00cd617873b74a572f2ae11d3d9c226e1218c628a487bfa0dab7af1276c2a276

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample260511-d2fg6ad16m
SHA256 00cd617873b74a572f2ae11d3d9c226e1218c628a487bfa0dab7af1276c2a276
MD5 1bdecf98a47670d6b06ae7fe1e23e525
SHA1 546281868d04e606b2c0b0b6f672204ddf207532
SHA512 8960c6aadb26f52de0de4527b5478b031cec4ab03b60b8b7f028a49278cd26505da5949d93701a83543adc129450fbb298cd953fd0935156e9e685d52f7c0e02
SSDEEP 24576:QtIZPfhaay8a7MRpSmqAhnMDaiGGC5SYCsfJ4yL/tNCJPXUQrPb:QtIZPZaJtMR8/AhnCQVfJ4klKXnz
TLSH
T1B965AD2DE6A801AAE06A9279EC554702E7B37F05137186CB33A0755A1F776E08F3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4404	alg.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
3336	fxssvc.exe
6100	elevation_service.exe
2296	elevation_service.exe
4032	maintenanceservice.exe
5260	msdtc.exe
5036	OSE.EXE
5356	PerceptionSimulationService.exe
4228	perfhost.exe
4928	locator.exe
2208	SensorDataService.exe
3848	snmptrap.exe
1128	spectrum.exe
4360	ssh-agent.exe
2744	TieringEngineService.exe
3752	AgentService.exe
2104	vds.exe
4132	vssvc.exe
852	wbengine.exe
1712	WmiApSrv.exe
5252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ca3686c3bf04e52.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81421\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081c7d37cf6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008446f17bf6e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027cb767cf6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc6df87bf6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f61a667cf6e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e529f7cf6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d8f7b7cf6e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003950be7cf6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000132d797cf6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f49d27bf6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3b2c07cf6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004717a47cf6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAuditPrivilege	3336	fxssvc.exe
Token: SeRestorePrivilege	2744	TieringEngineService.exe
Token: SeManageVolumePrivilege	2744	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3752	AgentService.exe
Token: SeBackupPrivilege	4132	vssvc.exe
Token: SeRestorePrivilege	4132	vssvc.exe
Token: SeAuditPrivilege	4132	vssvc.exe
Token: SeBackupPrivilege	852	wbengine.exe
Token: SeRestorePrivilege	852	wbengine.exe
Token: SeSecurityPrivilege	852	wbengine.exe
Token: 33	5252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5252	SearchIndexer.exe
Token: SeDebugPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4328	2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4792	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5252 wrote to memory of 3560	5252	SearchIndexer.exe	111
PID 5252 wrote to memory of 456	5252	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4656

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4228

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2208

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3560
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 39ad898c29b55b4ed310b9937f6712639fc1d60a22a7e0d1c5ca2c3df333206a
MD5 f76dfd175ba63fb33053272ceec067e7
SHA1 d1734cc5ffc37b723517fc18b2c833647318aaba
SHA512 935aa8ae0cedd0e2994bd36f9a2d938caaba375393b7071f6f5ec76e666d85d83f39f8f814d1b4cd62a528c390a97a07ee00be1a6193221665ff31febf1f5f0f
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0fJ4klKXnh:53q6mjB7fJ4k
TLSH
T125D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c0f9bcc310444028623f1a151d33e7c25d149c3b41752124633874d9910967b3
MD5 4a2983520163980dd261ca65ee1ef5f7
SHA1 41c1acc0b58ef33d3e5de0bfbd2ad058fae79cbe
SHA512 eeded53aab7095b15d76f36d8d3f07d64a7a6e4ad9fe6cab36a2969a9cd13e9b29dc71e954aa838c61f441b7c395c53ef5bcfa808d754b5ca8d4e7d1da5d2b25
SSDEEP 12288:M1XLsswWkxy2lRq2czAXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:6XYfDtczAXfJ4yL/tNCJPXUQrPr
TLSH
T14605F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7feb3b4826d3094f30068805ca9ecb6e42bd9f91a27b9737e859c23c4166ef6c
MD5 373b13bda62bf77e090b5d0e5a06cb85
SHA1 d755a3d2c0f6808bfd7632b70377d1d80ce2b3f9
SHA512 a409bcfa43c01f84ed51f20fb37dce1548976bba9d0c890f39470d5de1c23ee9729f1e971eb66d3351362c1a6428e70077e363feb930de0244ceb9007b48516d
SSDEEP 24576:70Le5ji0hmxhrMcfJ4yL/tNCJPXUQrPF:7Pji0AzdfJ4klKXn9
TLSH
T1D535AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9a928c18225be8b29a1b2b69f372b68cf7c7f1e99d12150d6e2ee6a53fdab57e
MD5 12657216fd447b33892df10d6ec98c9e
SHA1 2c68fcf05192d45d8c9e1fe517f3db417501a921
SHA512 01ff051316f1e7e5aaf895de67f42feb7df74fef80fafed65fe8a9f1dd6c1a4cf5afe819aacbb5d682af9987001cb8166a9b101290484a3fb37e4e61c58fc79a
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyu+fJ4yL/tNCJPXUQrPL:j/ezSC6vUzPv+Hjy5fJ4klKXnz
TLSH
T166756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 261145f0c004ad494716cd28bb52dcc84043cc195c66e3817c2b5a88256fd0df
MD5 6272ffbee2786213e8c82d1e86f1bfd4
SHA1 a04c7208ca519ec0f0629cb05c749f256c3b34e6
SHA512 97bd73e2bc4552b5e2e37f11ef775a1135cf2f50e33bc141c8e58da9e126fbf9b2e3bfce3dbb8a69977c3460f097e6d3c1221bad260d049b1efd63816eb49126
SSDEEP 24576:/VbqPb88hv/l+BrfJ4yL/tNCJPXUQrPu:/VO88hXl+9fJ4klKXnG
TLSH
T11F559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a3789c3129dc13b982c9c746d51cdb6b75014acbc66b53785ac55aa9da5948ff
MD5 76b60427054a1ffb7a3befbc4bfd8619
SHA1 635050574e0262db8828cd7a1a784badebd33b54
SHA512 1ee75c1b64f621d07162d924386ab825e95a5a15fe05f014745f7317d4aab18ce7bafa2bb25e1aa91fb56310faea9e4e2454f961038612ca7619d2319f0e473f
SSDEEP 12288:gGgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:gGgfJ4yL/tNCJPXUQrPP
TLSH
T152C423E751809486DF6687F82A88F001C704BEC5562FA2F6DE82BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1079243b08f4a67e5dbe838062598db96360a17cbb56030183ac608d52da3956
MD5 84f91432779a64707f5271591beb92ac
SHA1 0e823172dca5327066a52b806c69b5d7ca8e1b35
SHA512 470c4f1c4b21987588f4432a34073d1643d293bc9dbf8c91e5776854032bb9d96be9ce82286853336681fbd1b65c9e41c1ede3f248696622c5fc5dd41797ee52
SSDEEP 12288:UeBNUbTVO86UTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:UJIUTfJ4yL/tNCJPXUQrPD
TLSH
T12305C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 35516534b57e337d2bea3723e1d59f7ac4b897b3668a788f616424083241f319
MD5 de377647c319f1d2c34ac125d1dbdecc
SHA1 4bc03a05d2e283aa0178809994e9c0884e24e203
SHA512 210d3f0bd0a22d39faad26e582ba0910dd9ce5d1bdcf69687fe4afaa9d6614e2e446256b1f17b482687f8c04677c3ba98c28d49e438faffe50bf344b44d169f4
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THJ:lQvGAdlCEL8c/WRNw5CufJ4k
TLSH
T161266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 dde5f8c06e99ed7fdacd1b44f8daa880a792e8fd8a3ab98d1a61510f2775af23
MD5 a177133ad49c978e704fa1e515915218
SHA1 dddc8eb2444fe4c36492010cfdc5c3e783a6fe6a
SHA512 7e2ff45bb2c4702388cf5d0e316fa1d2efc53ad22a3abd9ed3cf4c33871e31126f34bc5d93855909df0d677874df5e8a46d73f0038527c24ec1b6fb67f1e7eea
SSDEEP 12288:ZAwSfxL/2Dc3mDLLmt0LDQewsAjNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWp:KfewsAjNfJ4yL/tNCJPXUQrPv
TLSH
T1DD15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e9f9bd04318f2ceff3eb922e1373f3794028f79f43e085d59cf58201e3390443
MD5 1ea63db8d8063c55ef9666d2e15d8fef
SHA1 48a01f932a63781abb60b4b950feadc86e26b822
SHA512 765b1842477990e0af046845324518a1e6ba46c21413a8b605ba0ef93d57a21f773f0eeec66c972e6c0c373be1e58ffbf452d2e0add76dbcf1c7359378cc4820
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHlfJ4:KUEtQevvqc2W1cpV20I32l
TLSH
T100474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac3b0bc3611181595c6c92d2c9259b9e1685786a329802e78dc58406330b32ab
MD5 cc8f2ffb2b6da2f2ecabbfc83b94b09c
SHA1 c572d3eada2090e2b888ea00fd6f2fc3dd5f4408
SHA512 6f387870fbca303f5e48709eb551c7c9f5b51f0b06458fde361d08f39eb9b07e76b63fa40137f3cb76b76dc36e9fd84d85dabcf87f165b9e89fede3e63f27186
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/ztfJ4klKXny:noqtVjnmqfJ4k
TLSH
T14ED58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e10bb0c0ecadf066b4ddb7d91eefe8f8075c5ffafe0e48f1c1ad3efa1354e0d7
MD5 332d9605bd47ee947efeea0b90f73030
SHA1 94b74535b0128f94f5f5a2d4f574626bf58ad628
SHA512 b8da645e540bcc8562c8028d68a89cff90daca7b24c5d011453540c87b85c8a0b28a4abaebd929b6343c1647afdbbb2d4fab4fa9b23fc04dc5ef6532cf681909
SSDEEP 24576:UAhGL6IFoiwtA5l7S53KfJ4yL/tNCJPXUQrP/:UAM5Foiq5afJ4klKXnn
TLSH
T1F8359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c32681574e39cc6d4705c3917027fac58f351701c59fec71027bfd5ef35cd14f
MD5 5a777071012556c57db0805843a9f46b
SHA1 9b2c7e434244244f9a6538863d263adddf00458d
SHA512 25d999fc7031f999b4db127d1ff4c871c76fc96003a8a408a860be0534930d3e4d944e57034d0fa69d39b998c707fdc3c7ab4e2c3cec489e63da1f78a9718110
SSDEEP 12288:Omw5HEjsChNEBFgl0WDm+CefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTL:HwuROWZfJ4yL/tNCJPXUQrPf
TLSH
T1D105014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 86090625b3058dee4975f28b74557d5f3edb81bb1d7cdd9b8d0192b6adcca73f
MD5 aa366dd931879deb04825213665db7c2
SHA1 6eebff96e4f47ddf0a523f51099e72ca74fb820b
SHA512 8ec41c1747c94ec76a8e61544909bc0f86f18c8fc440dd8af9d2d276e021922a34fcb4f5704f9063478dca1abd7051c52d1c4b65a4e02a40387cdad165bc367a
SSDEEP 12288:2yZ1Iy9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:PZukfJ4yL/tNCJPXUQrPP
TLSH
T1A2E4129B32D460F9DAA782BC8AD4D101D3317C92273A43CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 edbc3a081b7686955b837f71c3dfea36f62f2506bb565588ca52464abbdbf7b1
MD5 67a782543e8d55f821bb7c98dd629388
SHA1 4a4d17157892ba088d2b3a9bfeb396923d6d54da
SHA512 01a07a438a7522584dfb6f610ad8ec76b4b69e1f03ab4cea623964a15a919b66896b7a812c154e67086ee08cd0e57fd90ad69de5a0294d28014328cc8a93dfe8
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:+QRQyi36YOcPDLvw2gAf+PN3/fJ4k
TLSH
T1A6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 afb94cac4b52b3c358ff1dd4cdf9f193acb534ae403fc825c3465ec122a6cc36
MD5 00198ff15391c9e40d7b2a33d716c7e7
SHA1 606da5fd982f0b34e2c261a07d28e70e86973032
SHA512 92cacbd329aa9084bc02b60803b805b2e787d06edf718e55a81e93aeca06e71d7d6dabb3532f719efe426fd10aafda62438d5e12120d0bb6ff29d2aa07565c3b
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U1:KQRQyi36YOcPDLvw2gAf+PN3/fJ4k
TLSH
T17A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cf65c09ff8f80e0b6f051e415f9c8a10f569c54e2d0e6bbdcdabf88b9f20a05e
MD5 890a8d4784f599eecf7c0dbac6fafce5
SHA1 a7813830682b693d0de3dfdaecb8338f746ba2d4
SHA512 4a8df9e0d944e096d805c836f004ed552ca4525432485f94f7bbdd7de0fcd7912bbcb95d5dc046e145545ce4f1405c3f2eebde27d077f4edf09972a804aa2453
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL00fJ4yL/tNCJPXUz:468Qg55nhkeWu7PNU3/dfJ4klKXn0
TLSH
T1B6B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 60fe9150a4528a416f63f4c908c5c4b302080d1aed31bc91b0e2cafd87bbfd3f
MD5 a07201d1b88f1d68035544ba159527c8
SHA1 48cdd628a3cf1044158adfa9f6008ccd7d489c42
SHA512 b5ff92c5b2caf41c05d7c302ffe272e05c08799723ed9f147feb6dada9adc3375277b76782611be6517c5fc0fdca2efbdf365e28214a8fa6e4e4f9022bff3fbb
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99C:3y5112gYy5azzVvU69nLKnhZgfJ4k
TLSH
T18D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dd31d410f8c09e478c840b9e8c855dcd797dc71e9f6f2a21fda848a7a4f77955
MD5 e6851094c50e0fcc8c55888f6f3d821f
SHA1 a3196bc615c0ec870ee9fa2d12909e78c11d46e4
SHA512 a794676a28e757ecaf727848444fd74952725e5490a6cd2b094c5afc63537eb3e877d978d9780e5ea584b16c75c5830a5ea980c40c93e6cab74d18c2c34e585f
SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnfJ4klKXne:nu6JmIxd2dnfJ4k
TLSH
T183D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3a604b3046f4d24599fdb67674694d22f2125187e9d07b3a6b210a8d49e8201f
MD5 0217f56f8b5e3c5eb2a9062fcb7f5836
SHA1 9637815fecf3875909f8922ea09a676dd64b65b1
SHA512 a93032d306370e51353d945286dc2a3901c6bf32e24a6af4086542c43401e03e7a37c0c53dfb002094c7ace902fca734fabe4e0ea209c465b141fc49c47b1293
SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4xzfJ4klKXnx:6mifPqRqfJ4k
TLSH
T1D5B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4848f7a34f4290fd245847eef2243fb35a6dfcb46f3f51eed17bade411c6f610
MD5 fb98d8ef5a6fc35338e3d2661cd68475
SHA1 32d22ccb3b37eec72bd7d6bbb4f894c3f3274043
SHA512 484ceaeec7431c8886ba44ed6f24f7cad8b03ac38aef65a9f27453d7fd5aff59d23aacf35dac7cdd699c588d608b4e71646f05542e2d483a7a15e41150a7fc2d
SSDEEP 49152:wSuZQIY0Be2KkRVtOnks6NMHqkfJ4klKXnX:q5dKqi61kfJ4k
TLSH
T1E6C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 370f316bdbcc79071e270a9005ccbe45b8756db0c3f6a4cd315ef9d3a997c553
MD5 e168a5035d97302536206108adb3e951
SHA1 e961c3a47ad091ff5f324f31267c45441789918e
SHA512 1307dd841e65bf626c7efd8b9b67f4eab69a984dfed2de602bed0eecc1ac9e19b948fecef1bc907fc8b71545a24c85e1c0c1371efe78e20f0bc74024cf3504f4
SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5wXfJ4klKXn3:eX2iWphmfJ4k
TLSH
T13895BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a37c4dde68f6269a8866258ee2bbaa201828e84ba9fc4d6ec7c072aef47ffa50
MD5 d5892243d413ea7dd8c664bd0b9ead6c
SHA1 1d56dff7521c89e499fddebce7dbbe8201504d2e
SHA512 61f2c21aaba42a425a8f853a4d3853c087d9bf9226f4da14ef0bbf6188df27aafbba2595ae394cef47dccde9bfcd840275bc64829acf739c9fc3caf09a9159ce
SSDEEP 12288:5ofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:5ofJ4yL/tNCJPXUQrPu
TLSH
T177C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b6b79c0c7a9bb6eea536706421abc4afac71d50e9ed76936f0cf4fd56ffbbaa8
MD5 80d3b66382ff759200fcbba4fcf0dead
SHA1 7f6f45dd31680048d6365ced395a3ca4220aa0f3
SHA512 5fcc3aff670f2f6b51b2b06ce1304b21a8f1df9286295481835c396d79de098b5960d95c8cbfc660557e0335f212edfb79abdf043add1ffc060ae633ed0dc14e
SSDEEP 12288:tRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:tRfJ4yL/tNCJPXUQrPu
TLSH
T12EC423AB60D5948ADE1587F81748E001C7047EC6672F62F7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6e46e56f27b05bf078ee47fa8e1d6fcab440444bb5289207dcc2502e17e65ed7
MD5 0902c70203fe1f282021dae79fb0327f
SHA1 d9d2d4f98994b69ac0bf398b09128bcf167ff44d
SHA512 bb4f6ec28c7bb6d2378cb1f4fbdcf383f5e02b54d4d4b5a57481b520bfb51d9fc96924558244b536c2e2a0d2bcaf75c899cc75729ae008e4a3d54f37ac4e6f7d
SSDEEP 12288:u7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:u7fJ4yL/tNCJPXUQrPu
TLSH
T11FC423AB60D5948ADE5587F81788E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 590bb625ca6272767a45d72b2af6cbda7eaf26956253dfaa631c7edd8167a141
MD5 8825869330f30bd6cc2f1b2572b08ef0
SHA1 16d28db56069a19932379ebb0653c00c0ce34901
SHA512 6270a4339177de363ea44951bc890cd0f4e808c9b2036ac057d794aa2fa14e6276264c4e93463cf80bb8e4dccdaf3147a01df42168453f2c8637e334db889f51
SSDEEP 12288:zVqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:MfJ4yL/tNCJPXUQrPO
TLSH
T1BED423A7219480C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 bcef4b12d0deb9e8269d47e9f220eef8c8bb8fc40caafca096d0034a0ca67d18
MD5 f267ebaa0f41258cbe3adce219ad91e3
SHA1 d6bcae1580aeae25b545f7041f64a8d687764268
SHA512 b9ec5f704d5a3cfd1286718b7c12e71944558cc20c80f70e70eff8955f3b7071179857867232f99427f624a8b81a801395bd3bd81f89898a8ad769aa3dd34c6b
SSDEEP 12288:GifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:GifJ4yL/tNCJPXUQrPd
TLSH
T14FC423AB60D5948ADE5587F81B48E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ad9a8292e794849c8d8fce0782f66d9a921acd6d656c37b880d980857e3e0299
MD5 8f28cd1a56e1eebe179057cfdf1a4569
SHA1 e61124645a4431a10f47cee240155bc643693f9a
SHA512 d57dba2d2d2ed14ca61ca739862fd82fa5d68082374b3617f7e48205f40220aa991c5b6ee3ffb0076077c59986f22c4900532f3821339b4633403a87e3f58df4
SSDEEP 12288:1VfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:1VfJ4yL/tNCJPXUQrPd
TLSH
T1D2C423AB60D5948ADE5587F81B48E001C3047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c0ded1b35d5402107af826801d2dab8eb34e69f7f7b410c175d270d350fe9222
MD5 7796ab5e2e2750a7046c68ba5ae69837
SHA1 3d6b5d1ae375cbca766d267e55c2f32f1974d25d
SHA512 df4353c53afe892510ea2f2a121afcf3ff1bfd0cee39f0a1136fa0762512c13523dfd316ca983a0db77b44b8bef40c4b0aea36ee2f810de9b860cd0aa4877e41
SSDEEP 12288:rpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:rpfJ4yL/tNCJPXUQrPF
TLSH
T180C423AB6095948ADE5587F81748F000C7047EC6672FA2F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8cf52850a891e8828fae9f56f2d0353095a996d05b1e389dbec27ee8867c1302
MD5 634e9310582ff8ca4b39a5e0c29037d4
SHA1 b5558ff67bfce6b1b9c55eda6733fa282b8ffb98
SHA512 b219a10413d945c9159cc8614558035cd8b87e166ebc096c8914d76305e71057bb75cda5adb6d6e9cd80d9d52b168bed166c64b757fa70e841c45241a0518c14
SSDEEP 12288:QiZwbDzzFEoS2cPvyxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:TZM3zFVSOxfJ4yL/tNCJPXUQrPB
TLSH
T1E40501A5B39018F8EC67827D89549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0df860783e0e0881a76f1388732e20e99977a07ab0bc189d0d7099604dde48ab
MD5 8a08cbcb5ab02153965c997966057dbe
SHA1 50c4b2598ba9dc841f5a31ac32631fc3ccffda2b
SHA512 ce4012e4a3a0dfa16a5dfcdb3383d784808eb51077e3f43f07f0bcc55b44c3e7536ffddddc063c8197b0a979a66d28aeb366f997bead8a3f9bc41ae2eb1efabd
SSDEEP 12288:eUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:eUfJ4yL/tNCJPXUQrPX
TLSH
T139C423AB60D1948ADE5587F81748E000C7087EC6772F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 94091be910ebf719b069202970d8d7f25369e101a784a6d0e2bd0f13f75daf68
MD5 778d6d4a2d72e69734567af29c1b005a
SHA1 3812cd85b7a60565542de5fbc818fe2702d3962c
SHA512 653f073f0d836bccdb8ebf6806b8d52871f6b1f60122c7f371579250499d9b2a31809070f84ba6c84c6af51c883010aa949412a129d9522a77eff2af4364b87c
SSDEEP 12288:DQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:DQfJ4yL/tNCJPXUQrPX
TLSH
T199C423AB60D5948ADE1587F81748E001C7087EC6772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a81052ded30fe74d84c94c26de2bc1f279df2883f0d617c57ee5f03abddec5d5
MD5 3f242686bdd433a40710c6c9a5ee2f1f
SHA1 ca18fff37731e13a4ec5d8ed8aae4676c38e2fd6
SHA512 536dd358e6df8c62cd4bdd128a6833eb676066ef746fe3b3051c419b423c29340c46aa07caf8dd5388b6a3d1059aec910d9e3440836c3e531d3fafee688840f0
SSDEEP 12288:sUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:sUfJ4yL/tNCJPXUQrPP
TLSH
T101C423AB60D1948ADE5587F81748E001C7087EC6672F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4c7b36b60a709aeb6e9dde4b033ae8a3541d37eb2b256b1bf01a2b7c3fd09d80
MD5 7cb01474e04910b98787b099a85a5a91
SHA1 3d39e66639a03ba948858e0e907437b751bbdbe6
SHA512 63294190bdfe9d0a2cfc72c81d8c476e47efa5e727929657423defb2138825729a89e2f3cce4bec1e212a9d43fbc1081457b322512e1791eb8c9787c87472f06
SSDEEP 12288:pUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:pUfJ4yL/tNCJPXUQrPP
TLSH
T15EC423EB60D1948ADE5587F81748E001C7087EC6672F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 cccf2885fe4dddc3c2385310a82f54fef4cfaeab8c01313b32a32bdfe556e56d
MD5 3f88899e52f322dedc05eb075b3989e5
SHA1 4e799adef353053cf7156f3a097a680367589231
SHA512 db9360633b616829b2b55409ec18e374ad0578686b2063643243fc7768ea30a1458b82f39299bd5e0e2612bb7d05ee465f640f47d172e5c5543d19f256e510c0
SSDEEP 12288:tyPz5L89fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:Ezy9fJ4yL/tNCJPXUQrPB
TLSH
T17EF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c71f104879d37decbf745311d527d9bded7e2cac9a1ac5a47d97b7ceb289793d
MD5 0ae0c992ce2b3a809ba5a6ed43bde74e
SHA1 4830758796669de85a381ff4fab6291d0ec7e39b
SHA512 3fa5e24cd810afed9d6c47feb9bb2790f0aec0f28e870faa149e9ddd6b21228a204883f560cd26a7b41a209bcfa9f6a4ce707ca5b45e074d91574f0bf7b57418
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71nNKbrh/8KBsfJ4yL/tNCJPXUQrP2:9P4m4IpOO67W8KufJ4klKXnO
TLSH
T1AE65AE2DA7DC0096D0BB917886658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a7d06bece49b0f862524a10faf83dc8f5397556aa529fa89b796c267ef42912e
MD5 738989e00deeaa4ea750cc46544f8a64
SHA1 2343aed8a9ee70ad4a3ea32fbc47e2542ced0100
SHA512 c0766b3b6d77cebe5d94e8e47ce81b1ac44a45505cb77844f16211abc5090b215f568746fb35b8a9625749001263be3690e35432cebfed6a9b5b9224e1064c14
SSDEEP 12288:xpsfkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:ikfJ4yL/tNCJPXUQrPJ
TLSH
T14EE4015AD29441D8C46E92B8CB449201F3237CA593E2D3CB97C0F87E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 01a4e7abf70d9fbca2c40829bc18e7121a315a3fba268ed7ef4344e9d0205d68
MD5 cbd6a6eb6a47dc142b50e9623f5c2a2d
SHA1 f88fccf2c9a0d89c65056e00b0f268b0dc9c7bce
SHA512 55d854456d53b60985a688d8917a5068665e27acf9f88d2938412a3f7ce2ababe0e9596b56b23ab7fcee2f743c44bee180cb984e53186f8610baa20f992f28a5
SSDEEP 12288:eEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:eEfJ4yL/tNCJPXUQrPj
TLSH
T1ECD423A761D8D44AEE7687F81648E000D3097ED56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 999d3a192247b2b7fd45561e97a77c50af256892a9d97785ee9b1d4cc73db21e
MD5 4d64d45d85a6a858df1cfda3aa54c939
SHA1 1e35c2e1dbfe154ac7d60029863de94d6ae386b2
SHA512 bfb45995bf88e73dd2ec63ecbce4f894cfbea434249086642b3d7c2afa218bc264051ff59a7ccaab2dd07a18999551ab6cfe13fd825f4cd4a733349c68ed02b5
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQifJ4klKXnp:Fa0hNYG4JwlfJ4k
TLSH
T1E7859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 e2d67c74796006c9ad48bf3d3e2da46760e7dcde027eba7bea3cf0a277e193a2
MD5 b94281edcc95a507613dafaeb2526c00
SHA1 5b8373daede4200c84d2415af6e22d52a9ca0630
SHA512 4458a458aaf11d46f03428450885dbb4e66fa09774a4ad70529a113c3c72d2f48290bd9cd5e3cf04d3170e1b9304f0594b11220a171d69204e034e3e800d3f91
SSDEEP 12288:MhbHjfXhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:MhbHjPhfJ4yL/tNCJPXUQrPS
TLSH
T1A1E402BE22AC20D9E571D2BC4684D106C331BC951726A3EF67C2917A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 14aeda7a6e096297f843bd838074c1beb46099a6d177bc78510b4687fa3ffaae
MD5 c65d8a8ba3fe12a19e94255921e15bc1
SHA1 d917fc04a0348634b1ce80a1be3eaa410a3ad7f3
SHA512 8aeeb9e55ce28ec51410d70456595e3608b11ae754aee7bf4c514b3fde4b4463e0d6bc5e8d654fbe41cae9e2167971b605a286664f43574a2072004d37f5cc1a
SSDEEP 24576:M3YgnJcRTk4yti+R5dBR/ZfJ4yL/tNCJPXUQrPj:MIgnaTk46pBR/ZfJ4klKXn7
TLSH
T11C45B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 842f12cce01ace635a284fbd1845b587d675eaaa364cfecea6bd8e523a9a8171
MD5 b1a3435e2a8fe0b5a7c820b0812f4657
SHA1 c731b5c7c67247eb9fca7f2a6ffc472c3c42c13b
SHA512 972cd3d3cdb5e506392bcfc6abcd60f67805e58627ceaa4f7add9a70e2b9555e5ed413cfcf7d0bfa4925f017c1394996089a8be6ac0837ee28dc0fba24fd8bf2
SSDEEP 12288:sAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:sAfJ4yL/tNCJPXUQrPx
TLSH
T1A9C423AB6084948ADE6587F81648E001D3047FC5272F63E7ED82B8857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 06f59fb66af50c84949ab9b2fe4cf8f1c566801e5d21b6491ef2cce5ca44e763
MD5 4d05a46243b97bfe57a835837016d089
SHA1 697a49c186e88d1bb2cd462e5a0080eccf71c95e
SHA512 8f35b6a30fb8b83362fe24eee7d24869775d9dd795882510816a9311cd8b87335f4c2023fb1fa3a140f1e7d3b545607b155341de24e9407ffa32ac424415c01e
SSDEEP 12288:LObIA4LWOsvAYFTXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:UAL3UTXfJ4yL/tNCJPXUQrPE
TLSH
T16825F155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 ba2baf11d5bdf205496423fce00ccb051eba94f2cc4d82558be6df15e55f3e5b
MD5 f161deafd50bb02171fdd3437bf43968
SHA1 1f18facb989e75cee063d8e5cfe4e5f9b2cb22b4
SHA512 e6d5c0c2a0f19eaf0f2e1776ddedf00f7a096783e5a1d8e42e1a70b809cf873281e0260dfafa8ac682bd0c045c2cfda3b1c57823ad6137d6eea2aefb1a6d650e
SSDEEP 12288:NpFtvOzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:zOzfJ4yL/tNCJPXUQrP9
TLSH
T1E4E4026A32EC10E5D576927C4A85D209D331BCA6172653EF46D080AE2FF7EE82C3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 335c236e9f50d03fd21b4130c1a3a54406f484103e9b5a01ea1a93380ba511c6
MD5 ce119684af019ffb15c73799157101e8
SHA1 0f6ed8fc5d986527a54b121e7192d534964b892d
SHA512 9e60ee69c3018e8a2dc3b0b527ea1e3962a02d4f3348dac6703d91e8123af350e6b6fd03ba08c77c682fd166b883028e41253ea56257b68a4e7afda425c14100
SSDEEP 24576:i7NM9YqZqmWMUkPjZM48Mv6bEhsUfJ4yL/tNCJPXUQrPK:i7cBWMpPjN8DbEhBfJ4klKXnS
TLSH
T1CB65AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b1ca483e8a2f3941520fe35a11198ec9701eff0d86366f35fd4b4e72122f8162
MD5 0cd8b6b94825d28d3c0ee22711ffcaad
SHA1 0bb293e38a5a5c9ad8e37f006210b166ceacd6c9
SHA512 2205437ea9947852bbc65b54bfe0975f6a3540b4bb16c5616df04808163b291e5d2f73d5e7269f009f86a41674f55d49f03ab4d351b960b09a49d901e7e3e0be
SSDEEP 24576:8W6BApg2YuyuNDYTabvcdvNYf8km12fJ4yL/tNCJPXUQrPx:8F2YuHNETovAvNYf8km0fJ4klKXn5
TLSH
T1C8858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 194cfc84f9fbe2cf3f7af83e75d4024fc5b5ceba241ab789d75bd6c00cba4705
MD5 c4292b138b6e896515b0e7a06c869158
SHA1 9d15d1cca43189f4291c58bc7700cde992c79e1f
SHA512 486905a48ba04cff87b7ba62f748b3d5e2b0c98bbfb809c84471186b4ee73043a7dc9f63e24a549487f3d3826f9c0322b459725df973078ca8fa6210704640ab
SSDEEP 24576:OAFs06+Omlf8NXEbToffJ4yL/tNCJPXUQrPQ:HFs060loXuCfJ4klKXnY
TLSH
T15B65AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 25b418bc2ea59573e79fa09317ea506475aac4264428b30e31318017c6daf021
MD5 55fcba3aa14252e2b6d899bdb3231c79
SHA1 1da6226bbb7288f78540cf853a0356bdf1b64656
SHA512 90924b65ed87f7727d5cfa617680efd5fba164b152974bbe20a4411c46e7818cc7ed9b9256a2420f4ba8c78ab6ea76e236f43ae93de9ae8c71de0b033932b34a
SSDEEP 12288:7CJnJ5D3VkrDzx0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:2JnJ5D3WXCfJ4yL/tNCJPXUQrPR
TLSH
T16F15D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 38cd474f38287be062f6c9bb81acca7fe9ed1b4cdbf31e0ec996e3d05bc78e91
MD5 5e9823ea0fe68b9e94e280aecfa4ac67
SHA1 dc46b0fc1daf5517ff2c952f4934ecbd6b240f80
SHA512 94b2c4c08b9f14517ecb4c94dd884f47a440bab137ee88acefad0ae3eddf72cdac6d7ed916dda7c780f3e058135ca1bb2386dc8b2fd55080a536d8c9c4d34052
SSDEEP 24576:9EPghm6/7IIXdwcXrif7qQncjlP65i3VuZfJ4yL/tNCJPXUQrPP:Kg06DIKdwc+eQnSt65aVofJ4klKXnX
TLSH
T1C5955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 bb75217a36f6b8556a2129488fef264e8bbe99c682588b21c1cc80709b4650d6
MD5 8acb544866f6bb836aa791e9df4df523
SHA1 ac5adf983c3c67fd5748c1f34be388ca79801439
SHA512 df94d15460af0701bf35555fd7e5c2397a2e58b81901877938df737990eda4fafecbdc45c5cfd6637b174d6ebba3c3fe170b5e0f432258eeaa1dfbe68df0c717
SSDEEP 12288:yEP3RnefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:xnefJ4yL/tNCJPXUQrPl
TLSH
T1EAE412AE229CA0D9D52691BC4680C101D331F4A12B2723FF5AD1D17E5FBBAEA1D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b74a522fa5a3e34dc02fc6451558ebb332fb9d568e350a661d6f67ef409076ac
MD5 ed404d9760c3b29ac68f2a33f870ee52
SHA1 fff082c3c2faa9ecb402c7bdcb5f2df7c86a4b0c
SHA512 33d7eb379b444682fee27029d432201f8bd6a2ea57b4c48e033f5561ee3cf8f9ba0096a9150e150660dc174e467f2371d49bc9beda256fb3a3a0b7e0fdbd637d
SSDEEP 12288:1jkyRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:1IyRfJ4yL/tNCJPXUQrPJ
TLSH
T1E9F4224A23D4A085DAB643BC5A55D140CB34BCA06F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 9be941b6c63a4f569034a4fe1b5ef05626a538ed560222d2eee0845f4b3ad621
MD5 9fe93d22bbc9dd080198227d61a9b58a
SHA1 c94b9e08403373d914c7f7f8aed649159a53b4a7
SHA512 fc7f913f7d9e69edf3bf06f3c85cb87022d088e8b974bb06fbf852d7abddbde2436ffbf493a7a240de062660622c7b2dd2a3c50e420b2af3dc34045586f712f9
SSDEEP 12288:byjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:GjfJ4yL/tNCJPXUQrPW
TLSH
T148D423AF2195A08ADE2687FC0648E000C3147ED5272B62FB9DC2F4A17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cfe9a848a808aa1ac236de61bb3509d2023b8e98086832a2305b756fdbd2a2d7
MD5 b7c844dd29480d9c7e7e7c993b99e488
SHA1 8d963d196cbf31c01bb97f19943e100438a20e2c
SHA512 e020338523bbbb3f094203005c5a727ced5c3bec7ea101ab3118c6c9ba6678e15c6d445346fdefff46e38ed989ab819a8242efb5dcd282de2e6cb6670d84967e
SSDEEP 24576:iQ9MxZKdcz9dw38fJ4yL/tNCJPXUQrPy:iVKZ8fJ4klKXna
TLSH
T136558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 32c240fdd7be4c8aace60f4a35f19120113475d43a61c98068df2b1cc5e6c64a
MD5 0dae7c4a5f2a857fce651aa87caf5306
SHA1 898d37e6596872975de006db8f540b9011c8c4dd
SHA512 185fffba9cd98753e1ef69611e6d411e8759905330238c68fb7e058f9ae84679a0fca97c45e755b121b80bf8d74d4d76e1a9495b345234bbcfa7419f4e60e46a
SSDEEP 12288:RyoKo2JRple9pNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:RyocDApNfJ4yL/tNCJPXUQrPC
TLSH
T1CDF4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d6adf3bb83c7447add7933db2c0f89087f401e68e00cfc87411f4ea852dc1f8a
MD5 b0245883cf07c0b6c04291b62a8d14e3
SHA1 8a6b0c995acaa48ffd4bd82d61a7521657a6cd6d
SHA512 ff3838588a792407359a9c8e6c25b08956cffeb6ff7602b87a9fdce99705fd43ab0baef203f29c5b757d435bb5964257e8b5ad03f7dcbd5dc3bedf48af09654d
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNfJ4klKXni:E0zuNIXfJ4k
TLSH
T110A57B3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1e569ef24deb20afddbfa5c95b5e6702c06f84d042d259cb025a23f111ea50e0
MD5 8da0674ec77aa5e21c115d0f3b353398
SHA1 18596a3c251c881c11a246c87940d99dc80c8904
SHA512 523f2b626083bfc167f28b983a3d3a8115b723dc802a9ba4bfc8cc9ef5ba7a0f3fac68b022858d59f36fbbbc5f3296852900c0e719c4e6ae4415b5767185b124
SSDEEP 24576:81QT7EcpfxR+N5AWAz3ooiYzjMqbefJ4yL/tNCJPXUQrPg:hTDxR+N5YzTBjMTfJ4klKXnY
TLSH
T13255B02EA7F855E9D17E85789A23C502FB727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 c5b44acfd2f0e725e5b29f98c3e88de98dfcf1edbb2f19bde6d09224cff3687f
MD5 5da0db82bafa9a2793468ea79658e97b
SHA1 2e06f2bd734c223cd1163002f54d911aa1f162e8
SHA512 80d2f57a3ec27a98bd904c18191e4166824954acbd420cf1fb339824b39f0e7e94122b538de9067143c2d09ff90198b9a897e6972ebcab193dddeec1b33785b0
SSDEEP 24576:DTMdOz0FFS+UmSLqfJ4yL/tNCJPXUQrPU:h0K+UmSLqfJ4klKXn8
TLSH
T11715E17E63AD14E5E57BC27C9642D906E67238A6032266DB06D0C0793F9BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 375eb665bb042aa55e0f8a82466a9276e3a1bf1e5002d0d75f0c9bf2e4b5ffd5
MD5 cbbd0787a10972538bee1e7c0cf49759
SHA1 53f0eb3a6ffd89feef98e5f174d3b3a0e676c232
SHA512 33229e15a8229f27d9c31931d1da246fbc3b4ba9036adc2e275b65306a4ad1227feb6ad4bdd13388170bf1f4a1a30603e59ac9e3d32386132485593cfb849965
SSDEEP 12288:g4KXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:2XfJ4yL/tNCJPXUQrPW
TLSH
T16ED4125E23D870D5E87293B84B54D101C330BCA6272A62FF39C1D87A6FBAAD5593C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-367-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-379-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-386-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-387-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-385-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-388-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-389-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-390-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-391-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-382-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-384-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-393-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-380-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-381-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-377-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-376-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-383-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-392-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-364-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-378-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-366-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-357-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-358-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-359-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-360-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-361-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-362-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-363-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-365-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-368-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-369-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-371-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-372-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/456-370-0x000001A8BD700000-0x000001A8BD710000-memory.dmp

Download

memory/852-305-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1128-300-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1128-115-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1128-121-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1712-307-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2104-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2208-298-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2208-411-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2296-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2296-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2296-293-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2744-302-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3336-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3336-62-0x00000000006F0000-0x0000000000E2F000-memory.dmp

Download

memory/3336-64-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3752-139-0x00000000005C0000-0x0000000000CFF000-memory.dmp

Download

memory/3752-140-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3848-299-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4032-69-0x00000000016F0000-0x0000000001E2F000-memory.dmp

Download

memory/4032-53-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4032-65-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4032-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4032-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4032-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4032-70-0x0000000000D40000-0x0000000000D48000-memory.dmp

Download

memory/4132-304-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4228-104-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/4228-296-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4228-99-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/4328-374-0x0000000002610000-0x0000000002D4F000-memory.dmp

Download

memory/4328-329-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4328-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4328-373-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Download

memory/4328-8-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4328-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4360-126-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4360-132-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4360-301-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4404-355-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4404-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4792-18-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4792-375-0x0000000000490000-0x0000000000498000-memory.dmp

Download

memory/4792-356-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4792-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4792-17-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4928-297-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5036-294-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5036-76-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/5036-82-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/5252-353-0x000000000D0E0000-0x000000000D0E8000-memory.dmp

Download

memory/5252-238-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5252-468-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5252-222-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5252-306-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5252-308-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5260-309-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5356-295-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5356-92-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5356-86-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/6100-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6100-63-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6100-33-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6100-433-0x0000000140000000-0x00000001402E9000-memory.dmp

Download