4037e0cc6fd32b63c33500f9017912538e2ca977e09643bbe913e51735f99b8b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260504-nc2dfahw91
SHA256 4037e0cc6fd32b63c33500f9017912538e2ca977e09643bbe913e51735f99b8b
MD5 7fbb45760d38921222a4d6cf2548d8e0
SHA1 2db29b535bce212af719022f5d4bf980e57498d6
SHA512 76c283cfe4d25f52c7594ef4a67e5ad4089cfaa9e3a5927da0a347a438224a70677d32aa0e38ed4c6edde0a9bdcfdd07e4f55d5bde0188c2ac52e4daaa7789d3
SSDEEP 49152:Mgh8jK3xEPK3Hkcm4L8A5iltfJJnB58MlSKl2HJpfaF19+OOsR3aW:MMYTKXkcmjfJiLeg
TLSH
T18CE58D6D7AED00D6C175E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
788	alg.exe
840	DiagnosticsHub.StandardCollector.Service.exe
608	fxssvc.exe
4984	elevation_service.exe
5832	elevation_service.exe
2300	maintenanceservice.exe
5300	msdtc.exe
5256	OSE.EXE
2588	PerceptionSimulationService.exe
1700	perfhost.exe
1684	locator.exe
3956	SensorDataService.exe
1560	snmptrap.exe
4208	spectrum.exe
5772	ssh-agent.exe
388	TieringEngineService.exe
5528	AgentService.exe
5716	vds.exe
2292	vssvc.exe
5808	wbengine.exe
6120	WmiApSrv.exe
5280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4d22f2d98b62accd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000092e0b69b7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000091d7f6ab7dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d456f368b7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040c68469b7dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082b1af69b7dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023052369b7dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb1d606ab7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020ca2769b7dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
840	DiagnosticsHub.StandardCollector.Service.exe
840	DiagnosticsHub.StandardCollector.Service.exe
840	DiagnosticsHub.StandardCollector.Service.exe
840	DiagnosticsHub.StandardCollector.Service.exe
840	DiagnosticsHub.StandardCollector.Service.exe
840	DiagnosticsHub.StandardCollector.Service.exe
840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	608	fxssvc.exe
Token: SeRestorePrivilege	388	TieringEngineService.exe
Token: SeManageVolumePrivilege	388	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5528	AgentService.exe
Token: SeBackupPrivilege	5808	wbengine.exe
Token: SeRestorePrivilege	5808	wbengine.exe
Token: SeSecurityPrivilege	5808	wbengine.exe
Token: SeBackupPrivilege	2292	vssvc.exe
Token: SeRestorePrivilege	2292	vssvc.exe
Token: SeAuditPrivilege	2292	vssvc.exe
Token: 33	5280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5280	SearchIndexer.exe
Token: SeDebugPrivilege	4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4724	2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 800	5280	SearchIndexer.exe	103
PID 5280 wrote to memory of 5040	5280	SearchIndexer.exe	104
PID 5280 wrote to memory of 1744	5280	SearchIndexer.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_7fbb45760d38921222a4d6cf2548d8e0_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:788

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5060

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3956

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4088

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5528

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3024 3052 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3036 3004 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3670bb5566e3bdcc0ca0e20eee9d6b998f75969bea5b9190e9f1c7f2aa89a3c6
MD5 26fa42546a7b93a0c0df858115fbb497
SHA1 ccd3808d1e88e88ff5a2b794d3e9b563802bc0e2
SHA512 ff75d0d98be586d43bbdf712156f581dc93612bedd0f831a58341635957ae2bc8a3824c0744886300f9910479ecfe37a3d3f14454634111cf37ae42e51ef1cfb
SSDEEP 49152:1b+632BuPkFKRrdE6ohrstBhuXjfS4LWxn1aF19+OOsR3aW:L3q60jB0eg
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f3ed345f0bb52d99f22826579c69f7900493a80714d6fbd2e71165a3b4d21449
MD5 b4c4f2dd8b867a4d297012cdb3cb9a6d
SHA1 bd0d563a11ed12fcea763be1fd3d84f0d489bb0e
SHA512 356e55c90c3b47a9778631002cd8dd17495530da76cc2110233411624f2e021be969fff5e1057a58729099da0a4b9ba722e04c70f2e1dbea993c53ed64842b6a
SSDEEP 24576:vXYfDtczAoa/dHVnN5VWW+MAOOEUPsxLisaW:atczaF19+OOsR3aW
TLSH
T16965F12973E408F9ED678178C8A2C511EB737C5587A0E78B03E499661F332D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 35deb6a48a775cc9ed29fa5c616eed0696bcb529a1153e2c741536d7ddddfaa6
MD5 5da210787f84b6975ac8c32d5a88f49c
SHA1 cfab49306ce1752b20113c41d979902247ffa36c
SHA512 8c029afcf3605e13e0ca1a91a0a449c986a9e461899af2e8bf8810f1ab96f50c4226edd4a1e0846cbaba80768bb0b5f05e911d305ff0bd2f3372ec6f7e746bbd
SSDEEP 24576:N0Le5ji0hmxzrMda/dHVnN5VWW+MAOOEUPsxLisaW:NPji0Al6aF19+OOsR3aW
TLSH
T141859E16F6748331D073C0B9C5D2A69AED7230865B308ACB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8a3f0625b12a7ef43c37c07d61223beac9a0a0e80cc0ac58be8a2d0d35439d45
MD5 6f50e48aac30b94dd0293f725d1f6eaf
SHA1 cab47b0588b592676e5ae504d816f80b0c2e62f3
SHA512 68c25bcf6865259ccff78013dac8a1dfedaab8ffc88642d7e2b70a36c709a45c63a3a2ea3c4a74189e6e129f1e950075b57cb45c48378d269a21d2630622f5aa
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWr6q8wyuDa/dHVnN5VWW+MAOOEUPsxLisaW:R/ezSC6vUzPviHjyeaF19+OOsR3aW
TLSH
T1B6755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7e7b972fe55d828b2c7da2f31f1a11d8c09e53ff479dfe71a2706a5cabd5b14f
MD5 09597e315f932fadf2e31fc992e32fae
SHA1 308c6f377237558b43a998719e70fcd13dda455b
SHA512 127595fe6448515b4e4ee7d4286eebb28357cc09effa47a7e8c870447ddce9077a0edd8a233e65a06f680d06e9cb6f2efd7cbb813c07edf85de3a0cbf3bea3d8
SSDEEP 24576:nVbqPb88hv/l+bEa/dHVnN5VWW+MAOOEUPsxLisaW:nVO88hXl+AaF19+OOsR3aW
TLSH
T18B559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 71932e59be6b054f4dd2e0f610407c1c59049ec64bef2091a22dc5924dfd0994
MD5 500b013bb12e7ac5b4650f8ad304a7d6
SHA1 7484c02a8511ed53cbc6a85dbc9637c5ab6dba5c
SHA512 56180ac7456a426c9bdc6a50c87bb423476768acc42e726d7f15ba68e27488ae715e9511deecfacd640cba3b4c2a48e5a8341311035ca7698c783e2464f56961
SSDEEP 12288:c95LW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2b:c95a/dHVnN5VWW+MAOOEUPsxLisaWb
TLSH
T15C452327177890E1DE7B85B1F0AAE9D2EF824C19D8A0DA03729475C7467D5A0CFAC08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e20e3766cca62cd29b17ee591d536bdeb229f05db366f0cadc2eb080ca930c79
MD5 247d6ff833213731cc6d3600d80e1ce1
SHA1 3874c0a4588615fa33749212acc8e13b925de1ed
SHA512 6a96d8107712ec63ff49e3817cd2125d7d9ffb96c1f201b215d71f735157c5d3015ab2c58d20feb5cef16a57857826e5fab82be337a3bc618a59983cf644b1c1
SSDEEP 12288:NeBNUbTVO86UsLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGsP:NJIUsa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T10265CF3BAE38FCE2C67E8DB85691C640D76278304F61A3CBE165824EDE235E05E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c11e58f0bd7ef01f05fb2474b09f64fa87584931bdbe5fa14fea7d85e6d2134b
MD5 deb7f908d9483fc4e9fb0c474b16f55f
SHA1 45a5891f13957b28933fe9ffbf51dd5d147e0907
SHA512 1b21e1b4e01e51537423fbd02d9e43ec73f426e8761f237783f65be377493646d1a7869bc9b8a350083b5fe119321edd6738dbd7ee2f9b3593e06560c84f68e4
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH5:MQvGAdlCEL8c/RRNw5CTeg
TLSH
T147266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b057702665ddb45368774f165629cccf70a4bf9748c3c56e4ca1b10a5d116ff4
MD5 8d4dce52a54093d1da88dcc3a50efed0
SHA1 18382068efe0ed18536e51014a052f4f8ef59c30
SHA512 dee0bf54f91cc6c7a33226c76aa7161e9f847683869c84915473cfede60bc2727b6fa3005ab15b61dc3c071902b6735aef17ad42c0eec8844e3e05a3555b615a
SSDEEP 24576:7sewsAjKa/dHVnN5VWW+MAOOEUPsxLisaW7:gljKaF19+OOsR3aW
TLSH
T1A475E031FA74E032C67F0DB21B36C716586D79204F611AC3E3E85E8E59342D2677AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ff0e59ddf3fe4d0e07009357442688d64f1606029ed5da9058a82da22047f683
MD5 b844ab1e2f1977d9f0382c58a18017c4
SHA1 5a74f3193b1fb14a8e9f2b1223fab7514b6406da
SHA512 5ac6708942f9ab281b250ec0426c6151a5a0dab95fa844df3ebd9d5170a923fb98368fabea80cd7d5dcb134b9fba9b2a88f8f343db54a7fd6ccf52ebe9c2e32e
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHCeg:kUEtQevvqc2W1cpV2RI325
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 87dcd735ce9e9904d3866f14e8bd9760fdf54453c7df08b345a11ca80fc777da
MD5 3cf3f0178f6a3bf82fff89db10fbcfbf
SHA1 4cf7872d9de1e12de067533670cefa55cc4d4df6
SHA512 04f861f3765b0066ae8a384344003cbb5afac9ea0ed15c04777920c0017a44049dbea83be0477f01725c088bf5f22096171a38c376b2124b318a0b7f844da35e
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zqaF19+OOsR3aW:voq2Vjnmneg
TLSH
T1EAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 17db5d6657f30b9c7e4978e32418d9fe54e55dc66d8ba3c0fbfc7b81cd1d69c6
MD5 0344d4d5678c704e5310f5779497d61b
SHA1 1180e645cea41f24e09a8eba22beccdb215eaa46
SHA512 b52e86ef951f21f547297e6b914b2a4e36bd51cadc163230c6fc38d4e197f4e9a4b4b553300a3876f9a1807cab3f6251cf563249a52c7575261bacc926d4384d
SSDEEP 24576:SAhGL2IFoiwtA5l7S53Ha/dHVnN5VWW+MAOOEUPsxLisaW:SAM1Foiq53aF19+OOsR3aW
TLSH
T1FC35AD81E7F955D4F5B3AAB899B69171EA76BCAA5E31C20F2150D10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6edbe9e9b14fd2f0c8feb96cfdaebf2c485a26e14db8648ca32a82ea0d733aa8
MD5 2e7d300226e2e45d22cbd24255bc6cc6
SHA1 fbd2350b7f3707872553cb0b57dc66b706e6890c
SHA512 0a940508c2ef26195ad77886b097e153638cca9573760b9ffdeb6c6a3c098ac19f8a02a47bb6acb417b5e0481b74d4d56e1cc06523e0580f6d803935b66de9de
SSDEEP 24576:AwuROW+a/dHVnN5VWW+MAOOEUPsxLisaW:AwuOLaF19+OOsR3aW
TLSH
T17C65F14A36A41CF9E9678138C597C532F7F2BC162A21DB1F1360C65B5F37261AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5ee7158c91068414fd2648e019f1092d14731637b021c41d658acb8ca38243cd
MD5 7a4c8292310491d647a836d8543ac585
SHA1 c81be753e0d08bcb54790a8bb5ee5fbccae4b49d
SHA512 7baab478f733df095739aff92fef4994705ebb1183618a4d525d2e97b676adcfab0887cece36091f7875c10a3cd9685e93c2399550eac7249aebd5936f83fcac
SSDEEP 12288:UFZ1IyaLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlob5:WZuFa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1AA55125A33F460F5D5A78278D8E69641EBB27C16A77183CF226442971F37AD08E3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4a2afa7d8e20f0a7739c14d344d8b9809c0116a7ca91b68d0382cd0c86577dae
MD5 b6cbd5d0810cc9bdd388bd1b5f2ff513
SHA1 73b2f48c479637c9cea5d540c125e313ef976de7
SHA512 6a65217c0fbb405572c8f462d877aa4b0ce66dcb6a1dc51f5c46b6388aa1213172b9cb32cab39186a3544bbd294664c4c78e5369e18044b765c2548f44c176d7
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UV:HQRQyi36YOcPhLvw2gAf+PN3Qeg
TLSH
T1E1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c26a414946ce4bfe2454edb7ea7a19397fc2293e6f7f7e57202c07d4b652dde0
MD5 8bddb6af569c168dda7f40bd76967fe7
SHA1 e070bda21ef31d1efd1c25b7cc5fdaa722ebacb3
SHA512 ac29041bb7ea7452980fef5cf868b7cbac3c2b9e9eeba1ca113e83169bdae81b289ff25542bf55bb4196d798222b4c37a0424e5ffef4ae45325207140044f9ef
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UV:1QRQyi36YOcPhLvw2gAf+PN3Qeg
TLSH
T1ED667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 49d28391d195fd1d49e4933d0b54507921bfc21362c2683c3d26095494419f02
MD5 b3ca1f8f3e17017de5cfab2f3d058aa0
SHA1 5f7945bb679cce358789de9b052dbfcb56126686
SHA512 db46cff0606e981837eeb3d4a01ed2629e74ae7b0f50a4c6de78c22e866d06dea09891587877528cc4d0ab24d3b4697483af468f60d50585840a463947525afd
SSDEEP 49152:468Qg55nhceWu7PNU3/6aF19+OOsR3aW:CthLRc/6eg
TLSH
T172B54933B2F600A9C44DE1769F4A972196D27C75CFE0E3DB811172461BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e1be252e52fbabb8c677acc0a2eaa085cb5ea8a3246f85a9adff094ff9c859da
MD5 297e46f4d4a719543c511a4e3e98d6fa
SHA1 ebe67a4fe3021d860769ae3d924d98f4038c35d6
SHA512 3ecda2beb1d5df323b7c20c886ff00382b994837e471f482e5b8edecf0048c1af3d1ba935e0a70ab8436f49ab5e579242da0313cc3daa754ff41724949293864
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99L:My5112gYy5azzVva69nLKnhZ5eg
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b1ceee205116bdb4964113cce40c3e328b9aeca2c8ff5f6cc19c8a32f5944582
MD5 9d8719ebefcfda63fcbc8021bcea80d1
SHA1 eac059c9360c74098bcdaead76f647e9a2bfd31a
SHA512 cbfd1efd33a176bf2a64029a74b82f1078ec64f3d14fd0b23073f32058491bd946312028955b99a9ddb6209cc6dc9f6f483096a1e8a489e95be471f00482f7ab
SSDEEP 49152:kB+taZ3usBWOBr4tEG20bqx0z+n217aau1glYaF19+OOsR3aW:+u6JmUxd2dYeg
TLSH
T150D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bdbeb3f8db77e5b55b6fc00dc9fd96c77cae3270db37d9d7719a3456112e87e4
MD5 e42bdb808645204ef69ac6cb173ef5ee
SHA1 4c5c26ffeafdf35788e938da6622bd920c84c31b
SHA512 da7b07e0c4d64f0d102f6527a50371eef87bb63dfb5f35b1559ac718877d59a2b271d8a3c74e28a222bf444833fd2ffa563db25c40ac449b6c6e8c7149ae6f2c
SSDEEP 49152:a1hpsNoJpF1A6BU44CwH7R4xMaF19+OOsR3aW:amifPkRneg
TLSH
T138B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BAE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f2d87a5def6e6960a7da2ac6336cb9cf611d2715e61537cd89f73f941f2951ad
MD5 fb1018a4abab0797a580e2356b77253b
SHA1 53a27cbd9619558047386886f57888feac467816
SHA512 adadfc364fa20640a386ca051b472cdc20507325683efb179f1867e4482778ac18b95c22a1567812f0409e7c336d6d93c514abab63cccb879eb74543d5c63523
SSDEEP 49152:RSuZQIY0Be2KNRVtOnks6NMHqFaF19+OOsR3aW:/5dKvi61Feg
TLSH
T19BC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4396fc8517d85d3e977745847e5695e09d3029b9bc28f20d1462dd27c20e986f
MD5 bcbc1f04b359d18cbeee0633cf8a7854
SHA1 6d224b316518dc7e7c2e30c3f18e3b4980c3ee29
SHA512 09d589c622372d39102638cc833d7af1607010b73a9a6d83710817f3ad2c5870aa27b9c994e8104fbfbf3c3d30f7ce734171ffd26b57ce549c3eb51bf2fbacdf
SSDEEP 49152:PhtSn8EApI0figXgiDn0AP5woaF19+OOsR3aW:eX2iyphreg
TLSH
T15195BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 40f042e6144e18346acd27a4421b8e1a9d4d166a6e8d69bc980bad7f2606d179
MD5 21a385bfb38435a44297d6fcf8931552
SHA1 ccf83f50a701d677815acc24431e13090246aa72
SHA512 330a8ef53724771c222d4082c170c5aa4a59088247307b5c563a5df5798a2f024935c2b9a82fdb7a1c1ce60e63c69b6f8e4fb5da1d2914e861bab9d4ab166cbb
SSDEEP 12288:/hLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:/ha/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1AA45231B26B9D0E6DD2BC5B0E09AD5D1EFC65C1EE9A1D24333496083537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 01ce9830d98190afd1e51b7564ba207016585b25a0fe05c114fa9beb0bc9c944
MD5 8169cf194ab51a9bb7164f145df57423
SHA1 c8adb02b86c97fea3ec424c9d70ca396c15d2314
SHA512 37a591569e7811964da407da986717196e03fe99d7ffea16eefff41387f6fa753202cf3b04ae2e0260e4b0d73f06fe5d0dc1c3af2831e311e3fe566e759919b1
SSDEEP 12288:5WLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:5Wa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1E945232B26B980E6DD2BC5B0E05AD5D1EF864C1EEDA1D243335960C3537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9838a1d19b1c8653460fd6b951f0c8ae11afd0b9e5fd6ef9f73ddada12707d22
MD5 e89cecd828dc12b3816a9759e29b8dae
SHA1 401cf0d951b23eca068b470b775632b03986d67a
SHA512 6dd4c2b5175245f1ee7840979ef5fc4bf87412c9ab14e15fc78e33cd24a6338f8e9c7ff82c9da8208cee695acd33ae1a7fb9b77504e8f338e7d949a29379decd
SSDEEP 12288:x0LW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:x0a/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1DB45232B26B990E6DD2BC5B1E05B95D1EFC24C1EEDA1D24373496083537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 73b6b0fa995a0c797f4994b2fe623313759dd3b408b853067632b6e438aac249
MD5 18c9a907348cec27209f2b050df4f756
SHA1 8d5a568f19df58dd9d31bc8049e4a7c9c0cbc0fb
SHA512 332b383feb56781d3a5d05431f236bff87870ce8f8eb144c46fda26345faed773bd9aeb3be19fc52047dd7d93290624d93555207c8122a21ed18b842b71910c0
SSDEEP 12288:KVnLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:ma/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T13645231727B980E1DC7BC1B0D4A69591EBE2BC59EA71D79B734014870B763908F7C88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9da2997dd85574c064a9487f272152c769f6adefea8f1a067d7de381dd25c28b
MD5 1a2176c5d94a81783240693e179a537c
SHA1 54556c9079f7624cbc82d414a01adb2b533c936b
SHA512 3384f87dd1241a42e076c7fb7f3c2af7bf8cc087e9aff0ffca3e2094d3e64575812d33842ccbec8948c9b5d39f35d6ec6bcdb74910c9cfc16ccf88eb4416243b
SSDEEP 12288:jfLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:jfa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T12E45232B26B990E6DD2BC5B1E05B95D1EFC24C1EE9A1D243734960C3537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dda10b35329e75af410286ecdd1de6aeafb099c807095a6ae780b46fbfc3c644
MD5 734bbbb307e421eb1cc8ce728d8926d6
SHA1 6a64c865b9b1e63b48fec71e566fd633907a34a2
SHA512 a8396ab49067552b7f4b024428931f64f40ca68d4fcd33764312d3537828c7e297b73475c7301b1991dbf188bd360dfdc5e9f0b1de38234eb9bc8f6b03a55b66
SSDEEP 12288:aSLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:aSa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T10B45232B26B980E6DD2BC5B1E05AD5D1EF865C1EEDA1D243334960C3537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a6432dcd8193a0964689cc183d35079ad674f87d5b1c9d8d48a725490f9dbcc6
MD5 68bdabf2d8dc6fddd7fd553cc00d002d
SHA1 046914afccde2a2ffb716e026322ea46eb420ce8
SHA512 c0259a4fa3f91728118bdd158558cea630a8c397c7cdef8ebafb915777af46b49ada3e83f0109407c620c138abbf9f3d43deafe07317a8cc3d518919a6bcef39
SSDEEP 12288:XuLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Xua/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T19245232B26B980E6CD2BC5B0E05AD5D1EF865C1EEDA1C243734960C3537E5A08FAC4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2ad9c247af5fee66dc308cd74a39b46ec5807a6ea2fcbec430ed7786c7bf0536
MD5 6ff464f098fe9f10fac7db15270e522a
SHA1 6c42581522b5c77097e3ab0daa2dcc74a64513e6
SHA512 03ecb3f0252f1b1c71870d0ccb0816caebc99e1d6c9d74d5448fb994016c532a5017aea3213888d1daa132cc5d0e49dd1c2335a2adde3141a9b193947ce26de1
SSDEEP 24576:aZMizFVSO2a/dHVnN5VWW+MAOOEUPsxLisaW:aZMizfiaF19+OOsR3aW
TLSH
T1406501A573A018F8EC67813EC8668942D6F27C1A4B70C61F13A436675F373A14D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e27147f7ec56492cfb5140a69fd08c3445c37fa830cee5d5bdd3c6307373b17a
MD5 24f63eae6a38ac8a99f7f50c9440403c
SHA1 f631416111c3b56493508619aa11ad29ef160a74
SHA512 d323023382c7dfe04e085937ad6f2dfe99530c24bb4497e2f160a96ee45c16d3283dceb58c697e6ed764f042a264f4e10d55e7614ae4ca73bacde381756ab24b
SSDEEP 12288:pVLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:pVa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1DD45232B26B990E6DD2B85B0E05AD6D1EFC64C1EE9A1D243734960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 aa2c0ebbf4d5fe216422a6737b4f3eed9a44657ae1f2af68c6196e02d983200f
MD5 f866abea9c6fff71803472ffd472638d
SHA1 8b703e891039c865b8c18666f3efbb00664aed16
SHA512 a49598d7acbbe3412d8f303bb8d13301a699eb360541c07be4caf2e2f3133aa94ee83732c089ebc08829b2b4be2affcf6072aca144c09e95ba5f76353e56d79f
SSDEEP 12288:sJLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:sJa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T19A45232B26B980E6DD2BC5B0E09AD5D1EF865C1EEDA1D243734960C3537E5A08F9C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 efd4a2bf1eefcbf20a409d0a100762f26a13f086b79bb86666c24061dc16a62f
MD5 750f57469ff7136a1003d4dd629cac0e
SHA1 e8e57e6d67aef76481f5454ceba1b77b8cdd9f11
SHA512 9842ffe9002447e3a68c82a74cac89b669d06fc647840a48b08fc8726886c5aaaaedd06a2b7acf60c5175cbe8004fb2878f421ba14561f6a5b94bd06f921a629
SSDEEP 12288:SyPz5L8aLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlo1:Pzyaa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1FB55021733B520F9D5378274C8625A42F7B27C364B608A9F23A406B71F376909E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 32883df7cf0e719c8aa3c16d8126b936561b1029d80cf76dd58d70e733937392
MD5 2f594768670c1ea023ab7fdb40d6dc31
SHA1 15c9c5831cf0cb51c1b96eee399c4a5f4130bdfc
SHA512 82c5163a70a43298f511c98df17d320dac97b8e7bb7149b06d73bb8f32e593ef03c5083ebaa835e96b2ecc352475c797ef5a5a7ec3cbf5b270d4cf1c0cb7073c
SSDEEP 12288:OVLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2B:OVa/dHVnN5VWW+MAOOEUPsxLisaWB
TLSH
T12745232B26B990E6DD2BC5B0E05AD6D1EFC64C1EE9A1D243734960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a9886378ccf19d35e4d43bc2f51959cf97b63414162cc362d81ba8534475827a
MD5 d1dfd067b2414b11f5e537ead35854ca
SHA1 b8135c38166c0debde5137212a176ee1545f13a5
SHA512 183fea74adda42361918b35ff9da43363c91045a2a8768bd052c496e0cae4a5f9f132e5cab854ece89c395bdfdf47b16b2b5cc790062911548ab87b5e0a8938a
SSDEEP 12288:eVLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2B:eVa/dHVnN5VWW+MAOOEUPsxLisaWB
TLSH
T19445232B26B990E6DD2BC5B0E05AD6D1EFC64C1EE9A1D243734960C3537E5A08F6C4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5f304f70a9ef29958eb6370829c44044f18449cff0613c05c82299e561ee1f96
MD5 691f7efe47eb4345b4650829448fbeb9
SHA1 6e1aaa47b2a7d45067cbb6f971217e22e88e5592
SHA512 62e90c15c02f9e03f0fd0a4283fb071cd4ecc4a1817f6cfd3034bd1ad06533e3eb9c1ce90e303ee6fd47b56412ec73f702968454c963421b63e5d4347198c64d
SSDEEP 24576:HCUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAAa/dHVnN5VWW+MAOOEUPsxLf:HCUEPTY+8Wg2lIL8lrIUJLWwfaF19+On
TLSH
T1A565AE1EA3EC0896D4BB813589518A06EB727C2E1B31D6CF2160C37D6F27AD55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a3e5498e0aaf7547735cee8f29a95767cc3bc71f3d6c3fe6668942033098e1d2
MD5 a2e80f18490c4c05fd41ac866b4bc70b
SHA1 c1e32996e991426d909bd365c3f46e6ebd3c0935
SHA512 a17b27e33e1720836479b83cd5ce3d2dc78da15435316787fb8c6125e214c21ef7af716a03ef2f7fa75d991f23d21da8911a0582ff1e0731bb7260a916cd73cd
SSDEEP 12288:qcsfFLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:wFa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T13B55011AD2A841E8C46E9175C7568A81F7637C2587E1D3CB23C0F57E0F7A6908EEDA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3b207348ef16b668f388a6c952c71c47fc568a07d938949e522049d9a62df71f
MD5 d9b1f5b379fa528f1587d7e1c798a579
SHA1 feb35f27eb5ce2940c8cb1147ea181cb4cc4dd56
SHA512 2aa5f2ce18235b7f7264d45819e167b88337aee7718ac5648e534590e6ba8461ca1d54f905d1ead4298a6d50bf6bc8cef7bfbccafdbe05a25ab0dea254cc0f93
SSDEEP 12288:kULW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE26:kUa/dHVnN5VWW+MAOOEUPsxLisaW6
TLSH
T17145232723B894E6DC7F86B0A06AD561EB8A6C29DF60D5C3B24421C7527A5D0CF7C48F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 48dbd12dcf28e9f1b69a9f315daeecbfda9d3edf5ef1afbbaf6f3b7374dbed0f
MD5 8ba2614822441b23f94f81f76d8cbb73
SHA1 11d9cb97f859cfee86389a3b1fb24db763eb1003
SHA512 72b197360cf5ade655e6c0e86a1bfb2c76160ada0ce9e23516d3c417d868269a0a332231ec4f7502a0426ad154c8bd5bded92d7d234e496f27c8598a4df4a4be
SSDEEP 24576:28RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCqa/dHVnN5VWW+MAOOEUPsxLisaW:PRZwQCyiHiQEaaPnM9aF19+OOsR3aW
TLSH
T11185AF1E62DC42A5E0BAD278CDA74407E6B27816573197CF1290C27D1F27EE49E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 32f1ea7ab404583a87d2542e396b36fea2b831b2ac1ed0df47f750cc3293b1d6
MD5 7a8a68f457088c7aa84ae94c3f952a09
SHA1 5378e0e459b75957923cad3dc6428f3920ee0a8c
SHA512 280ab4b8164c599d61da5743934f740a3de6ccb871a3265b9f3f92cef16711085092885d7e5cf931840322a96557da1c43accd71933a3721919c48b2b958abae
SSDEEP 24576:tbxA1UGka/dHVnN5VWW+MAOOEUPsxLisaW:tbxA1UhaF19+OOsR3aW
TLSH
T14755122E22BC14E1E576D579D8D68102D7727C2A5721D3DF21D182BB0F3BAE48D39E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5c11be2a01a958bd31f2bf3f93593880dd6dfc6d63d8fdc0704c3b56f6af86ac
MD5 85c8b4b3df6e3bf8a680dd1f3f840374
SHA1 7f09c3eab9811a9c1b4d440dbe5343a8943d3170
SHA512 e387bb2a8eabf12d47fbbfa3b1520fa0ff90fff8b6bb69f021ebc72d0afcf07a6bc556ce7afc44f0aa4fc7938d23eebf2ffe8953929a8d0767469fc9fd909b63
SSDEEP 24576:ejsmP0yHaqrVqHra44KDzMsrn3a/dHVnN5VWW+MAOOEUPsxLisaW:ejRP0yHfVqzlAsrn3aF19+OOsR3aW
TLSH
T1E145AF2EF2B910F9D4AAC176454107B5EB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c4e84e613f5bb18ecca81adde39395a6d1e470223d6858208dbd7db17606e27e
MD5 bbc2c87294e2a5a000d80512be1b04a5
SHA1 d76016c5e314fb2d1e523d6b819ced916a2d5d3f
SHA512 2db81a83c150641beaafd781e2c7c7b719d021071e1a26097c0055ad7efdff20dee0d65373fcc67e7d2239083c3ab2eb0502cf5b39c746a75f592889228f66ea
SSDEEP 12288:GyLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Gya/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T14F45232A23B9D0E5DD3BC9B0E05AD591EB825C19DBA1D6C3329571C3437E5E08F7C48A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 018c347f2f08d566b8be2ddb1f4b25cd47980c5ea8ee839c8d6c1e10c489c795
MD5 e5f46c89962b8058b1d3c3c8e3179d1d
SHA1 767e0bb9b5ed0a3e716f82da4306704d0fc4cb74
SHA512 0a71e64556d0f9ab6b7e4c7d877a68cc6ba08fd6951848cd205ea4fdb1671c9e6ce875e9ccae7b02029a18fa211c8ef4c1ba0d6d9a732c23924cfc29c246690e
SSDEEP 24576:ENLBUToa/dHVnN5VWW+MAOOEUPsxLisaW:ENLBUsaF19+OOsR3aW
TLSH
T1AE75F155F7A400F9ED7BC13CC8A68A12E6B2785D0760E7DB13A84A561F237E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6d6901077716dc98f22704ae19f2e19887ee29879f0c1d09b8f0aa4f3c40f1dd
MD5 67ff3ec729df9997163d3b08ce3c6cc8
SHA1 381bc63ae38090d106408c88d6d8218c277b5f11
SHA512 e6b191290558c355adae5d4fb61afc9da84c7886dfa10c38e84b535f87f9a6fa44338da45a4ff6cd4238a6974ca5b9ef387a5ccc592d90fb88e0b3173896c8ac
SSDEEP 24576:F4YNH7a/dHVnN5VWW+MAOOEUPsxLisaW:F4Yt7aF19+OOsR3aW
TLSH
T1BF65F12F62BD08E5D93B9179CAC38205F6737866571192CF11A082BA1F27EE8BD3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 afc46da37a44070ba4e6bb6e7bab3a3d549a66232805c4ce1d80d43c17afa531
MD5 501a08e59328edecd05658144a5ccd56
SHA1 e633eab9bc934ded9d6cd187f49b4475e5ba3469
SHA512 3c476ac15cd0a32044d04f8bdc12c0e29e3c2dccb17af04c18107d057015438fee44c66a5ade87dbebab33cc78de83c2ab25f2ead2a88eb9d43acf1219a64a91
SSDEEP 24576:5nXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKP:5nXoJJYH84VVS6AmERJas+cHBjSSKHP/
TLSH
T1AB65BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9e5f4197a5f188b1a6730138b1be112a9182796967295efdc50c085b7fa39041
MD5 a3c614228adb97aee4d06161232be940
SHA1 e680e81f652ca736b821d376c604566f6364a0ca
SHA512 cf84ea7fda7475571d206348bcd9c1025144d7e97d2d6685f0809b08d224853a0e504ce3ef41aabbb9d5c01be218b51a1da71bb556c44b67e835731e4f3923ca
SSDEEP 24576:Mv7Xbxd9Tuycf8M/TYlSuxwr2PCZa/dHVnN5VWW+MAOOEUPsxLisaW:MDLL9TuJ0M/TYW2PSaF19+OOsR3aW
TLSH
T1C0858C1EA2EC42D8E47BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 91d83a8d65b675e25b252c16aace8a0823004e9b517dd83e20c51cd131f77d44
MD5 a78f3eeb92ccce321fb45aaf07f82077
SHA1 8bafbb00cc9a19f02b8903a9d01fa679b1993280
SHA512 03812a930c3ce800ca971fec1f630f8e68e78c54f5986ca201ff35f98dca5e34515c413fdaea7160b0c4fa1cf15a4b00e12e7c20e6fa631352991d009b838524
SSDEEP 24576:3egJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10woa/dHVnN5VWW+MAOOEUPsxLisaW:3ngOJOmPOHcoaF19+OOsR3aW
TLSH
T1B655BF3FA7BC15D5D03EC17D8A968916F6B1782603259ACF0160827E5F2BEE46E3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9cf9de4cc560d9c87fb34f1b77ea149f970c9271fca1eb9d339a31e39a4e69c5
MD5 297d32e22a1238f2371d558c9395b676
SHA1 d6c5458ebed39332de34e3d0a3ac0a1bb8532ec2
SHA512 941b89531a7e09d8e06328351d0a8a56c826a9364706f9070e19e8e952f1daad72f05a90048ed2acbdedcd05e5178b049be53124f852a72037e20e00c11fca29
SSDEEP 24576:sLJnJiTk3R3waE4JrOSa/dHVnN5VWW+MAOOEUPsxLisaW:sLJnJK8R304lnaF19+OOsR3aW
TLSH
T19175D03DD2A810E8D4B7C2B4815A1796FF71386D2B2169CB25B4D5313F12FE0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 baed17c5c1be6e917254cf655a2443072aa6417abe3ed9f62bd27bb09fffb6dd
MD5 11d4c543b63232fc8a580d4b106449eb
SHA1 0ce6a75c0e9a1fefeb7609463f074ccc0f5c0c2b
SHA512 ca6b542d0d7f23d77a7d15b90a922084eb1498796b7ef37392f42024c791525b265e6a724ef4dc35c4a72320c038868b345d920934c214f890a45f34099e8f38
SSDEEP 49152:x9GqCzDScAZmlvTcFg8Ph6uaF19+OOsR3aW:tbeg
TLSH
T161955C15F7EB5298E8B3C9F1C96694159B327C409B34F7DF0A80CA6A1E32BD1D938B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8af9dd8b253d1a2b7f94e5267b8f43dbb9ed2695ca90f9a5c35bb74b906a3958
MD5 a7132604e474766837e591ce06637b3e
SHA1 ac1f8f33e18300de3cc2fd017f3c7b274024b7cc
SHA512 03c275dd8054fe0f9c6704cdc285261d8f36830a9568ebfc42caaab8d82df471b2e8126f6d15d4ae0e877ca8c9c8b64edab759e69f10d4b4477d47d5b26c60b1
SSDEEP 24576:FlYJeXm5jUuE4a/dHVnN5VWW+MAOOEUPsxLisaW:FlYJeXmRUuE4aF19+OOsR3aW
TLSH
T18E55121E36BC70E5D52F8079D4A28540E7B2B865575193EF22E0C1BA8F7BAE15E3CD80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 33cffe3a8f63511d84ffb3d81ab34ba523ca930b25e426192bd99c1510e2c874
MD5 9ea1cc628669afa95c039188198bc11b
SHA1 65a8a047432ba8919815fc91fa4f70e322333417
SHA512 44a8e378a4af4b62b12333c2dc99a1a3fde09c07bcfb392e01cd38a9fbe84d396af94817450df32b79951b68e468853a994e076949d5a60d0fa24f46f11f1905
SSDEEP 12288:Wuu6kyXLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlob5:WjtyXa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T1F355121923B4A0E4E97A4674D9A38190DF65BC249F2083DF21D0F66F5F3A7D09E38B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 548ef9f3c2b2fd67e49209ac52552ec7d399cfb0b1bab7482ec7f50c90605ac0
MD5 963bd6a4ba1387294b108a33f9e92ecd
SHA1 f92102259f94e0dba578cba46cf7b86cd3f6bd46
SHA512 7193ee2adf5adac81536a2a6ed8ddae5667f1eca959cf0a4ab57e81e44fc0097b10aab1e9bde361b447c4c6e63aa6610487ff41d469b59e79d1efca829a902a4
SSDEEP 12288:rPoLW6S/dHVIYM1aB9YKM8AA4x44W+iBT+h5sKzOOEUPIvxxLpzGswVTlobE2:Toa/dHVnN5VWW+MAOOEUPsxLisaW
TLSH
T16845232E2374A0E5CC3B85B0E0669591EB967C29DB60D5E731D4A0F3877E1D08F7C88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a2bafee1017f856f813970a7e398b5fb55fa467be32268be32abe775cd81c64e
MD5 f8537ff48f2dc86c2ed262d7e6ec8e94
SHA1 6c32491585923b0ab3773f0e0c6733bb2e7a39bd
SHA512 711e6892cab27df7fef9e83e0b63cfe96e4df5a3681c9e41ebdeafb538b4146214bb22f692ea5a199c3b4f6224fb9b35ece0541aa13a721c3aff7ff1eb3a0163
SSDEEP 24576:wC+TyQIu93VAumZr7jmla/dHVnN5VWW+MAOOEUPsxLisaW:w/TfIq+YlaF19+OOsR3aW
TLSH
T1AD558D1DA7F919CAE276C575C8A34493EA33B872177186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ee29953b9190eb79d71ff4c3b74fac4678bc9e4c04bf909f8fcfb49d59080eed
MD5 e1b7dc2bfd4bfb22d534d40d0f24f828
SHA1 bbbd8e8b3a2a577c3cc10b3e996755f8424aac7d
SHA512 b992b391cb72328bd863bb86c91edd76e7c2d3750ba736842322d89bc6c6e50c9018c217af88d996286bcf0b8e502ebe66f9ee1f9703e6f6361618edb4f41134
SSDEEP 24576:/LQikZca/dHVnN5VWW+MAOOEUPsxLisaW:zQikKaF19+OOsR3aW
TLSH
T1AD65F10F73BA10A5D46BC178C8864152FAB374355712A3DF1290C77A4BBB5E9BE38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c69d2702159910501a404dec140ed2dd995d81e7a238592a84ab06d0c2583f9f
MD5 0f7516703383553891d9adba50aeeb48
SHA1 862208af045b483ad0f696eceb2214beab588402
SHA512 517e9cba16abdb9727bf9b9242d8ccb30e83ab7df56af2fb13c3964ba92e8201988cb67d726492a684a3f822ca50bf0b89d17688b66c5b38916c5b6dd91b51eb
SSDEEP 49152:KpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPXaF19+OOsR:npC7b4+80GTkmeg
TLSH
T12DA57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 57b6c7f6dccdb8e002a42224485133a958d07538ff8ae210a616ad072cb2c490
MD5 bf034fbad6659db515c8fe1f79bff04a
SHA1 13b45f9947860c105908de6a458dd1bb7418bf59
SHA512 bac0ec5c230454be98ea8164005d6b580e13ec651775793e4004ae064ebfb2df129fc7af848749c7b558698dfb0b9ead42509582e3751b7cbe46cf44325baef9
SSDEEP 24576:xSAwJPE1IDAo+4Kt+l4413AUQ/a/dHVnN5VWW+MAOOEUPsxLisaW:xqPCIo4Kol4KQ/aF19+OOsR3aW
TLSH
T16955B02AA7F946E4E17AC7B4D663C501FB7278221331A3CF5290817E0F169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 38c3f7267183fe9d9acd522895025ca509350ddc14f10fcee383a075304922f7
MD5 a0c06dd5bda24a668bef9fd654f89927
SHA1 c3e6c92f999a30af5f02e81a1a2b43784f072803
SHA512 30ee229542cdbb20abf3ebe1b54da334295da907b3ea7893fdd407f33f16cfc9e3fca8b287eac5238a2b381873278a0779bc10f82bdf27963ab10a15e6f23bc4
SSDEEP 24576:5yLXPLca94tPa/dHVnN5VWW+MAOOEUPsxLisaW:5y7PoNtPaF19+OOsR3aW
TLSH
T1E175D03EE76C04E5E47AC27CD6A38506F6723CAD033166CB15A091761F6BEE4A93DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 0ac2c8e69e489379029c4b0b2b094a29921fab923174cc9765a6bdcef83a4ad2
MD5 e09d92be1e566cdf546935cc68a4bc5d
SHA1 bd644c8e2409e7fa28f1b227540acb391a0d025a
SHA512 42f78b05b35d7ea95465882ee7aa8ee59595b88b93cec33906dfff7f8e99e93883413005eb8ba953e75988580dd7c9095e906f3f51ac60e56e871c6bfae58075
SSDEEP 24576:EWv8qjpMa/dHVnN5VWW+MAOOEUPsxLisaW:EWv8HaF19+OOsR3aW
TLSH
T1AF65121E23F460E4E83A8270E4668161D5B2BC765770DAEF31C4E5B74B39AD0CA3EE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-371-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/388-145-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/608-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/608-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/788-124-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/788-13-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/840-130-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/840-24-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/840-25-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/840-16-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1560-127-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/1684-129-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1700-376-0x00000000009E0000-0x0000000000ABF000-memory.dmp

Download

memory/1700-105-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/1700-100-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/1700-125-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2292-163-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2292-373-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2300-61-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2300-55-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2300-67-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2300-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2300-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2588-92-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2588-86-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2588-182-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2588-95-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/3956-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3956-126-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4208-116-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4208-184-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4208-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4208-122-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4724-0-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4724-6-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4724-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4724-64-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4984-148-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-39-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4984-33-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5040-403-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-404-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-391-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-390-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-389-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-388-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-387-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-386-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-385-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-384-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-395-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-396-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-397-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-399-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-398-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-393-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-407-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-408-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-409-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-406-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-405-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-392-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-402-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-394-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-401-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-400-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-413-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-414-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-415-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-416-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-418-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-417-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-378-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-379-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-380-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-381-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-382-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5040-383-0x000001388F810000-0x000001388F820000-memory.dmp

Download

memory/5256-84-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/5256-169-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/5256-80-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5280-410-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5280-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5280-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5280-180-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5280-411-0x000000000B9E0000-0x000000000B9E8000-memory.dmp

Download

memory/5280-189-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/5280-224-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/5280-205-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/5300-83-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5300-162-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5528-152-0x0000000000690000-0x00000000006E6000-memory.dmp

Download

memory/5528-149-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5528-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5716-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5716-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5772-140-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5772-356-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/5772-142-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/5808-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5808-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5832-155-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5832-44-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/5832-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5832-51-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/6120-170-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/6120-377-0x0000000140000000-0x0000000140162000-memory.dmp

Download