dd155c755d86afad5ef2e0de1eda9e1dd8741e5bdbe75ae327f01
SSDEEP 49152:xB+taZ3usBWOBr4tEG20bqx0z+n217aau1gliaF19+OOsR3aW:nu6JmUxd2dieg
TLSH
T1A2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5b395849c9b675437a57e9f209302785da9318b5d823098c8e071f3c89276490
MD5 af34596e97bf165752b63e2130d9fdd9
SHA1 ac7b8af3d0d030183a16320e289f4d558ade900f
SHA512 69e34dad0963a7b6b1a654161bb65e4c7e4d96548762e5dcb17a7dc94e90d7d3dc2c09240080affdb3095054c01f0e1f604e337eee972388b5d7109091f16281
SSDEEP 49152:Q1hpsNoJpF1A6BU44CwH7R4xGaF19+OOsR3aW:QmifPkRZeg
TLSH
T1C7B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BAE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4710d99618841def750c360562fb81b3b49836e2d9b3630ba8eee0658e0fd2f6
MD5 2a03aff57fed0f06f0c70a39a08bd05b
SHA1 f2e7a53cb30972edf0569fa9a27b19fe9f83d1b1
SHA512 4b9af32e3495a72ab05ae145fdade89833e798e4c5089c0bdf6775bf418f2d0d0e4113c420c24c9181637a5238445719d2ea1686d6766d70a2ee2a867ee8f78c
SSDEEP 49152:9SuZQIY0Be2KNRVtOnks6NMHqTaF19+OOsR3aW:T5dKvi61Teg
TLSH
T1A2C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 835e1173465dfdcd37962564fdeb3c976d53afd15db10d873f70474789bebb20
MD5 7409bd5ca9dbd1c7a61cbf37bd21a716
SHA1 6d163322a8328f71ac0436b0a1ddc2dd5c93db31
SHA512 8f8c86469ea85333cd30d3238cfcbf250779bccb7745562749bb16d6c3485c24b909967be33922f2e798055eef295180012496e2317023362ea8e4b17f27b2eb
SSDEEP 49152:ZhtSn8EApI0figXgiDn0AP5wyaF19+OOsR3aW:oX2iyphdeg
TLSH
T1CB95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7e1ac745a1fcd5aac55130bf9e032987589a169b2166fbd474682ea5c0e9ba9e
MD5 d7989ac6f03a9ee12236f550e2481bad
SHA1 d407143f442aba6695ab7b4d6e6944fbc2af5546
SHA512 6d43aef519fe5ee59b5622ec8684d7af74428507e1d854134da07198429b328c6e36c31b5016a304b8a2d50cc41dda7363252c41849acc4d645454a640d7364f
SSDEEP 12288:aPLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:aPa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1B345231B26B9D0E6DD2BC5B0E0AAD5D1EF865C1EEDA1D24333496083537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4f36aeb5e5ce035a81b7e876940a1b94e1d17c41dad4042f9f750639e22ff0bf
MD5 5b006750146b527b58941e56d609c5fd
SHA1 f93f99a8e4c4702da8205e07c0c1d3cb83e6c6fc
SHA512 5011a7c41bfccee148ddce0f4382148a00f52bb409b8f8baa18531ab583466ca9361a86eb1b0d05c8bd267e2d0b2065d1bd5668fe6572ac191168fb5179a0a5e
SSDEEP 12288:NkLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Nka/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T11745232B26B990E6DD2BC5B0E09AD5D1EF824C1EEDA1D243735960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e7253843066a2d7b4812d8fc87d7c2f6ac9cea83f5756f90a642c39143f697ac
MD5 75df2df6b6775efecd66023ab9770492
SHA1 fe94d2f03f96343a0db207eb64db928b8960c816
SHA512 ed019d42e9819974c4235b935dfcab51be71c128f8d0552875e0002a7a019b1665ebfcf34aca64b68719f7a0a36fc06104f329b1c2ee59b9660bb252e98e5968
SSDEEP 12288:++LW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:++a/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T13945232B26B9D0E6DD2BC5B0E05B96D1EF824C1EEDA1D24373496083537E5908FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 16cc2fdc629b819f14db505844eecabbd06313d4194b4e79cbf325fe9b4b5353
MD5 28cc5b16f3d2f64c1eddb646c9f00dd1
SHA1 7b48b132f340cc061ea4b883513ae98400d2f2e5
SHA512 90d18b991e037be328ab7fd64e175811a5d10798b65664c7f57ca345fad6bd454ae73dd8154d8b2b5352bdc82804b51fc3c041268b40577098c7ca725fbf9456
SSDEEP 12288:lVZLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:5a/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T19745231727B980E1DC7BC2B0D4A7D591EBE2BC59EA71D79B734014870A763908F7C88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8313b0507f869a461eab53c670f781b763ed75bd49695efeb216e06e418d7b41
MD5 e6a3c035d385dbc193966f313212dbd1
SHA1 ca7eee60eb4c7cd1790bd946bded127e6dd2b70d
SHA512 bbf7d45ff497a246b3837a4d54dd0732c317380bec91b92e85faffc6915a8517a1d0c8007a1cbf2fd92ebeada65d69dc420d5d52b50efa73cc9b7d3dcaf2f56f
SSDEEP 12288:3BLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:3Ba/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1CE45232B26B9D0E6DD2BC5B0E05BD6D1EF864C1EE9A1D24373496083537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 22de995b3e26675f26674a3eda1937f9b60465fe6aab3ac8fa1ee18b7c75df7b
MD5 b5162146f4d532d101ee991e733ee13d
SHA1 c97e806e39f6606138f3a70e287670194cd2ff46
SHA512 f1267dfcaf8049e5c41769bfff718205ef8f5cef9e664bccf5c0e757fd72962302058f66136e47815f89c42ea24fada76a3333d4c9078d4d4843b09740076cd1
SSDEEP 12288:zgLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:zga/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T11645232B26B990E6DD2BC5B0E0A6D5D1EF825C1EEDA1D253334960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 36da4a337d60396b022a1c92a0cedf4b9084fbf982bd64c8e37a03852c624857
MD5 7713fe8c046cb4601522fb0656271b38
SHA1 43f845141a74622ac4e0196aa8be5374da486223
SHA512 aee24b3441bf47ba054eab0986229c5e76639b4169aed3315fded894ac0117ab7b58c244f02566aa0cdcac752bb6ba3c2056ce925e255ccfe766323de879c01f
SSDEEP 12288:SsLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Ssa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T13C45232B26B980E6DD2BC5B0E05AD5D1EF825C1EEDA1D243735960C353BE5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7a9ce4e01df3c1fb84b4a716c5c2e35d580bf5da7193770c7d77184ac8882537
MD5 ddae87285a4f8340da0000d951f76c01
SHA1 eae1918f9783fd4b9c68e4d2124aa4ed2d02ffdf
SHA512 74d1cad1ed477c6fce4f42deb423b729fac20e4ed80175d0649f5427f4cc96f700a502d3e413b47bd759583298cf012b9c16bfa47c38920ada70c473a8cc71fd
SSDEEP 24576:uZMizFVSOEa/dHVnN5VWW+MAOOEUPsxLisaW:uZMizfwaF19+OOsR3aW
TLSH
T1B36501A573A018F8EC67813EC8668942D6B27C1A4B70C61F13E436675F773A04D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f797db86024ebd205ac666ae44f379bebd3c59849e57a1000698fb61062f6244
MD5 b0b14f40bd6d512e0f425f2c7f779493
SHA1 17d6993e96f15df193ce8b15eefdd775b4c7ffb5
SHA512 e8776eb0c10a265f83f9a411b748a6577a8e2d1f6f10e4cd4591d922b734c9911abf0239ea2fa220ac9c041b53428e8aec090a7db1378ec4315de5d8cba5540f
SSDEEP 12288:ZjLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Zja/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T10F45232B26B990E5DD2BC5B0E09BD6D1EF864C1EE9A1D243734960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b375073ac60eb4b9843d37be7163ff791804d388ceb9bb21b51aa4b7ae90cf6d
MD5 ab02e5ec4aeaaf0b742faa9001aa9278
SHA1 4061c02f5487f49b03007cd12acafd32f1988607
SHA512 324be4cb8a5f840a62f2a9850c7c66ded019f3bc7d0aef86b117396959089e0568eff04b38425d3b0d7c9b35de7f2008499ce2f82507f3dc247c400b1b576a9e
SSDEEP 12288:EHLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:EHa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1A245232B26B980E5DD2BC5B0E09AD5D1EF864C1EE9A1D243735960C3537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d607d51640993b305f3a5e3fd14328091218518903568d38538fcb9046ebbb1d
MD5 23d6331d888ce7c3e0c6a8776a9dd23f
SHA1 315134a45dd8937cb5112b3f931a3c4234ebea0e
SHA512 5cdc8f2dfb9be9727732768412c91ac68b54bb26d2da059bb8ae4716b4c908d4170c555a978b2c13d5501b86f7e0b5ab7512ade6af7e35aeda614675e6af3999
SSDEEP 12288:HyPz5L8YLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlo1:qzyYa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T18A55021733B520F9D5378274C8625A42F7B27C364B608A9F23A416B71F376909E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 02bd0af485b499c288c1b7dbb0a9e348a668484f0d8809b2ea3cb4e3391b26b6
MD5 8955f7c67d4c45423404da643662cc25
SHA1 2d8a7cd739dbb9792888f342da4279fd7b5ec1f9
SHA512 f883c74306ceb830b70c86a4967ed6596b543234447ba7f129111e04b8db23c022c3df776f468b759fff27190e8112f51c7bf42e84eb0b49593c559e98c77ab3
SSDEEP 12288:KjLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Kja/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T12045232B26B990E5DD2B85B0E09BD6D1EF864C1EE9A1D243734960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5943ed30b2ab7059651cba7e44dacd79616aeb3a3deda6735e2e708b03c79336
MD5 4827ba05f6cc989f569c859d09030272
SHA1 686040343437931e95d0e70bb667449f1f648290
SHA512 d0f6bbce4172142bb53f50aebcd8c56443ab1b6ab7b25b21836faa9cc47f3c19597d9e32076a7fc81a900470fd0b1df8a80a8906d24a8c130f859115e1e9fb73
SSDEEP 12288:djLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:dja/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T10B45232B26B990E5DD2B85B0E09BD6D1EF864C1EE9A1D243734960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cf872d42717bee510482da7138462d18f436626526b9d44d95a6612626ef558c
MD5 15d570d807ecff141bae611afb0a927c
SHA1 c9dfec64565934180cc0ef3b70bc363d780bb91d
SHA512 df56ca0f8539ab1e8b626287ac9d0bdc7151585a916ca598c9471774d8f2d4615ac3a7ae26afb29b03a152538f825530371149db932120598d49dce5bfd676ba
SSDEEP 12288:XyPz5L8YLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlo1:azyYa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T18455021733B520F9D5378274C8625A42F7B27C365B608A9F23A406B71F376909E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e9a7eabfac2eebfe7f407e4560d75df868ec50e1adc01ed004b3165ce042730d
MD5 0387848af7fbb07b14b09fa196019890
SHA1 42416e3d80394b09da00c05c0205286c373521f1
SHA512 96b736d2eaaa0743d1bbbcde503d8e34db8cbe4296489d0e8f0c90279c0ff5a7c56bc72e834ba2cfd3faf54e29219339c7cecdacedc11be49017038648e63584
SSDEEP 24576:pcP4mcvIjkGOxhKP2l71nNKbrh/8KBLa/dHVnN5VWW+MAOOEUPsxLisaW:eP4m4IpOO67W8KVaF19+OOsR3aW
TLSH
T19B65BE2DABEC0096D0BB917485658A4AFAB1742A1F3286CB1160933D3F77EE14F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 42b3b0e5801317676233f2bcec70e8437c4c1a646607531fe6df3dad3d8ba25b
MD5 25890c85abf5b0b873a2b2dcaddc0dfc
SHA1 1cca999ec06d61831167d723e183c61a327cd70c
SHA512 1286ab6d688bebd51cb3d87206a32ce0f81861c658c35f393013d957056cbee3fc882f8e989e5c1747c94b3f95161c1962df29a787df8ca643607687b9ac73aa
SSDEEP 12288:5csfTLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:FTa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T14655011AD2A841E8C46E9175C7568A81F7637C2587E1D3CB23C0F57E0F7A6908EEDA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c84e8528c83eb62429cd0b2fc698ccbaa01c7a040ec2a71908dd21e6a5451a78
MD5 cee3f0d02efa494570452f7bd0b233f7
SHA1 f946bf2bf63e2034a2e6f19aa461dd1639022381
SHA512 ac37473170a54f28e251d51be0c83dcd86399cca48414579ab398223defb98b256a187bdaae10b85a73ec2abec9bedf8701b5cf66ae104bac9a904f3de7c7bf5
SSDEEP 12288:PzLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE24:Pza/dHVnN5VWW+MAOOEUPsxLisaW4
TLSH
T1F845232B23BCD0A6DD7B8AB0E06BD5A1EB4B6C29DE60C647724421C752795A0CF7C44F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 eac0a1b2dfa2ad50653caee0ead390801ce1ca072ec25eb2e7b4b239312b0227
MD5 e558568b725e77fd643a4ac1cbe91461
SHA1 e99e8f561b210df561498b1d03e964a0c452b908
SHA512 78cacab7a426f5184625ff295669c10b4e4eafdc804b9d626487eb092b61ab0913d8ecc4f20925b51a8d6af53966abc709159601b61d7082168da1162919f28f
SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQBaF19+OOsR3aW:Ha0hNYG4JwQeg
TLSH
T135859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853E3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9ec7b3b541e667e6f42740b96bab9ff4c5e7a4431a4b31480406b9a5240f9706
MD5 3517cceb72e2134f7ed351a11299ee0a
SHA1 3abfe9a1df0baa5cea7be4700ed8a6f975fc9f3e
SHA512 07b2cfd68f69ecf5f79611d8ac2d97beae15d8afd3d780cf4a0358afeb19e793e14e9ab070a3c4e86cea1a05453affa7b63be397d993f8f32261b76b0638a4ca
SSDEEP 24576:zhbHjPUa/dHVnN5VWW+MAOOEUPsxLisaW:zhbHjsaF19+OOsR3aW
TLSH
T10055127E22BC20D5E576D178D4968542D771BC255B21D3EF23C182BA4F3BAE44D38E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d9a7b95387cb175ecc11ef5c95c3124c704845062a74eed7e40476812023cd6f
MD5 6121c22199dc7d81bd23da178e40c7ab
SHA1 e07c4c9cdd15a3d10776d6a189af6093b9f29438
SHA512 94baccb860fb98a388c1fe04bddb9fdcaff40b77190b6a720ea737b45d0615c8f94cf610f63005aa03552fab22f14e10bf28e630331df97ee7d3659a7182f35b
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/8a/dHVnN5VWW+MAOOEUPsxLisaW:VIgnaTk46pBR/8aF19+OOsR3aW
TLSH
T16945AF2EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3c0438d4eb19b9434298a1de384cdccc3effa1fba64aba4a958079c79841817f
MD5 9a35c39ddb817a39dcc9e25355223a53
SHA1 9912a89d43c4b7b7ce75c23f18101903e70c159e
SHA512 b0551adacf80f1e9339a3598c5ea19d524427555f37c9f6c880836a12e4bd02e1045a4d3fd01e655ff6858367e6429075df5293ba1b8381ede4ab12154958c30
SSDEEP 12288:FXLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:FXa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1BD45232A237890E6CD3BC5B0E0ABD691EB825C19DB61D6C3329571C3537E5E08F7C48A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 d46837698d42bb4d8fe145dc0c4f276ea55138a1ffbc17268c1b9ade74fd1e02
MD5 46f3b03bce0bc8edefd16db1fa409b9f
SHA1 fff91e6e6ce8dcb683690d01185162b8257fbc67
SHA512 8ff5e95db9a50741c42feaf48d0cd2acab3f1b3775604ab8eb92797e256c6ff73c50516267d99a37891d970bec5c4c094fb29b46d23cc62c79dc68b8c8c159c8
SSDEEP 24576:KNL3UTya/dHVnN5VWW+MAOOEUPsxLisaW:KNL3UmaF19+OOsR3aW
TLSH
T13D75F115F7A400F9ED7BC13CC8A68A12E6B2785D0760E7DB13A84A561F637E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 25a50bc4d4dd44c48de58ab644a47f0daf811366bcc6461e9f3581c32428e43d
MD5 7e4ccb14c9ac26238f190e32891f5cb2
SHA1 fd4429d6e4bec61964941878474e8f86d817c6f0
SHA512 75d4efda0ca89482721c54b2c9910ae99683d9016669a5f3128b6aeeee4ae4f54ec3b36adcd9ff159ede52fb675cfb7b52154ca84c51829639c92b2484f7fcb8
SSDEEP 12288:fpFt+OGLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlob5:EOGa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T14355022A33FC10E5D53A9178C5938249D7B2B8664B2293DF02D081AF4F77AF49D3DA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c37bfa27ff48edd5b1d412669bd864b3c46315053ed9e34900e080f82a0d6831
MD5 fa6119a790564d065903be29766eaae5
SHA1 28bcf9f47b0750bc17049741829b67d095ea4517
SHA512 d90a8eaf89c96940f0b5aaf98426948bcafb5018942140add9195d73f588d2d946b427ac508ba602e962467078e6726fce2fa1dfbe19585c3c707b377afbd7a2
SSDEEP 24576:B7NM9YqZqmWMUkPjZM48Mv6bEhsja/dHVnN5VWW+MAOOEUPsxLisaW:B7cBWMpPjN8DbEh0aF19+OOsR3aW
TLSH
T1D0659E2E6BEC81E5D477D13DC9A28245F6F2B4611B318ACB1152833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2637cb21a3e9e87d69591a4635d015b241646215e0b58096b7057fcd199563f7
MD5 4a2b33dd53a22df62e90bc9ffe361c97
SHA1 4e44bd428ae188350d417d168502eddd06c18a83
SHA512 c71a801611ad5a9bc400b16fa23093ea2b00b01d630938885eb05f1654022ebacd2270102203b9a09900c402587845efd593ab8dc001fc849ef580ebf5cfb519
SSDEEP 49152:OF2YuHNETovAvNYf8kmDaF19+OOsR3aW:/6BCf8kGeg
TLSH
T1B9857E2A27ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9642d256c804ef1f242f402d5fd72e3569c5742371a2c2ff85a4e91aecb74b44
MD5 78474f78f20c6a1a98149a370e0d88e4
SHA1 c6d7a412bd75b35fd9c46fba70755084e3879dea
SHA512 74c57637437bd174241b7d8b44b742093650df786855cfefa4bf428a71ba9f8118b8f342ed7991f85a248702b355293021c8027886125376b0df70489014abd1
SSDEEP 24576:8AFs06+OmlfQNXEbToqa/dHVnN5VWW+MAOOEUPsxLisaW:RFs060lcXuhaF19+OOsR3aW
TLSH
T13B65AE2F62AC00D5D07ED17E8997C91AF7B1746307215ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e3ac8f8be24e6c27ec20b80772a3b57482f45d1f03fff42b0efaa6e003407b35
MD5 af1d525b0af910c76fbc21375318c26b
SHA1 d2d64d486ab244c85fd3aa1142942376e295389e
SHA512 0c819344980ca143811992e84347ff4fcb4d004dc78d7cfe7cae5169fa5d252e09506743dc29658163b9fd6363973b3b57c6ae007b89ce27e02b3e47fb85d3ee
SSDEEP 24576:EJnJ5D3Wtha/dHVnN5VWW+MAOOEUPsxLisaW:EJnJ5DGthaF19+OOsR3aW
TLSH
T1A275D02DD2A810E4D4B7C274815A5796FF72383D2F226AC724B4D5353F22EE09A79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e646c30adf366665e9793638663187d3229c82727462ddbe8e43b7245e286a38
MD5 8295bde6b2147445035d9ae5deed24ed
SHA1 13fc5ea3c329959b7544d384ae5cbdf673c872f3
SHA512 3da7720811b5686c74568bb3f4b07bb33065b69e6a7c23ee08dd8d852adede54afa9e74f79ad562820636af9eccd13eeba92b5a98f39539de5713fd62e8f4950
SSDEEP 49152:dg06DIKdwc+eQnSt65aVPaF19+OOsR3aW:2teg
TLSH
T19A955C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 165d381087f78b7460fcd6135da2e422abec314f7bd361ae414a4ee238d97616
MD5 5e9b140950463675296acdbd5fce2934
SHA1 1f9afaf910dd9ec5997e50c2432350f9bc9f8a6c
SHA512 86f0239d307ebf6f62cf02f33b6c668839ea999cbc33b8816c7bd7dce60ebc36df5c268c48c8b5c02bd29082d1f08becde81e5011afe202a9cfbabc5f3d795f2
SSDEEP 12288:9EP3RBlLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlob5:eBla/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T10A55122E27BCA0E5D43A9078D0918641D7B2F4356B6267EF22D0C27E4F77AE45E3CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 e36f50d3eb18f0ae380afa23f2dfa04df9af5ca3ba49e03f62a093e1e1ebb5b4
MD5 30740a78dbb08cd35676557914ab791f
SHA1 0027c75b4b6b84474faeb0a6ab5420993ec21dea
SHA512 6ca40ad58b6ee37aec0625eaa4b020f3f12955f1f6bcbdf0e98248ac6e834f22f63aefd599839088a7f0b8fa5d8b27018660d02fb99eb8da560cfc61adaf4260
SSDEEP 12288:ejkykLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:eIyka/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1AA55120923B8A0D4D97A4674D9A38191DF71BC209F2193DF6180F66F5F3ABD09E38B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 254a9d66e16766b810b09f1d3b03541be2f6b7ff9f4c1714663d3095c849a2a0
MD5 1f550720e54eeb841d2252bb124156f6
SHA1 8ec4bfde9b4d0fd62ab53a1392f7ad1a65fbe831
SHA512 1750bb042684210f9800ff30a67a81f98868036a6d5fc5a0b1fcb0df1007e25a428d23cc9213d39b6cf6b433b74897f2087e5d00f771dea3e1d1e649c49f0bdb
SSDEEP 12288:WEWLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:RWa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T14145231E2374A0E5DD3B85B0E06696D1DB923C299F6095E731D4B0F3877A5D08B7C88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1be00b39210962122f42292d69b1e580ebce1d8054bfb1152f000c19ccc8a4da
MD5 1b8ecc1988784cfe8aa11f5196836692
SHA1 1394bbf7f3ce6473f15f030913fb25290489ef31
SHA512 e27560357a91287da3c99226cf2f55bfe4f7b33b8a4b69b82e32bba8e6e680e54e9ee661827cf2fc6ea4a2ed2bdefbb032854d453e83a003513b87e80ec490da
SSDEEP 24576:xQ9MxZKdcz9dw37a/dHVnN5VWW+MAOOEUPsxLisaW:xVKZ7aF19+OOsR3aW
TLSH
T15E557C2DABF9059AE177D27594A250C3A673B4311B31D6CF2048D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 afed935f327a6977a170ac6920eac40b85ec63124fa11a1f918d8b7d9ff08cbd
MD5 1e6476bcc371eefe313e78268041cc7e
SHA1 a6a06308610d9f92267f499520d6eeeffd54c078
SHA512 2580e351c41fc940e77facd9445821415c2f31cab1bd1cd68cbb4dd7b392cbaa174c1c63b0cbe0c5fd78d4a52a37f86fee0dcbaedfbd17a54a00952fce633758
SSDEEP 24576:CyocBApIa/dHVnN5VWW+MAOOEUPsxLisaW:/ocBApIaF19+OOsR3aW
TLSH
T1A365E01F776940E2E176813C89858745E7B3B4345B6253CB6291C33E4F77AE8BE38A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 07218fac7c0619f7e0edf8fc7b46f9e47cb2c243fdb6d3727902d9b2a1ac075d
MD5 340bdbffc43f24970e27c47623b196d1
SHA1 b9166084af035890752f476b835c370974ed19bb
SHA512 03b2d38fe7417c2762eec3f91bf3afa2ba49d6540abc5f760162c883dd94a7b2306d771ec2f10e2fc3fb17a15ada2eca3005e80208783d859adb7be0be1f92be
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKIaF19+OOsR3aW:m0zuNIyeg
TLSH
T10FA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd46518dc4ebff66a77b65a8798d7f34a1e3849eb248f4425d6c9efb76b176cd
MD5 9e4da776c14d87cb629a474903e791fc
SHA1 3bbcbc92116c18ce42158c438f7aea5963051b47
SHA512 ebd859fbd11c12413da86c170d29ecb043e8ea971288f442b1befa187457db4e39bc565b6f537db43d4a34cc3dcfab1a76cf57c448f93b85e6d6529c22df5800
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYsjMqbla/dHVnN5VWW+MAOOEUPsxLisaW:PTDxR+N5YzTujMmaF19+OOsR3aW
TLSH
T18E55B02EA7F815E9D17EC5799A23C512FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 f1762967e99992204e451a19025460ad9cfaad05cd88a2afd57fa4519704e44f
MD5 5a710218b5f759251777c53fbabc7823
SHA1 9aa324d46be54183706a499d2c968bbcd28c12d3
SHA512 08f8182aa7ec89ab737ca36789d93e75cefc41e0c8efe22b49d8774930527e23aa4f80464ae74fff0448689323ed5ce216498d5837939fb24827adc929696153
SSDEEP 24576:8TMdOz0FFS+DmSLZa/dHVnN5VWW+MAOOEUPsxLisaW:U0K+DmSLZaF19+OOsR3aW
TLSH
T15D75E13E636D14E5E47BC17DD653C906EA7238650321A6DB02D0C1BA2F6BEE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 01507551f4bb9e6d00051a9bb78585462deb3ad581b1250719495707a4620a63
MD5 894a17b5a8731b46a21e5dd07b2ba995
SHA1 42bf78754d870959d13bd5bf42b203b84cb964ac
SHA512 735d85ddea427a8cf8385edc5565cb75c7d127ba8e636c93c3fd3801cdaaf0f454556bf3815661eb98b847b23c82360fe8e9b7de591e2c83f81751ad5ed4bb32
SSDEEP 12288:I44yLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Mya/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1A055121E23F870E4E8778270D5668292DB61BC36572196FF31D0D5BB4B3B6D08A3CA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/564-208-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/640-377-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-401-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-388-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-389-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-393-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-394-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-395-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-396-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-397-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-398-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-399-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-403-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-404-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-402-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-400-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-392-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-390-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-391-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-387-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-386-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-374-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-375-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-376-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-378-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-379-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-380-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-381-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-382-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-383-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-368-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-369-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-370-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-373-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-372-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/640-371-0x000001912B6D0000-0x000001912B6E0000-memory.dmp

Download

memory/784-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/784-203-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/784-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1088-120-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1088-366-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1104-24-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1104-112-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1104-358-0x0000000000BF0000-0x0000000000C9C000-memory.dmp

Download

memory/1104-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1104-17-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1104-18-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1820-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1820-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1992-206-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2156-362-0x0000025409130000-0x00000254091DC000-memory.dmp

Download

memory/2188-90-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2188-327-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2188-96-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2188-97-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2568-101-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/2568-13-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/2600-131-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2600-124-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2600-385-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2600-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2740-207-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3180-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3180-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-363-0x0000000000D60000-0x0000000000E0C000-memory.dmp

Download

memory/3180-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3744-40-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3744-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3744-34-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3744-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3912-103-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3912-108-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3912-384-0x0000000001330000-0x000000000138F000-memory.dmp

Download

memory/3912-328-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3912-102-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4584-9-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4584-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4584-71-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4584-357-0x0000000000760000-0x000000000080C000-memory.dmp

Download

memory/4584-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4764-82-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4764-84-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4764-269-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4772-72-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4772-365-0x0000000000650000-0x00000000006FC000-memory.dmp

Download

memory/4772-218-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/5180-113-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5180-359-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5224-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5224-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5224-56-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5224-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5224-68-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5256-185-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5256-360-0x000000000C930000-0x000000000C938000-memory.dmp

Download

memory/5256-422-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5256-169-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5256-209-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5256-201-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5540-212-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/5544-204-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5944-364-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5944-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5944-367-0x0000000140000000-0x00000001401D7000-memory.dmp

Download