0c34d61302bdfd537012c041567f8a2b53a266271970bd929b6aa56682dc26b6

Analysis

max time kernel
80s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260504-ppgp8sbw2t
SHA256 0c34d61302bdfd537012c041567f8a2b53a266271970bd929b6aa56682dc26b6
MD5 34812b646cff3c6adeeaf392b23e17b4
SHA1 97a0395617d3fb514ca3ea3e8ce696b7a8139096
SHA512 4113c33ce8522bae5d8084528823ae8012e545706c9c14a651ea74891f6ec801801371d60be7faeef84938551574ec6a8ab7218f153dd69a50644b70a9465abb
SSDEEP 49152:5vmHGcnO2EvU/bMvo/SHEif5YL8NnjSBjNCWTPp8N7s8SJGVYPKEnSG:5TvUko/SzMj0I8Ni2YPKES
TLSH
T1F91629ADA6DE00C6C070A4F4CD164795E2F2F854833149CB15E81A1FAE7FEED4E39A64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4300	alg.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
6088	fxssvc.exe
4100	elevation_service.exe
5340	elevation_service.exe
5028	maintenanceservice.exe
4684	msdtc.exe
5124	OSE.EXE
3856	PerceptionSimulationService.exe
5148	perfhost.exe
4648	locator.exe
6008	SensorDataService.exe
2772	snmptrap.exe
2472	spectrum.exe
2468	ssh-agent.exe
3340	TieringEngineService.exe
5276	AgentService.exe
5068	vds.exe
2552	vssvc.exe
4736	wbengine.exe
2176	WmiApSrv.exe
2108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bb2d4f7db955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\UnlockRedo.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046d8be83c3dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003513d983c3dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064a60983c3dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ef8d982c3dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfa8ea82c3dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebe2e582c3dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	6088	fxssvc.exe
Token: SeRestorePrivilege	3340	TieringEngineService.exe
Token: SeManageVolumePrivilege	3340	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5276	AgentService.exe
Token: SeBackupPrivilege	2552	vssvc.exe
Token: SeRestorePrivilege	2552	vssvc.exe
Token: SeAuditPrivilege	2552	vssvc.exe
Token: SeBackupPrivilege	4736	wbengine.exe
Token: SeRestorePrivilege	4736	wbengine.exe
Token: SeSecurityPrivilege	4736	wbengine.exe
Token: 33	2108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2108	SearchIndexer.exe
Token: SeDebugPrivilege	4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4304	2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2976	2108	SearchIndexer.exe	104
PID 2108 wrote to memory of 1040	2108	SearchIndexer.exe	105
PID 2108 wrote to memory of 5788	2108	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_34812b646cff3c6adeeaf392b23e17b4_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3900

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5028

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5148

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1460

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2976
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2904 1768 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1040
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1764 2856 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 18c22d48cd555e75a91e7ab3b398407a3060144dd9e764797c43087f356743b5
MD5 5e534e6655ca50823207d0d3e4249aa9
SHA1 43ca644a771e639bd1078c964f7936304616bc3b
SHA512 5d5eb2a078db2a5de508e097ed667b5ab7fb851508ac43cddd84c3d7c437397e85cf0dfa0d2c000ef4366d0d26fcee6f0386f0484a725a37c36bd1991a9750d9
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmYPKEnSG:P3q6HjBnYPKES
TLSH
T15CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8be8559154102d490f755cc257f50586d2cd713f4f4eda0c7968eb42de755a0b
MD5 43ca3fb57b15b4900267bed766bb850f
SHA1 b930a7901a567bc36e815614e56142df96f8ed25
SHA512 a02acae1c55b4a56b8a6e323736a69b2ab91b4c12db41d43e7aeb14e0a97feb0f84bd96926527c64540ddb1de6d963c11a3ce15de24f965e307e8ff2ebf8ff6d
SSDEEP 12288:w1XLsswWkxy2lRq2czAQ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:mXYfDtczALYz7KEMdX6keYnAcert
TLSH
T10685012867D508F5EC6B823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a366dd14568979755dc1302121f9c65c1fafb70bd766adf057a87572949b471b
MD5 887f64780d8965b663a417308afbfb36
SHA1 0410f75e51324fabef81a1564df58171b57b467f
SHA512 e72d455202b88068d3b31b7b7ef9bd8bd43d4190300fc7ff832a71a93a412e124d31844ae1ec056bd5f0dfb2314b4acac73cc0986a6270d322201b631c56e539
SSDEEP 24576:y0Le5ji0hmx3rMeYz7KEMdX6keYnAcert:yPji0AZNYPKEnSG
TLSH
T1C2A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f494ae7b140880012df27ad3f89710e34cee4d55f1d3eae3163be2b2ba8921a
MD5 60a30a93c98100181c8074954c7f6227
SHA1 9eba180b8fed2622eea558ba721b32a5df936bc3
SHA512 848594713b07bc6320a2d14191cc9a90350a13e2cc3d96e6ecb802bfcf7fe57b7dc0f13a1a1ff4e6b6ae966186d6592c09618653068eb12ceb1f5c7dec590b18
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyu0Yz7KEMdX6keYnAcerA:2/ezSC6vUzPvxHjyRYPKEnSG
TLSH
T172756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bb8cae328fcf37f4063ab266fa28521ad713ec1dcea43db919e2b12c60936d58
MD5 39cf681fe2068463a2df36b37c67c4ef
SHA1 665c0aa4d56a2619b5b5faee31df92f8d5e05796
SHA512 ceedfa89261d1e3bac7f66370dc0078fd9f5316666363576fb7865f0e309a06b56ec46512c6cf159f4dfca48d37ba0f07f83dbdf70a9736bd2bb6be17cfff522
SSDEEP 24576:oVbqPb88hv/l+63Yz7KEMdX6keYnAcerM:oVO88hXl+SYPKEnSG
TLSH
T172559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 0791345b686600114f5128fdb116b195367365a7759d380c6e839416019bac48
MD5 85a301defde54167dc036d3dcab11bb4
SHA1 4d65ad81b302aac2e8d2da06181fdcdb607dffb2
SHA512 8eceb4a3617180177eafca2da205f69aedafbe767597953fd91a1abd7c862428c07a098b846860715a9512367a856262f4a7e2cc6a22aad552012cba1dc564c2
SSDEEP 12288:yXV45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:yX6Yz7KEMdX6keYnAcero
TLSH
T18C6523048B1A89D2F85F467BFFF5494086375DC62A8C9761C94CFA8293BE232C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 93e12f21c9840caf597db097b38cb3af7c187b98a6ceec484770062d83affd64
MD5 7812468747b29c7ed97d9cf1a6e63dfc
SHA1 2ef99da344f95f6e4b25074932c9630d8ad6313e
SHA512 98dcdd76b63eaed432f391fa972441014c6efeb86fce9594b7b6b0488d3245dec8fc93686320aef4139edf2e9e274a768bece271c91db66987f5efd2b7a05558
SSDEEP 12288:9eBNUbTVO86Us45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkw:9JIUvYz7KEMdX6keYnAcerV
TLSH
T15C85CF3BEE28FCD2C27A8DB96B918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e61909488953a9491a26212f8869ad5543ba81f08f21dd134badc993d7c4dc90
MD5 bc4c1e6061480617bb6698f85bff2654
SHA1 6e501b188cd36dc2a5a4902b3bedfc96d32ce190
SHA512 ce14863780480e412cfbc41ed3e354f9f51a7d595189c35cf6dda61044a341c9b27b79a446adf3b72deec717417f68dd65660f9033a520c5ea2c4abb60df7144
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:XQvGAdlCEL8c/yRNw5CEYPKES
TLSH
T1AC267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2c54d176638d508733a90338a322e41cbbddcc9d7ba97685b5b92edf3498181e
MD5 955e289b3bb801e88a9221509cb6d749
SHA1 4c25882f3ae5d82c8cf304a6865ab06fcaa99b32
SHA512 5591ca5f3cfa597f27b5b31040de68499904917f3384ec2605809ba399ccaea2b0ef1b5233784ba1944e26ff2de8d21f99b2560f70bc78457db8f9144af04e01
SSDEEP 12288:7AwSfxL/2Dc3BDLLmt0LDQewsAjO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk1:kkewsAjdYz7KEMdX6keYnAcerU
TLSH
T1EE95E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 9.6MB
SHA256 b736882549da57abcd543e6a379ebc51711f55674f91560f53198d2fcfe3ab5e
MD5 2145401948e9ae4ead123db9656f034a
SHA1 60417ef671838cf9140d9ad7632329678b72ec45
SHA512 f75652caa3d006e3aa43104209614cc10a01d9def4ff6a9668723a77973914dca8e92d5957a23e16076037409d1652a03c9a301883e4260a1b35067632c7f86e
SSDEEP 98304:XVJ3MXEJqyQdetVbvC+2gslOxWixBDJ2sJTv6wsztRC1cCf8H:vUEtQeTbvf2zlO12sJTv6Ja1cd
TLSH
T1F0A68CA667F802F6D53BE448C6568573FFF138050638A66B46E6CB5B2F375305A2E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 64fec6fc69e7a0c00c181242919548c5ef76403496a3c168ed299077f96121d1
MD5 65c4b75363c13ccfc98a5c2a4216cef4
SHA1 853fbeca90b934fa715a9faa30f038fc937e8d9e
SHA512 5ed2d0b0c1faa6862ca6b975634a7e4181c2d99e03c1ca1cac3d0732f429585f89c81df24d6e59ce7c8a6b840307c06d4f3673646f88666e7f7be4470d35834b
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/z9YPKEnSG:moqtVjnmYYPKES
TLSH
T1D6D58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 81f2c7f5b916abbd2eb8b7154405cb5ab0dc7fe1268f65cf4dd1eefa1ec0dab5
MD5 f4688d92fd8c1e1ffef14a81f12da610
SHA1 ed2372f122a99e8a3a559e6909fd36be51db0bbc
SHA512 5e808b50ab558f2b6ff15408f190ec4d9580ca59c9113306a8cc034f61b0927ded89960539c01d20cb87bc414f0278a5d6ec73d40e29577d891c2db369935465
SSDEEP 24576:YAhGLJIFoiwtA5l7S534Yz7KEMdX6keYnAcern:YAMyFoiq5oYPKEnSG
TLSH
T10C35AE80EBF955D4F5B3AA78A9B68570EA76BCA65E30C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6045fe783992fcaa43989dc2f13d33a9d5b58f5fb4083a121b5695c1e7b640da
MD5 789d093e77cb2e73d592833e7be45e08
SHA1 a4a16618827a1049a35aefc05b7737f11dc6677d
SHA512 373ddfde532d5f81d86a39f60240ff2ca3609d89b6954fe633eb87315a2710437f16267714636ec5454743b9280dc6ea95e6c7da52d66016f7dfd3fbf5b00265
SSDEEP 12288:wmw5HEjsChNzBFgl0WDm+Cr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkP:twuSOWxYz7KEMdX6keYnAcerm
TLSH
T16C85F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 95f3853644d9a641f0a913d612c9625c96c847cae482152e0f49748548952a14
MD5 9e828dba04799947cba88486b1812be1
SHA1 8d9a1b8aa71f0ab9d8e17da332750ae7c0aa4461
SHA512 fc08388eba9ef1ad64101aab936b0e24bc59fb8aff9911318490ae25a70b9a122d3c54232a1ff5b099784110b38fe3ab09d069065be5445b746e8d6bc46e2775
SSDEEP 12288:7jZ1Iye45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:HZu2Yz7KEMdX6keYnAcerI
TLSH
T19B75124927A820F2F0A7423EEEF14601D7727893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 712c6ad2f728e023c2ea960fea1e91c4b414f45a169ae651f90b2aeae72a4ffe
MD5 3fe903f514496111055ae4b2fb0a91aa
SHA1 75c1965c941fcb2f10175ba5e588932d5bb0f613
SHA512 93fcbe6c9e886cdf4825f90020dd1612dac739e15ee3139ad8b52539b1b486b2d11405b0cc42b32f196dc49af098bfefbefaf6f7559742dd82c44164c35b290f
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:uQRQyi36YOcPQLvw2gAf+PN3DYPKES
TLSH
T1B1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 014b4ea79c29bd2ccf623c556bc4beb92027a29fc2d4e03d77c4ef917b8231a5
MD5 7f10fe3cec955dc5e8905abb77034e75
SHA1 88b9b1a54b4aee743fd99a5934ae918d14578fab
SHA512 3444c9a180c01b644bb13484f165f0ae3758548b66d233df7b8612935b40a3d23257d478bf57bff1d373b181e7780b6db3a6f7f6384999c8bb7a842b002c34d6
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:DQRQyi36YOcPQLvw2gAf+PN3DYPKES
TLSH
T179667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 75eadf1f02737d2edce2c6c5dc0f676b7b922b2cccce57542330ea7ee56820b3
MD5 64916568b938f73a7df25e0b4b93d500
SHA1 db4c91149d585d915da76422a5d1d189561faeed
SHA512 dce84bd4010256c96d77be387b433c5b43d44f85ab4909aa9db77362c5d66e95b48eac8269426824d3e0582d6fe44753cfa4f110102fd2a1451ae1bcb2f03a92
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mYz7KEMdX6keYnX:E68Qg55nhheWu7PNU3/NYPKEnSG
TLSH
T17EB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4643002e308fc7ed25cb0fac92ddc234e9b7890fb614c96fca0ab8f325b6ff12
MD5 de90bc3a523f69000600b4238c4b5636
SHA1 7ac7294629b4b752133874bffacaabe22dad7b76
SHA512 43996d7d0551b817deba24650a379ce73506c773db9e0aaf67ae771a6155f713fec5934e93121f214a69ee089bb57ea1f6a4736d9101a46de64d7e4e01fd416d
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:vy5112gYy5azzVvL69nLKnhZ6YPKES
TLSH
T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7820fa31b6648db272f21b38615bdef1ecc6ea3bf7f8db355dfa659028e6d26b
MD5 3159d7617e5f8803e33d2ee0e893af82
SHA1 92d6cd3143f199dfa9155b5861156b7570042840
SHA512 da03e924cea3b34afdeecdfb7f7adf50ad5c10a349a56365892e4816bdad614dd21d4271591f2de090d54095011199dda342699b1734855238f53c9ef19d8d4f
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl7YPKEnSG:Qu6JmVxd2d7YPKES
TLSH
T194D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 da8df02b3de1acbf71872d69b406b817618fad294bca83d32d24f4b2d2addf87
MD5 262e809ffb6ec196876d65e688a85ab6
SHA1 b80f825fd94a995b1c1167970b7eee96ee399df8
SHA512 0fa1416d11ee5f3d189608e262ebc3f96e84cf1d4c458fdef16808bc8458a22970e9c5805236e0096b34cc65a2156026ff2c1e650d96e24f1636644b45fd4add
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xPYPKEnSG:1mifPbRYYPKES
TLSH
T1F3B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5112b9818af92e727a937b6c084481670e9a98815207d3de381e166290c6855d
MD5 b440589e0bf57319006f38f859258eda
SHA1 95ff282660e0063173c864edf763a5c4498e416f
SHA512 85bec4046662aa24b3172e4e08a1ba39f2aa456032cace2c13a14fa38c49a36362ff25eb88c58068f1588397cfc25203c77e6cf9e1237ba56c08e7c3b482c473
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHq2YPKEnSG:K5dKTi612YPKES
TLSH
T1C7C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b894b986cdb29ffd757adce0389499e9ac337501806f4ad751f5e319373041bb
MD5 00a5caaa8ccd46cc5763c073f8fc3769
SHA1 a62c8c6a8ee29e6f4bcb2baa3c6881f883c34cd8
SHA512 0f427f97ed1327bde0909b08ed42643b8008a625a20ff51b482bfa66d470a8f1844969aafef408ed56cfaf4d19931cbfdae107312875bc261e47c01cb303e651
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wLYPKEnSG:CX2iyphsYPKES
TLSH
T14B95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 56f3b2e4d4cf1d2dfb12c2ba690fd97292f2eca19ababf1f9a2437ef9c457038
MD5 972d7b6f1aea9b99f07cc97863af77a7
SHA1 966636942450c519b01cc2933265bc6af90890d0
SHA512 3e64a4b666cf0d1f7f8956ae532b248f615a3f3603eb792a582bc4d0391dc7a498706d236c6ea491a57a89e00bfef7d14aa49bdbc4236ee18404838af9d9789f
SSDEEP 12288:xN45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:xSYz7KEMdX6keYnAcerf
TLSH
T1C66523048A5B8AD2F84A46BBFBF54540C53A6ECB3B8C83A1DD4DF50293BE732450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 5d4a20cb2326423413fcca54f453dc498b38117b477b8db9890749c5086405b2
MD5 d1d1f0752b79bbb22bb3965c14f8fd36
SHA1 1ad89bf7992b3251971c12b64649926d2d6feb5b
SHA512 27dc2d6aafa087b9b75e0a8afc85c6c2407050d1e1bc3f6722efe027e2b5e0a8609f24ad6933140b9877714ed2b76821cc8c02565595654a506b2aa45158be38
SSDEEP 12288:0y45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRks:05Yz7KEMdX6keYnAcerZ
TLSH
T1A1652304891B8AD2F84A467BFBB54540C93A6ECB3B8C93A2DD4DF50293BE732450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 5329653006ea34fa8c15472b3d3569bdbeca65ffaf24302cca9284ef904a57ce
MD5 abee66c7475f3b78dab1070b10d8a8b6
SHA1 45bf8f15322f79e9fa9d4a49cb391bb060955ec8
SHA512 dc1074b5320391eee701e29ad0b11715ec842a9695e516492c66aa889c0331fc59c81abad688029ce6148c27bf2c8f4da4c2f6efe3cd1224f6553e7bb36c9c56
SSDEEP 12288:fk45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkX:fnYz7KEMdX6keYnAcery
TLSH
T1196523048E1B8AD2F84A467BFBB54540C93A6ECB3B8C93A1DD4DF50293BE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 9efc6d74617b65d8afa28938e78a88d25aec3478e98f806f4923f011a29d2305
MD5 2b001e202fdadf60ec92f2be373f12f1
SHA1 d17a469548c55e024cd5cdcc6fdffd5013b28062
SHA512 accb96dedaa17b549003c05d79db3a7cfcd99f12d7ae059bc7b055ff39e43b397e9789a848602c1757f23035b562c7635456c213bd66f8902eb0b57a4102737a
SSDEEP 12288:2VH45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk+:FYz7KEMdX6keYnAcerz
TLSH
T1DD7523044B5B45C2F85AC27BFEB18500D6767DC73B2893EFCE08A5424BBE3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 3348b0e465ceb6887c5ce233ab155f9125c2524936d22f31fd16fbbbe23f235e
MD5 95f34df562c0ebbea844f673b8feb5c1
SHA1 45563e6f0dfafdcc185f74971ab4ee12c27c53b0
SHA512 f7f858caad4f41063729941ba9519e235427cdb83bb06e001bfa65b0fa1ce084182a7298181a053fbffedd77cc6641070b243daa33d3cf09930167e68cd4e244
SSDEEP 12288:2P45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:2gYz7KEMdX6keYnAcery
TLSH
T113652304891B8AD2F84A467BFFA14540C93A6ECB3B8C93A2DD4DF50293BE73245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2351575073111de3c772f055993d0c0350cef1caf6ac715e2b4502a0a9804b5d
MD5 ec961b7483821811f34ebdcf12ba52b8
SHA1 9554fe02c6a460bb72ec802c57ba9b5af021144d
SHA512 caf49df72c1791fb4b56e847e63a2cd17386bc177240640d6b3e2954398d431c18efc933991a59a46b3a2e323f07568fcea9458fab3f62fe1321f6cb18f282f2
SSDEEP 12288:Vm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:V1Yz7KEMdX6keYnAcery
TLSH
T1956523048A1B8AD2F84A467BFFB14540C93A6ECB3B8C93A5DD4DF50293BE732450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3ba28e86b7654dc4a93f8f391c44fd5de680e978449a118c39937835a5e59e98
MD5 db32b7d1aa2e7c5f36eb8d2275c46859
SHA1 58e61862a88e2dd71eeea1deb0023c3c4b325a0b
SHA512 d3ef206e55c66cedbb4e7f94a378edd2597f89c5dc12cf6a0924758b0c940af4aa19bf29d671d7e97be65db44157ab57eb83a04d35088d5b5ce7c1aa2ea2cf3d
SSDEEP 12288:Za45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:ZhYz7KEMdX6keYnAcerW
TLSH
T1EB6523048D1B8AD2F84A427BFFA44540C53A6ECB3B8C83A6DD4DF54293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a9cbab9295a770255a29ab935b7a4b1ae0f41c61870f42a5aebd37f0521d2d55
MD5 4dabc6c47f5abbc50db3bcea76e9f00d
SHA1 9b3d26988d61984059667a69d0cfba0ebdca1386
SHA512 1525390b08d847a683c83fe7d8d0aecfd8d2b8fdf74ef60864aac41ffb533e567a925b65667f6ae1699b18ded39b739731664bf5599e951e1bcf8faa5bfb246b
SSDEEP 12288:jiZwbHzzFEoS2cPvyS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:OZMTzFVSOZYz7KEMdX6keYnAcerz
TLSH
T1A4850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 602d5259f1f3097dd5d0601f39d94abd48aa66ecae789b27ebcf81998f3066ca
MD5 98cca459087a7c1714e81c5a77e226f0
SHA1 24de9e40a4aec4754e9d731f84b45df463e21376
SHA512 f60b0db1738f3079a19cf278006adb3a7367b3dcc0373c00a3909f2640fcec1dbaba857847ef2a6da309b524dc6a81513bbefc5a0e447dd9b3a97eb095f72d15
SSDEEP 12288:m545Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:mGYz7KEMdX6keYnAcer5
TLSH
T1DB652308891B8AD2F84A467BFBA54540C93A6ECB3B8C93E1DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4228592e2c3b8a70a06c17cfa7b48303036f655644bd1cbf799a3ab4837ae2a0
MD5 45c35eeb73a64cd62156ca521677a882
SHA1 8521d5f6009abdcdb799320d37341f77ef10af5f
SHA512 212f4987d264b909044b52de7b75287ef4ba5f62a7564e7d561860d3566e9df940f1e95845d02f7fe17fb12f3aab8af5c81a31107f320cce08406d4d7abea8ce
SSDEEP 12288:pl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:pKYz7KEMdX6keYnAcerj
TLSH
T18E652308891B8AD2F80A467BFBE14540C93A6ECB3B8C93A1DD4DF54293FE732450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 94d807d9974d89baa0272f25461a1a388958d7bffbb501a0df351b15073852c6
MD5 c8644f8cb4b4d30bca7833b102bdb66d
SHA1 84b8a7e4c02d5b14190eba2dda7baddc900f2071
SHA512 f70806cb48aff62cf2e8eaa6a3259438d1fc84a185db4611b41afd5f323aeb6feab13722d06b4604c3e458b062ffd55dad120767ea0b48ab1629448f76ce8ddc
SSDEEP 12288:TyPz5L8e45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:ezytYz7KEMdX6keYnAcerS
TLSH
T1B975120767A630F5E0278239DDA20A01F77278761B248BAF579447732F7B3A15D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5c1a5f4b9fe8fdbae8ee8e796cdcd39ce3e1ee155861298a03525ce5dbb5a93b
MD5 499f2a9c09f1c4461ac42eea73bd2ff1
SHA1 ff49a2ef4781f561d6b601544502f60822f63064
SHA512 441f930e65e2215d7503aa36c6189d0495de5d7c78d2fccffe6985ffd3d0dc52b273c924cdf1a7d667b0a3060bd9538e11e765aad3eed34a7270994588a4fbb8
SSDEEP 12288:j545Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:jGYz7KEMdX6keYnAcerA
TLSH
T18D652308891B8AD2F84A467BFBE54540C93A6ECB3B8C93E1DD4DF50293BE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 236590790a6b16ef0e6f12344a614fabf73f01e81621daaa25e161e6781697d0
MD5 14fc211b15fd6f922568ce109bb574d9
SHA1 5a1554f6494cd497ba6af538759fefabffe6eef4
SHA512 d6dc7c46a71133ad23fe54d343907033f6e92796651a8522cc75df79ca9f0e06d2d47b40e33fd7e07d5d37eb8e7b5bf6cbb950c46861923618f013863bbe2260
SSDEEP 12288:f545Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:fGYz7KEMdX6keYnAcerA
TLSH
T190652308891B8AD2F84A467BFFA54540C93A6ECB3B8C93E1DD4DF50293BE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d4e489c9c2887f61db89dc3125784aa6d1ffb6d98279e0368f200f207bc0f7ac
MD5 046adace3bb5301b52bc125bf8384ad0
SHA1 755976eee41defb2ae23a053dc2db90f0c148a32
SHA512 16c42f679945cac4b1b61909fe2642475986404d547f7bb4ee0b34f93d78a6ea47b7cb01921093c946587b59f9d51986c628239bc5cd721b59428fee49fc6b00
SSDEEP 24576:yCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAzYz7KEMdX6keYnAceri:yCUxPTY+8Wg2lIL8lrIUJLWwgYPKEnSG
TLSH
T10665BE1DA3DC0896D4BB81358A518A06EB32782E1B32D6CF2160C37D6F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 01696c14a04e5d9fd3c62b57e16a88a2a45654052f37794246a61c3032c09f71
MD5 c28926905dd64b2290e9a776493e4865
SHA1 473a532713bbee2ba4d19b7f6f24fcdc0c9fe975
SHA512 4ebfb967134c66c4bdc7a3d85891e97323cf64965fba786cbe3f48ce02dbb500ed162f15279adb936e68391b72bcf1f6f42b2bb757653fcdb7aea7101b0c650a
SSDEEP 12288:qzsfp45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:V2Yz7KEMdX6keYnAcerC
TLSH
T14B750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 591af9bd259e72cd0e30b08dac101697ac516e33030e215e4eb9989f479c221b
MD5 9b9ccd0bf1e9664b4ba88850286ce675
SHA1 3374c1da380b5b3663106baeaa66df531072760e
SHA512 9082695f777808a994b40bb122fc5daeddef7e2994a1dfd5cab4d2d9ac0e98201968c28515761b9e973895fbc9f59d79d44ba9f70562e7b54444639cb7e480e8
SSDEEP 12288:vE45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:vHYz7KEMdX6keYnAcero
TLSH
T1E9752304875E8DC2F86E4677BAB58520962E7DCA2F48C2D3E80CB642937E6E14D3574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d42e05d0dd9e2262f09536635b373ac3b838e3fef68009f69190f983b670f11e
MD5 d4b8145fb47560a220c50122bf013ad4
SHA1 e1f4814ac0155322a22555213bd44d6bb8f6f14e
SHA512 b9aaed8269cd54ef3784d157c3583d3e066d9a67b01c476a01736cba0aa770a63260ad8efd6dae93270b5f5bf42b5ab35d328c29545b2489b7fd800685910abe
SSDEEP 24576:l8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC9Yz7KEMdX6keYnAcerJ:6RZwQCyiHiQEaaPnM+YPKEnSG
TLSH
T14F85AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 b1300bbc111745a82b403a3aaffceab8bafd990fab87d8fd380221f992a969bf
MD5 8f6e0e1a6f279c92333de95db6b940ac
SHA1 5547718a3b4328747d57e330a02b9f82fde39efb
SHA512 c2d0c253053fe509a3257775712519e693d8bf1371c3a785161420c54a8aa8f535aaada81603ca84e74100ffc708cc58d7491c7de3e6bbac3b9a4a9292bc8de7
SSDEEP 12288:vbxA1U7KU45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:vbxA1UGXYz7KEMdX6keYnAcerx
TLSH
T14275122E56AD18E1F47A923EAAE18101C3327C56272493EF5484C27A4F3BFE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d843bf9e2bf63722c370eeecd544a4febbbbb8fae522a75e09db86bc3f2d1c96
MD5 ffb5260625ab5d1a1a5ef32b4ddd9ed4
SHA1 bf8d07ed7075d051847175b2dbcdcc544ce0a690
SHA512 f15f839725b106cadf7d829747553f9febde7763c2439226bae2bd3afb210e07617e08613e4500c3ce3d21b0c863dcaac31a222f47dd12caae7193287ab7e37b
SSDEEP 24576:rjsmP0yHaqrVqHra44KDzMsrnoYz7KEMdX6keYnAcerN:rjRP0yHfVqzlAsrnoYPKEnSG
TLSH
T1F245AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 821d2ac7a4da2141657c0d5cee4ce9828efc94c4ea76146251c15952406f4836
MD5 62ca8fb51b655dc518762eae26504a8a
SHA1 fb321d1bbfe35edd0b8c210492745841c3a6adea
SHA512 6946a882c6524bb86003fbac482f72126eb2ac614fdaa60ee13e0dd2e3ea80f1024435c5ad2b2f8170f50e3e2848efbf819134efa89315f50324ee458fba65da
SSDEEP 12288:yG45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:yVYz7KEMdX6keYnAcerm
TLSH
T1047523088A0B8AC2F85A467BFBA54500853A7EC73B5C53E3D84CF54293BE6B3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cb681d93146e3545d7e258ceda1bc6d07f3bc738c0b5274edc2fe3eb65a0060b
MD5 440f539feb65d1a4179cbefe9f05207e
SHA1 4c9c345a5b019d450ac71bd3c3910a01d7ed4fb5
SHA512 a31c65a0bc85032a47b96a79fd81de34e675d86411a51af999828a73d85b7037865b45faada878c8e2596fd64b034300dc3885b76b97895d0d4560952f0fdfc7
SSDEEP 12288:qObMA4LWO+vAYFTQ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkB:bMLBUTLYz7KEMdX6keYnAcer4
TLSH
T119950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e1f3c7487416854712f160aa43e4560f8db5265b08042d7343c9e2df30ffd537
MD5 7c96dc6668a7fff5a44b3dd9961f66b2
SHA1 088e64e05ab1303bbe41a63a02ecd92b2bbb2042
SHA512 3b07b45353b3fda7ba70096bf14697755c9f4066f360f53dbd1a83d86925e8299be890a6f7eeb293431d6dbf399cabacea0597a9c2c2e2c78e5794688c549ded
SSDEEP 12288:z70VmKIYNvUyBp945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk+:8GYNH8Yz7KEMdX6keYnAcerj
TLSH
T17785F11E52AD0CE1E57B917ECAC28209F2737896171593DF05A0C27A1F27EE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cb9fd672ba93649548f34d351170f594872eb4d0263544f0d5ccd69e8d760d19
MD5 da2b8b86a841230a79c06ecbcc064486
SHA1 84822cff2d2d4fa78ffc90fe4daae9cb7ef2457b
SHA512 304d07ae5b56a8e47c6ed626949c8ef194d836831ca831e0f2e629a8eefefbeab26e6f787c85b19231ef6d7502f1197f82a8e6404d5aa502d93d6409d12575e0
SSDEEP 24576:tnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKC:tnXoJJYH84VVS6AmEcJas+cHBjSSKHPs
TLSH
T16165BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c79eb5d2613be6102ba3c9034d5ada2c4e452e31e29300ae10fe08fa0f35ff87
MD5 f2f089cd1609b2a1ee2482e15e2294ea
SHA1 ca2035b8e545520d92b16409ce46e45dda3622bf
SHA512 a2d2ca19418ed0972232f542c71314392e9a7137b2a6a761eb1737d84deb770974efc56e22c870abe7b4edb46c9e587607151fc1f178bdc84eaba3e98032a5a9
SSDEEP 24576:Gv7Xbxd9Tuycf8M/TYlSuxwr2PCaYz7KEMdX6keYnAcerd:GDLL9TuJ0M/TYW2P1YPKEnSG
TLSH
T182858D5EA2EC42D4E47BD6BD85B79046FAB2B895273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 53f5971d01eadc879590049e15e23ad2baa69922b92d9ac6d8f82c1cd03786e4
MD5 58287eb8dab3fcbe37a61a0a3338b1a1
SHA1 885e98b588e4a63d5257e0dfccb534898cf47db3
SHA512 c0b6ba9c75b8abbb05e8a24fc6f511e1fff62ea329e0b03f09bf7f5c3c0c62691cc044014239818cc772299d5dbba9eb0800102845f60264d303419ec4399b24
SSDEEP 24576:legJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wLYz7KEMdX6keYnAcerc:lngOJOmPOHhLYPKEnSG
TLSH
T19A55CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 d322b706bb1f6ebd8b658fd317f9350e3e6fded2ef4bbb94c1cd92bec7f29e1e
MD5 2db69c427d73550906e6b383b31f2c19
SHA1 daa9e3cc19258e7bf8c055d21391ea45e1a05f01
SHA512 0cd212ef519aef1782afdf8fd08a0673bc1383fad904cd1639d377403b562b96492106be9db85b484e79531d7a3c86b8ad2973bbe9181b8ff14c614174fa2f6b
SSDEEP 24576:CLJnJiTk3R3waE4JrO1Yz7KEMdX6keYnAcer9:CLJnJK8R304lYYPKEnSG
TLSH
T14D85D02CD2A810E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d7f3e246407e6c5ac6e8f97484463e2f50caf81e3e7868b9e291db729d2fcdc2
MD5 02ceb5d48d90d5a78ff3566a8870c97d
SHA1 5c2364c2b7618dd8da63f0f0d4d34dd15e5b88e6
SHA512 93be577fc7926216612d4fb5cc022798c916f58bb82b6d5d503681d4f9dd9fbe0affe90723f3757f461f14f3af01776f3762bdfd0fec17eca0cf39ef9205c48b
SSDEEP 24576:pA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pDYz7KEMdX6keYnAcerE:+9GqCzDScAZmlvTcFg8Ph6hYPKEnSG
TLSH
T143955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 fef06bfbd6250ac3a97d249a13ab46d45c399edd48d0e07a13f13b563bf0d6f9
MD5 701e3561d536dea13d8eadd4ec640a20
SHA1 d446733fa5b9bfca75fa6c164b6ca5d328b8260a
SHA512 11e3e5f76534975bd099306e67a01b438f37e4e954f974d183e139999d606f21a7954ef653c492e6b5f64fe2ff7ce670d86871fe2461b32b65b4613a127a3d2f
SSDEEP 12288:alYJeXm5nkEUuEg45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk1:alYJeXm5jUuEbYz7KEMdX6keYnAcer0
TLSH
T1D975121C669D70E1F02E817EEAA14900D372F4A6274553FF85D4C2768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 4c54f50c8c7d177f9466fa5f95d9f87c0fc29f04c1d355f2ac889c5421c0f284
MD5 ea597a402cc9abdafe26f78ee168ee08
SHA1 70971a316bb537d035e7d59cc5082671fb0b82e8
SHA512 261921a290d15100d52abd50bf090d1f79f882bd1e480008ea28eb3a9cb71aba8d68a0602939da94c998d24cfad1f6f2ba51a27705cf9614d5b64e0f5305a892
SSDEEP 12288:jCu6ky345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk9:jHtyIYz7KEMdX6keYnAcerE
TLSH
T1A5751204579555D1F8BA0639EEB28150CB36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 99aea21dfa4551bea2af0fa1fa5fd26b6ceadf42465bc4c3ba41a23c2eecf6f5
MD5 450e3d56eb3f43b753e82b29007a5a36
SHA1 6351ecb12fa7abca74995017c3f60a2d3a2ef80d
SHA512 5707b9c3ea763320850c3347b26ea401c4d96c138acfce1589f93efdfbd98975f6523fb4b616191f56f521f09c9564f0a718351d069146d66779a53778501b44
SSDEEP 12288:qPQ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:GLYz7KEMdX6keYnAcerP
TLSH
T1E875230C461B55D2F80A467BFAB54540C13A7ED63B5852FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 965c50f3e5621f1399daf603ea6c8010008ab23765ff0f82cdbc4af5beb43c96
MD5 5c18a8a0da06dda881b7344730b6c7b0
SHA1 bdb123d4f9b6452f724c0615d7697a2f0db88fd9
SHA512 65e2847dbfceed7fa3e722d092afa462b093fde39d0dda4a2dd1dc94c50cc01875029ecfc3d486a32f0da42e89cf4a4d17d69a70e314defb8e15ddab4feef05d
SSDEEP 24576:JC+TyQIu93VAumZr7jmWYz7KEMdX6keYnAcerY:J/TfIq+YWYPKEnSG
TLSH
T18C558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 eb1f054ced8814ac79b12eecab9fc789644c8ca2a6ccb9eedb1bf312f97c2ac4
MD5 a67fb7f571070c54f6e3ebad46aaa7c5
SHA1 597ac38dbf16d09cf934e555b79118cdef5b73e2
SHA512 342a7920921a33baef2e604af4e41f926edbc6285e480791069bcdbf9e6c94792061bbad7c93d1b8259c8deeb0f4fca7e775fd204fd17d610b7e581c0a24bd7e
SSDEEP 12288:UcyrWOstaa3kcsc45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:BLQikZfYz7KEMdX6keYnAcerX
TLSH
T18C85F10EB7AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 15ac5c2ac4f5a1d26d227f02e501fe43e7eb42701c48cc10994c49bb8fbc5211
MD5 9bcb30b36e33bfe4ae4300d77967c63c
SHA1 2db5b67deed26dbc8b017a14660612eaf480c947
SHA512 1b91dec8c7cd56ef87c8a0ffb71e9362132ee19eee8d0f22b4d9d6c66144909aad579847e18d97f81521d7916b79782df91a96bce6178fa9112b529edf4d2f82
SSDEEP 49152:tpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPIYPKEnSG:upC7b4+80GTkJYPKES
TLSH
T102A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 054749bc2e8c633338b1b6d0ad4b328794864b4dc7586a05b998895436efce73
MD5 aedabed0330d8cf37ae1d3704150b5e7
SHA1 6f448b4f5f7f675b2358395bcf6bb7413eadb5d1
SHA512 8a4e1551e37b85f0f4f9393513c6167e83ea818a3eace0fdfe4a21179ec1a8ee0f57052e699bca7dc8a84128fd9f0b6953707e2ceaa55541b3b8520fe37c1dbb
SSDEEP 24576:jSAwJPE1IDAo+4Kt+l44135UQAYz7KEMdX6keYnAcerC:jqPCIo4Kol4/QAYPKEnSG
TLSH
T1C755AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 25d0c51fecea87d7781052840943dc82ba0a1e66a27d4d51e9cbf63459829e3a
MD5 6e39b97157841345cd66f548b5426845
SHA1 090993f4dbb6ed97da69b29a9c72db3342d13fd6
SHA512 0f77ff055398c5679924cdb3340b79143bfe9027bf603cc8f21f52b877d32fcb21596a4ef90da3081ef46682ca5304962055d62d2ed0d9d272377f5afc7fea4b
SSDEEP 12288:vSsyLCFBoPLCRyg6NQ4t/45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkI:jyLXPLcL94tQYz7KEMdX6keYnAcerx
TLSH
T17C95E03ED66D08E1E47AC27DD6A38906F67238AD033166CB09A491751F6BFF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 770d739d4b018b0fe8a421602efc515e857be098821f20b9326ce98f1d8a98cf
MD5 8e52a3c97674fb32f221f66e3d4e64be
SHA1 8e7dd4d7baf1d29164fd0c9351020c299cf007d3
SHA512 4bf4d4e7a0ec9108352c384ae53b33fe5aec8b2c17b9de9bbbdf7323a4a0d20bc271c41ff7599c08c72f6836cfa55785d9eb6debf5d6ddca77789ee8eb2bef56
SSDEEP 12288:w9lyvj3IkxjbBzM45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkG:wWv8qjpPYz7KEMdX6keYnAcer7
TLSH
T1DF85120D46A468D0F47A4234FA728121C172BCB7276896FFB4C8E5B74B3AAD1853EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-404-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-402-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-410-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-398-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-409-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-408-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-399-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-407-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-406-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-405-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-396-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-403-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-400-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-411-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-387-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-401-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-388-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-389-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-391-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-390-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-392-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-393-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-397-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-394-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1040-395-0x0000015BD2940000-0x0000015BD2950000-memory.dmp

Download

memory/1460-376-0x000002701CC60000-0x000002701CD0F000-memory.dmp

Download

memory/2108-175-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2108-187-0x0000000001CE0000-0x0000000001CF0000-memory.dmp

Download

memory/2108-224-0x000000000A1C0000-0x000000000A1C8000-memory.dmp

Download

memory/2108-203-0x0000000001F90000-0x0000000001FA0000-memory.dmp

Download

memory/2108-169-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2108-382-0x00000000014E0000-0x000000000158F000-memory.dmp

Download

memory/2108-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2108-176-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2176-165-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2176-377-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2176-381-0x0000000000C90000-0x0000000000D3F000-memory.dmp

Download

memory/2468-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2468-350-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2468-140-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2468-138-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2472-375-0x00000000013C0000-0x000000000146F000-memory.dmp

Download

memory/2472-119-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2472-113-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2472-127-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2472-238-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2552-158-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2552-367-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2552-379-0x0000000000C20000-0x0000000000CCF000-memory.dmp

Download

memory/2772-126-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/2844-17-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2844-368-0x0000000001340000-0x00000000013EF000-memory.dmp

Download

memory/2844-25-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2844-23-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2976-384-0x00000237394F0000-0x000002373959F000-memory.dmp

Download

memory/3340-146-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3340-365-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3856-93-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3856-87-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3856-122-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3856-374-0x00000000012C0000-0x000000000136F000-memory.dmp

Download

memory/4100-38-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4100-157-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-369-0x00000000015C0000-0x000000000166F000-memory.dmp

Download

memory/4100-32-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4300-145-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4300-13-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4304-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4304-70-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4304-0-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4304-9-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4648-124-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4684-121-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4684-371-0x00000000014E0000-0x000000000158F000-memory.dmp

Download

memory/4736-161-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4736-380-0x0000000000D20000-0x0000000000DCF000-memory.dmp

Download

memory/4736-372-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5028-68-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5028-55-0x0000000001740000-0x00000000017A0000-memory.dmp

Download

memory/5028-66-0x0000000001740000-0x00000000017A0000-memory.dmp

Download

memory/5028-64-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5028-61-0x0000000001740000-0x00000000017A0000-memory.dmp

Download

memory/5068-378-0x0000000000C80000-0x0000000000D2F000-memory.dmp

Download

memory/5068-154-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5068-366-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5124-128-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5124-74-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5124-80-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5148-97-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/5148-123-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/5148-102-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/5276-151-0x0000000000D10000-0x0000000000DBF000-memory.dmp

Download

memory/5276-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5276-149-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5340-164-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5340-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5340-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5340-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5340-370-0x0000000001670000-0x000000000171F000-memory.dmp

Download

memory/6008-125-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6008-373-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6088-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6088-51-0x0000000140000000-0x0000000140136000-memory.dmp

Download