4ccc30fa30a034ad1203f392c58f9344b92966ae6a5523be417e33d9f54295b9

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample260519-trfyyahs71
SHA256 4ccc30fa30a034ad1203f392c58f9344b92966ae6a5523be417e33d9f54295b9
MD5 bdfcd8a55166c1df5492d25e0b54e82e
SHA1 982b60205d882ef389b5052818f3d997e539e3b6
SHA512 8e4ce405dc8d61e769567eaa1055b9a6477cc8377fb775e0ab5368712e2f2297be1768c8f9b195cf2376c15aeb5ef3a9eb47a7a97808c219daa92f446eaa1b35
SSDEEP 24576:ebdmZPzOFfoDAwP+L6VMRCPU6CENltmVVdpx7fLrQWd:wdmZifoM6ZU6CENlc7dpJLrQWd
TLSH
T17075BF10165F1CABDC93F13D8A618E4BD5F27C510B22C6AB76A12D1A7FB728269353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2484	alg.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
5056	fxssvc.exe
1308	elevation_service.exe
2020	elevation_service.exe
4896	maintenanceservice.exe
1848	msdtc.exe
3652	OSE.EXE
1976	PerceptionSimulationService.exe
4472	perfhost.exe
1948	locator.exe
5272	SensorDataService.exe
5248	snmptrap.exe
5416	spectrum.exe
5540	ssh-agent.exe
3188	TieringEngineService.exe
6120	AgentService.exe
2564	vds.exe
6084	vssvc.exe
2240	wbengine.exe
3028	WmiApSrv.exe
5772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f0656886f6d6c89d.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\javaw.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dd20f19c5e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069b97819c5e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d768c719c5e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef341219c5e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd98f518c5e8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e1cb921c5e8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
3496	DiagnosticsHub.StandardCollector.Service.exe
3496	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	5056	fxssvc.exe
Token: SeRestorePrivilege	3188	TieringEngineService.exe
Token: SeManageVolumePrivilege	3188	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	6120	AgentService.exe
Token: SeBackupPrivilege	6084	vssvc.exe
Token: SeRestorePrivilege	6084	vssvc.exe
Token: SeAuditPrivilege	6084	vssvc.exe
Token: SeBackupPrivilege	2240	wbengine.exe
Token: SeRestorePrivilege	2240	wbengine.exe
Token: SeSecurityPrivilege	2240	wbengine.exe
Token: 33	5772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5772	SearchIndexer.exe
Token: SeDebugPrivilege	4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4860	2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2484	alg.exe
Token: SeDebugPrivilege	2484	alg.exe
Token: SeDebugPrivilege	2484	alg.exe
Token: SeDebugPrivilege	3496	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 4852	5772	SearchIndexer.exe	107
PID 5772 wrote to memory of 2160	5772	SearchIndexer.exe	108
PID 5772 wrote to memory of 4416	5772	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_bdfcd8a55166c1df5492d25e0b54e82e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3760

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4896

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3652

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4472

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5272

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5248

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5552

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4852
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1652 3036 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2160
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1836 1848 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9dd2812442c0a41b540a0a08c30d817b3b5afce6f89df6ea58612b3424c96d6d
MD5 da4989e4fa2878ffdba415121662de39
SHA1 3d7f13c6f58099a467c5441eafe59a96adddeabe
SHA512 c5b59af9086761dc554de47be0bd54113c818575e4396733ac1425cc8e4a5f2446fa74fadc4d5dbd23f280ec60e2f684fbc50f13920aa05187100dfa72629a78
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnj6ZU6CENlc7dpJLrQWd:t3q6HjBg69CEN6rV
TLSH
T1F7D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ec3adb60e9e807ca6f81fb27a0167701f517d7b7aab631b615457d3a035fc60d
MD5 5071d1b940d0815f852a6927084eb2b8
SHA1 96510d58e0fa9c81938a5e74982d728644e62dd5
SHA512 3a3c9408a5fb3b337d3b53fc4b8ec0b24150ccb74cb39e6814f218ce9777866163b0448746ef7e971ac0b98f40825e15d8e003f4620efceb89d8446322c161f4
SSDEEP 24576:FXYfDtczAv+L6VMRCPU6CENltmVVdpx7fLrQWd:Qtc96ZU6CENlc7dpJLrQWd
TLSH
T11A65F12867E408F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 422e2fefb94fb57ef9ae7be486b226171e835eab23fe60bb16af4a47ab4e0799
MD5 b57bc0959e5f7484d683d7fcc026460a
SHA1 4859f7a8a95e788476123ee5dcd4977ef3e813dc
SHA512 b43cfdb0db6fd01cfd2df0cba5b8913594042ce8f6c26d3f847a2432c50a58d77875e1699ae5f1a84e3718b46e28cca461a7f002bac478669ede01704d7f01bc
SSDEEP 24576:40Le5ji0hmxirM0+L6VMRCPU6CENltmVVdpx7fLrQWd:4Pji0Ac66ZU6CENlc7dpJLrQWd
TLSH
T1E285AE26F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4bdb02af49f3dffc453753b670bb43cac3c8fa5a631b37f3f64550598453748c
MD5 68a970f3d9959732805404f694573d84
SHA1 24f352a5ee070106f27ff52c7ea3fce6ee0e25e7
SHA512 cb9eb3413793a988e1aa6e4b19bf2546eb201914a7d65bd653ce4f53b0432586b36067f89498d3983ff0d512ca9ce0be060e7986d6ecb5e6df6fa99572b0fdf0
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuO+L6VMRCPU6CENltmVVdpx7fLrQWd:y/ezSC6vUzPvxHjye6ZU6CENlc7dpJLL
TLSH
T1ED755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eb5d55186fa0deb354cd99fa69fdba199ed9714ded03f7d9cca94d97c82b5171
MD5 2407ea7bae46bbcc59ec9eccc16c0272
SHA1 4c40b60313e49e4ce805af7d43e7b8c8c1e2988e
SHA512 60465d59917fb060d1d954061ef56f67d4d136de55e53d97fdffb5c4778723fbd4b92943d643873e3917b095c2a992b3b471cdd0d92b8061e2037260c5d483d8
SSDEEP 24576:pVbqPb88hv/l+6T+L6VMRCPU6CENltmVVdpx7fLrQWd:pVO88hXl+f6ZU6CENlc7dpJLrQWd
TLSH
T16D55AE66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ac3501bde2686434843cc521bf91cc4bc52edbad481fa4f85878430dee3c2368
MD5 7ad84d806f754bf4e3b61e5f21d7e8fa
SHA1 4d79f6b006c9ff0ec392c53ede2c3fe417f406cc
SHA512 a915eba309792eb7eba5291b1ef39426f7f4fade8d6bab0a65080fdc457d119481838896e0269088fb7533a0594fcc5196069de0832261760656929be5c5d543
SSDEEP 12288:sRb8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:sRI+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10145233187642D62DBF40238E1E691B5AD2AACD55B405E1FE2767C0F0D3C8B89C5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9564c6768d552c7ea8a6cb94e39f13ecb379df587ca6aba96da3c7c1d7f3968f
MD5 af169e5efeeb69e8d117ee9968d34980
SHA1 f55ebf0d70b7fa08b2148baa782f6d39c7396995
SHA512 3b74844dfb9aa933b8ecd04ef1f582ae98d5b7a291f7ec5d672a2b5fb6413f558b1f0870b2ef60bff18825f222e3955d1d18ae8960ef46e18b1dd53e67e03990
SSDEEP 24576:TJIUL+L6VMRCPU6CENltmVVdpx7fLrQWd:TJIUY6ZU6CENlc7dpJLrQWd
TLSH
T10365CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e63c4ae612f741563c8beac6bdb4f369cacc568bf3cfbe786c3ad67dd8516156
MD5 a673eb97a2866f2e06e148b246b3b954
SHA1 b7f29082ec367fd5dd7994cc51fc7831e4e073b7
SHA512 bb24c7ef6e993fe5f8a1cce71b7fbb5d53fa172cff0f8bf269b660023b789e78f75c911ff64541110a899a8e59452e7290174fe5822cc321c0447bfb8afea1c0
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:uQvGAdlCEL8c/yRNw5Cd69CEN6rV
TLSH
T1B5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d22c0cdd5b851bb99889615a4310e8c1a6cf9fbb44ec0fc3d5e535629cffcf9f
MD5 bfdf8d533cc6f8b19174adac8bc6c946
SHA1 1caa3bb9a410719f81cd3a568a7602f935848522
SHA512 40c897d4e0c9ee5e94eb6901510bbbb0e3de95d168831026cc29a25cbb8170b18b7cf60fb2988bc7398730e71a14eb5798a41ee53dfe3f687cf6233f8e4979f6
SSDEEP 24576:idewsAj9+L6VMRCPU6CENltmVVdpx7fLrQWd:CljK6ZU6CENlc7dpJLrQWd
TLSH
T12475E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89D9E49342D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6f68cd9d7581651538f96ed3956c796760d63b658fc9ff10282f71e2d64d773a
MD5 e2113a9c22d5663a8a5e3889dfb3c534
SHA1 d364db8504d859566c33357d2a570e3ef814b1fe
SHA512 e39c1ff38d7260227a42d20720da44e1c731064c8c9cf87a6af98bc96f3a3a2f27a1c850fa6862bc5413643ff626a565dc487c10c98cf2ffd3db07a658e007d3
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCIm:XUEtQevvqc2W1cpV2EI32x
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8e3949e905f1a3671c1d79cdc177bc954ebdf2c3b73b8355ef4672f5f0f85fb8
MD5 4ae0aac73cbec62b6d0b2f8ef9938163
SHA1 c452292cdadf4a060a62ef3821e8fd145bdbd28a
SHA512 c5383f98d30d87ad528eba6faf110d87c6a6186c1b491ae8e04321206974d1228f729281b941258980005991fbcab1b5e73a25211fca5165ee7003c0400cff60
SSDEEP 49152:fCbRquA/m2yL5zifFiV+XenmE3/zq6ZU6CENlc7dpJLrQWd:4oqHVjnmB69CEN6rV
TLSH
T160D58E1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 868006891005b101be8215fa4985aaf6d3c18ab99c6db656504f57139f55f93f
MD5 ce81616d69d4ee7dd539374bdb33c985
SHA1 b66a0e6a3d097c52965b0ee43caa295bc8bafb1f
SHA512 7d76f5ee68cdb52774ea06f4cf3a05da2487e5fe6e6a01b97abfe7c959f6c3c2e709648ac2f23625121981fa5fbbd13c67b1d071b7b8ca6a5a8323802c5e3987
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53a+L6VMRCPU6CENltmVVdpx7fLrQWd:ZAMyFoiq5R6ZU6CENlc7dpJLrQWd
TLSH
T180359D80E7F955D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 312c38c49fc28272867a511e3d4fb5cdbb2a0f4a1baff1c8e33c153f521ef8bd
MD5 d1540ca35807925130ba0ef8af5c8cfc
SHA1 93cba7ed9fad85838bd04ed40785ba3e9bf3407b
SHA512 bb88d8d52228051e8b8f160c5510293d01d61ebeff83c9fbf350b78d571d06a88df657a02ccffdf168bbe943a60f2f4b3c956a4d64fcf23ef9189887f3ea012c
SSDEEP 24576:BwuoOWZ+L6VMRCPU6CENltmVVdpx7fLrQWd:BwDOV6ZU6CENlc7dpJLrQWd
TLSH
T1F465F15567A41CF9EAA64238C597C136F7F2BC422A21DB1F5370C61B5F37260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ad189f2a38006a3afbbce26d2bce7b49a2c0549cd7c71de2c5b615aaac118d90
MD5 98841a6b00e81d04bf21283d87c49fb9
SHA1 aa6abfe73d8bf3ef63574e8560f0bed350c38727
SHA512 2141cdd7bc9aec9318cca0214825aa594aab228f1904d028a0c5b6fd39c14a9edd28a91e74f8f9b208ae767c34f91b2165a2bbf2884dafcc1e96cefdb462b256
SSDEEP 24576:sZus+L6VMRCPU6CENltmVVdpx7fLrQWd:p6ZU6CENlc7dpJLrQWd
TLSH
T13A55122A23E434F2D2E2023CD9E29655EB72BC96273147CF5235565E0F37AE45C3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7ad7f5a7d295901c0deb4ffb0c35b79bb2582c2359560617f1cd8d3ac0ee1fa8
MD5 fd36c6f9e2b31616ca36546ff546bcfc
SHA1 b15426629cdcb92500ccaea865f1f77f910770f8
SHA512 e369c71670c866bd0360c46c71424dae7b5557d3000f4657628576323e37168c460355b8112887e1be7f5042aa9631fc38330467aa4c7e67ddcfbc5ae74a4931
SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN3869CEN6rV:KQyiKayX+PNsIm
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ec412b2cfe2d3e7179eb1f325a73c2b3bc1136746d0ad895d6fa64a7cf8d1ce
MD5 2fb4368171007e8991f3b77d97937baa
SHA1 963268d329e121dfa88ed548f78c1f1bb0a048ea
SHA512 83907e9dc9240158ac806b7663c47c38de382a99f7a16fcde25c237d5edd4d015cf14e8048ff0198f07a1c4ef362e9f225d4e923323631f3784dfde92a2cf662
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3869CEN6rV:LQyiKayX+PNsIm
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 491235fcdc70a5ed2d5f1de189a9ea5917b7c7ab9d7c9bf0511f8c02da090472
MD5 faf61f4dfa1ff91265f6a001ac5f1351
SHA1 bc6e000486c5b78754cb599d24ed277898a88a52
SHA512 d3284cd943bf15ad02a960cfb1fefb0e73046794b16aacb02903bf083d1d8faf446abaef1e8c4d583bd3bf1941b99454adf4119891d4896db811b29ce2b03e3a
SSDEEP 49152:p68Qg55nhheWu7PNU3/66ZU6CENlc7dpJLrQWd:3thWRc/669CEN6rV
TLSH
T111B54933B2F600A9C44DE1769F46872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 314cd8aca8c76787f4de577f4c39f96e736e20ac5090de5a2948539c02aefb1c
MD5 8c4688c52b949c1af45dfc9924880c56
SHA1 cf82ad20ab10909979381d117e4eca543aa82217
SHA512 69170c9a7b5d3ea58b07ed33f8bfb29f2eced649dec4e5ed21699643b29c837eff670ab6df90073e5f34cfaa37adbb0123bd18cf9e0b047c90248b1cf10aa698
SSDEEP 98304:3y5112gYy5azzVvL69nLKnhZ369CEN6rV:KLIHmWhZIm
TLSH
T119167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1e3282d167e194dd4d107002f3fe1d6df382141d81c3663687fff1532f9379f4
MD5 9e7dcacbf8063d4adde06649df3df2a5
SHA1 a5d67e048af3979d5e17e386db75427f21752976
SHA512 549dc7ed8b4716262a2498e0beb8546c4cab5dec6c3aa3c76021f2452b7ae25b162a4ad775fc46ffc2f6698395d1dab14ba5e72f69d954b2a50590cfcbf13595
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glk6ZU6CENlc7dpJLrQWd:Uu6JmVxd2dk69CEN6rV
TLSH
T175D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 724d1c598cc830b9a4244e05729da52c57e2bd4e41157f36b14bd88e6f59aef4
MD5 7a2267008746b5951f77e192bfb27332
SHA1 387d9cda6434e2eb240ade3a42b15b6f98fb854d
SHA512 7196f7806380e322043015171bb8a6d6c3a63c09b5cb29e3f75e2042ad54a15bc8be225c7395c1330d314ed0ce05c1218047f418c7545fadfebbc7d85a592690
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4x46ZU6CENlc7dpJLrQWd:dmifPbRB69CEN6rV
TLSH
T1B0B5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 14756f608cc96df2ccd999156b8e259f97cf7786f4977baf995b290a82220fd5
MD5 4657a4cf2c8788c4aa9a4f5e22e430be
SHA1 7087c7ac241c1fc125a54f46b9f82336992d9c71
SHA512 9c77972ce9b89990b6df10afea47b469cc64ada78be2568c2d8a472994e08aa49f6eb4f0cf5e296c7d698c1ed3cc14ecba03b6885d3211788408cf4b00ca1f5b
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqz6ZU6CENlc7dpJLrQWd:g5dKTi61z69CEN6rV
TLSH
T1F7C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 435bb2452d1cae523b9b9ba82e191cd8b0fc0d3c60473a0dc1bd64d28c6dcaf8
MD5 144198adc1688f06f74f499bf34d35bf
SHA1 84946e2460049431af7f572f655bdcb9b304126b
SHA512 f6ea497895131f28eb677b88cb554b51e51daa614c9120d5268c572e67cc0412d8d46c927ff2e33aa964f0e433a6351d85fca294238c9ef845f2205e1997ccd1
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5w06ZU6CENlc7dpJLrQWd:ZX2iyph169CEN6rV
TLSH
T10195BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b461615794dbecabeb5e7928b8f2bb7fb0a65537dec0865ba736dc37cad9f2d3
MD5 b7bc74d0dd08e6d98a86a948303e55ee
SHA1 7a86303b5cc9eb7842e63fd379cb428408eca625
SHA512 3696f7a382298fe6d4b65c71358bf7902951d9210c9a3ea9d562f0f306c491df8b6455cfb17186bfaa3e4d761eaf00e7b838dec301eeb79f9bbad470c262ef04
SSDEEP 12288:Pz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:PA+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B4452335876A1D63D7E00278D1A291F5A95AADDB7B001D1FB37B780F0E398B81C5B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 25c2d6a5a429a2335f2a49d15d9527fa15d4263a1d3f36d9c5dcf28bc266a709
MD5 1c8b30b8aaf7f7f9ba3dd894c22e9232
SHA1 4fbd40214aa12b21ddb224b12ffadbac6b28ef34
SHA512 4574e652acdfec15a051475cd864bc2ae864ca1fc7cab62985bf21cd34b53ec6f8b78da2773b3ad7a56045817e85e00b33586b92385ea2fb98e94ed3a02cc950
SSDEEP 12288:Na8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:NB+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A6452335876A1D63D7E00278D1A291F5A95AADDB7B005D1FB37B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bf9dea722af75d5736acefc54359766bf5a15e1e19182b8f2f12fa839991aa8b
MD5 6847e253f42b0ac8847f738d79e0ff62
SHA1 87e40398bc2853c5092e702f601b6bbf6bf2bff0
SHA512 c9dff36b61fb1ef930057af6b68e6c50dd18b0abf90b630b78144adf536db0a60d14c07b11cdc4e8cd28d738d826702f79d2ec478d4b56bc2dc117eb56d37e91
SSDEEP 12288:bA8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:bD+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A34523358B6A1D53D7E00278D1A291F5A95AADDB7B005D1FF37B780E0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 566e27d17af44e54b550efcf0feb60dbf1a3626191ebf01a57163e76ee2ea0e8
MD5 525c44e756cc122985aae34f6e731d76
SHA1 6bd10f6d66e2f3d21abf59f782be1871b1193977
SHA512 0cf1a208dacc78db0e75c14edfa3a5d956b0de2bf54c99a2d86db35e4d622dcf2c6b3198ea4d5c0b740982c94150cb16576dc92056d0eb833cb87a757350723d
SSDEEP 12288:+Vp8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:N+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14A45233547B919D2DBF04278C5A291B1EA76BCD6AB105F5FA3222C0F0E356B45C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7971f71e45ae80fe1b847fcca2db4ccacbf6d84c8ef7ea20e40ff8506286cc0e
MD5 7542870986c7600249ed68e965e3d6fa
SHA1 ab27433ccd33910b1a40cbc927af047caf9ab8d3
SHA512 05eb057452f1615e20dc66577f92c9036376d4a701f45203d1477dc0594a1c2a8355a53eb3f5afaf272930ba47d38ef50875f2d72129f1051e428c46685c7517
SSDEEP 12288:eR8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:eC+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1254523358B6A1D52D7E00278D1A291F5A95AADDB7B005D1FF37B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a9278d02c5085f931a3a4550e20b569c181b644a4ef2768ffb67f80fbc4674ec
MD5 8304bb6552541491137b312c7e9b01aa
SHA1 978e6e226e66de92ac711fe01a3f378030084ab7
SHA512 bdc894ab5528c09ebd254611b49418dc7568628831d99b06749e78dda138489687436b927bde5ad6cba49620c053edb29376e9dc819db122e28f1ade6479e9a4
SSDEEP 12288:yG8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:y1+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B1452335876A1D63D7E00278D1A291F5A95AADDB7B005D1FB37B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8b9041fb124b19e73914aa524440ac2f7dccff97c5649256684d4280fe290f15
MD5 f6b1f76452a70181771f078ef2cc8a24
SHA1 0aa8573fe4b501ec5bae1973bd2b5a95ecbda7fa
SHA512 02b188c151865cd3f159cd7ac41406025822885aff5b970230438bca769f12a2424af158055e40c94c1406d772c359f304880f0cabe20fb7330b8e5cd3a537f6
SSDEEP 12288:ZC8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:ZJ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D64523358B661D53D7E00278D19291F4A95AADDB6B405D1FB37BB80E0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a6b3c83c7956e03bb9efddd2229d9c8a3952fb20091411bbd6506232257369ee
MD5 e0f5b25c274a77fdbe1fb6e30305d7b5
SHA1 3b07fd10519278b7bcbea38d67d2e48ad01cf6b8
SHA512 94c552a2e270be76637d4528da8a02b74d8fc9251740e31a1767c0f246f773eb1b62951094717968ed8f8a17f0dc5a736bce7d3fa08d5c3c3ce84c4689e2b1b6
SSDEEP 24576:oZMSzFVSOh+L6VMRCPU6CENltmVVdpx7fLrQWd:oZMSzfi6ZU6CENlc7dpJLrQWd
TLSH
T147650265B3A01CF5EDA7423DC9658956D6B27C5A1B60CA1F13B4362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f003517eb60f96672dfe3f212d37177c5173ca679ec9f60baf79c08cb4f92d03
MD5 a6b6425c5e53bc282915fda273356741
SHA1 ab04b87438fa1c3e6cf9794212547f134a590eb6
SHA512 d7f77536b60cfb1a5de0604f07025b51d507cd13b0a2d3409aaf2e915dfbeaf01baf0af1ca8c66ec799285a490dbe596168bb91ec9d7940d640f617b5ab4684b
SSDEEP 12288:Zn8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:Z8+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1994523358B6A1D62D7E00278D1A291F5AD59ADDB7B405D1FE37B780E0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 095a9e8700523c96f72f7c0d125bbdf74b7733f730bb27f6eaa8665cedc0f1dc
MD5 303ac785ab73f0b7716407d307408c8e
SHA1 48a2e7e1125d91656fa21c2e0567597e6d52be64
SHA512 2e79da2fa81ff5b92caaf6771dcdb6efbe57b9546ac3dc41d7442382f35c9c0d26e1c7cf2652ef872b95cfa08547d90b31b8a3e9c3668b3eea9a2b98ee19a65d
SSDEEP 12288:KL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:KY+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17D4523358B661D62D7E00278D1A291F5AD59ADDB7B005E1FA37B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 82af1584f1522d65a2470501d4320adc91534dcad02299cb15cb26851adb02bf
MD5 05aebdb6b27c93e96e52135e7fcbd8ae
SHA1 b94aac0957bb07346706132d21dc6c1c4dda1566
SHA512 635e04e0dc446b5e77594394c2181d5c92ed6db1865f5058f6fab07c9404c6721184844cc24e751e1199ae40d7c6d6d5a01246ba22524ea45a51fb34c5162122
SSDEEP 24576:5zyN+L6VMRCPU6CENltmVVdpx7fLrQWd:516ZU6CENlc7dpJLrQWd
TLSH
T1C855021763A530F5D2764238C8A21A52F776BC761B208EAF5364563A1F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6a1ae6940fca0802ec20168515429e9ac4fddd9554fca7463861e3abfe5628e8
MD5 73416649d9e9b7b0c51d6720d31fd2fb
SHA1 ae07e7f5112de67964ff7048b93f4b849a9ff0aa
SHA512 a2ffa4fe4ba7e17c40f3bb34536c08466f4da45f4259821b59bef07a5016b0cb9ba69e45bb8aeb9dd7c9dc87344078bb73244b2bec133ea3c821588b5e7d9b37
SSDEEP 12288:/n8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:/8+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D8452335876A2D62D7E00278D1A291F5AD59ADDB7B405D1FE37B780E0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e58317c08e3056bcbdbc888b44c46ed9b561f403ad6a367be69154548cec18a5
MD5 5fc936293e1415e12586ab5e82a0a695
SHA1 e68ada938d3f283c05e76b0f6ea259d76dfdb2db
SHA512 1c1cef4ebdbffd8ba398f733ce788d20ecbf067511e16fe0dd683416112707c2b2d6803740088027887b18cf31be1e205e8571f537d187b39718df1877964f7b
SSDEEP 12288:pn8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:p8+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17E452335876A1D62D7E00278D1A291F5AD59ADDB7B405D1FE37B780E0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 45b91c1dc4bec0f79cc280ba1125fa908ce4fc87a99f311e562721ef5dc85be2
MD5 8244cb9c7abb454a57b7707b046ae85b
SHA1 b3437b9a37c485d2ccc3155f4bc86d20a9ec5362
SHA512 90fcf727a3cb6c5d85cae24cf0fcd8f30b7246526e148c68edce9b6f6fba400c59093707fe9b15b70838c09c8e5a3ebbf393ea8e6b39b2d8ab29b119e5047a72
SSDEEP 24576:7CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA3+L6VMRCPU6CENltmVVdpx7/:7CUxPTY+8Wg2lIL8lrIUJLWw56ZU6CE
TLSH
T18D65AE1DA3EC0896D4BB81358A518A16EB72782E1B21D6CF2170C73D2F27EE55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 036b1608372894f646f31b5afd9ffa4b86a7cad38e1425114e6009bfecd52bf6
MD5 7076c3568a1452febab982923400bb49
SHA1 d2e2578594407013c98e2c6f15192e35f5d91a31
SHA512 825dedba713f08bd44dcf37475bdfc38d7173f2c16dfd0413ad7e4af5da6d7d41dc25eb96b04a734c6e359e4ffebce47f9cd171e5255ff6d880af75149704c39
SSDEEP 12288:dNsf38+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:ys+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T15255F019C39812E5C1AE2278C7528651B7337CA597E197CB63D0F83E0F3A6A05DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 82559f5782f9337640d1245854830511ec18e5aec07ada5dbbafefbf6cd63acf
MD5 916ca7e2c51d030dea96b876ed67285e
SHA1 48a5a846af703ea8df3ca6325d98cbe8e796e0d7
SHA512 6a7b3a86e05c4df432a213d7d9404b9ff2ecce50b8b1e154e90c4bedd586926f2b1637cdfe0d1f5a6d236c0895c6814f2003f45a479abeba861dc88fd358d099
SSDEEP 12288:og8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:oj+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1ED45223187A92D52E7F4127890A6D170692EBDE96F0099CFF226790E0E398F45C3B71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e035b2cc3e857ccf4edc08987562d65dd67beda88e9c5685a78bc275ff0857e9
MD5 947abcba1b8621a8d0f305b5909eba52
SHA1 2c78b9b3b5a159f7ec837a8fa42aa0c94945c922
SHA512 76247670ab24a095d87d0efb93908d8afdf00c4187afbde8bbc59c20c5f0141c01f7725a7231a6cc4df356d70727eb2ac25206601af7ba206504d84650143f18
SSDEEP 49152:PRZwQCyiHiQEaiPnML6ZU6CENlc7dpJLrQWd:59xPPG69CEN6rV
TLSH
T13085AF1E63DC06A5E0BAD278CDA74407E6B27816573197CF0291C27D1E27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c36e012695bbed47ba068bcf707d91b408ddd9e01d6e99dcf9379ea632eb6a52
MD5 80da5734d010165fc2315bdb9090386d
SHA1 8ddd0f3079387d46b257176052770980af429085
SHA512 38fbca0198ec87561fad6cb34aed95564937451809680f2ea522f3ad26a4130727379795fc18efadeb5b0cbed154351a7379770171480d4e30c1a7b6531120f1
SSDEEP 24576:/bxA1UGz+L6VMRCPU6CENltmVVdpx7fLrQWd:/bxA1Uf6ZU6CENlc7dpJLrQWd
TLSH
T1CD55023E57AC28E1E2B5913C89D28105D732BC56272097DF61A5923E0F3BEF85C3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 53fc78ed8ef4bd74bcb5422041122c003c74cc65523ae15e8f7794d82e710e28
MD5 297c6a40cdb5c32faee77c97c808e15a
SHA1 77aa89fea2a084fcc30e00826cc72b0223d7c104
SHA512 de6fd5e8ab1c3bf9144c3da121089dd298170cd62cdc2d507d482193d32bbd55d4af85963889bd4013d0cbc124dea82dccda88cd490aff2185d6b957f8633212
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrnK+L6VMRCPU6CENltmVVdpx7fLrQWd:hjRP0yHfVqzlAsrnR6ZU6CENlc7dpJLL
TLSH
T17445AF2EF2B910B9D4AAD136454107B5FB71B82D1F209ACB0170C635AF0AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 2a214823a7f0323289e4a285991595e302820d4b3a991eb65467f8c07470a3c6
MD5 26d0403d945b69212403255320925524
SHA1 5cd92d0491af12da46001f230a20684f20437c35
SHA512 b1fc617c1f129bc1f9a35e27416c7bb59ba780635cc10b030664d54c8de9b0211565ce992cd575510d8c0bbced8a2cce935ae5465ae3d376e8eacb0a7a9392e5
SSDEEP 12288:am8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:aV+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D345233487692D92DBF40278D1A291B5A919BDD66B005EDFB277781F0E398F81C3B21C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 c20a446e69406e9a2e91b5298451b7f8787393c11f2174621a2e63f12ad44bc8
MD5 9e404f97002526d93037604722f7643b
SHA1 26d6c4c79d209017372b6b2e64788cd80a435d84
SHA512 2eb458a1843265b649492fb6e06f700176402fe1105ad1aafb66d29e23170dc77c9a9d22280ef284b8cf966d533b42d920b620ee8cf653853b51a76b3d2eb9f3
SSDEEP 24576:cpLBUTv+L6VMRCPU6CENltmVVdpx7fLrQWd:cpLBUY6ZU6CENlc7dpJLrQWd
TLSH
T103750215E7A404F5E977913CC9A28626E672B89D0760EBDF03A94A5A0F237F14E3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2b84f40e44eff52949586f0ffde34d383d5e4b8929f15908871db3cd46283edb
MD5 57dd9db642dd47d1b6626e451d7d4480
SHA1 9ff636fe1625d3c16f77145d2670e966d4696b40
SHA512 7fd8ae653f82444fe9642682bfeeae91c810a5bf081533e6afee3c592b6d8852d2d871f71bb02cb7fba956e6546f676220b54e61b0b623d3dd702d11c0d71b8f
SSDEEP 24576:qrYNHW+L6VMRCPU6CENltmVVdpx7fLrQWd:qrYtF6ZU6CENlc7dpJLrQWd
TLSH
T19865E12E52AD1CE5D67B917DCAC38259F67278A6171196CF01B0827E0E27EE87C3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cfcd3b0b03757d2356216848a18d1e98af64fb172f3034119b7ea6a5d9c71661
MD5 aed9aaa7c559f2e3232219625dec4231
SHA1 859b3bc78d277b9a7fb59e5799b6e6034aa2d7bc
SHA512 b256a4d10d3a83a591d28a7ac8106fdbf1fbe6d5a2756b4d153580ffc51a829d2955fadd3e4a247e5ddb3fbd49e5caffa8eda181657f3d74270689b86940704c
SSDEEP 24576:cnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK4:cnXoJJYH84VVS6AmEcJas+cHBjSSKHPI
TLSH
T12765BF6DA2BC04E8D5BBD17DC5C24506F5B278621331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 63231a14d981b83521972ad88141e72b4d282fc6e6b8c63fee4437d26a292f70
MD5 0ae2aa30a9842629440adb45cb692f73
SHA1 7401e883831c5afb783fa372f0e66642a37e65db
SHA512 e781a656a08a04be3365c3a8fe592c7afc2cff1517ecfc62977e5447f68b66bc17ec4bcbfe9de8f6d0cc8a98f7fe119d189d81953f0679c1ba92ee8e0ef6294c
SSDEEP 49152:VDLL9TuJ0M/TYj2PS6ZU6CENlc7dpJLrQWd:mG69CEN6rV
TLSH
T1CB858C1EA3EC42D4E0BBD6BD85A79146FAB2B895173081CF1251856E0F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7dc5c8c880e0ba69e0d1c2303cf22d3af88adae479362cf94bd678476feba2c6
MD5 f000c8670240f31e2cb90f44fc0197b9
SHA1 45a1bc6a00bb1a364fad9428b03c8f7c95bcaf36
SHA512 6ceec88708f95c7930fc4ff0f2d07c96e387e97a448a50a291021928f8645c65df71db03d860056c9a77b97f762a943ce4fe084bed293704f9556df7a5cc5860
SSDEEP 24576:LegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wv+L6VMRCPU6CENltmVVdpx7fLrQWd:LngOJOmPOHh06ZU6CENlc7dpJLrQWd
TLSH
T18D55BF3FA7BC15D5D07EC17D8A928916F6B1782613255ACF0160827E5F2BEF42E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f9b972353cffdf3cb5fc153b45f33de6ac576f1da37adc050ff298a0b44b0933
MD5 3ca39592d50ea26443aca2f05ab41200
SHA1 c2e229fcbe97c41335f6578d5ff626ee861bd47b
SHA512 e178b5b8f8f86790a0dd79da2c9a89d74b2dd78df64b92dff4b4a6274c78610a95aa29cff1802de3a95843b1336da2048614ee6c424223b9c86ec976cc4e0a4c
SSDEEP 24576:yLJnJiTk3R3waE4JrO1+L6VMRCPU6CENltmVVdpx7fLrQWd:yLJnJK8R304lB6ZU6CENlc7dpJLrQWd
TLSH
T1CA75D03CC2A810E8D4B7C2B4815A5796FF31386D2B2169CB69B4D5353F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 866014def03a6e326513f7600a2fb6125f60672efb002fc977fc761e933c05f3
MD5 4d34642d1ed7d32385ac83299139d6f0
SHA1 0358c55b5e322dc87e4df3e010bbe157f0d2a16c
SHA512 9dc447ef63539c0173667bf2edb5420846044888d34327c16b22bc28f5042f013a60f7e50c5808a33b3dbea93b8982d209d6251aed36e2519090541b43fbc51c
SSDEEP 49152:l9mqCzDScAZmlvTcFg8Ph6u6ZU6CENlc7dpJLrQWd:Jl69CEN6rV
TLSH
T13C955C15F7EB5294E8B3CAF1C96294159B327C409B34F7EF0A80C96A1E32BD1D939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 a68543ff5a1464c249c0bc291582a4bc1ff262903da03fcc1866050ef7b198db
MD5 8a901e489168c4c8ed2c002e0eb39585
SHA1 3715f067c7bbbff6f7bb9670aeeb6d2acbf37bdb
SHA512 e33779baddb28d43a3ab133777bbea7c8229689c26c2d0c8105aed646fa997e04f191878bf92cf75bcd76edc9000407d57133b17088a890eff5b603b4d412381
SSDEEP 24576:AlYJeXm5jUuE/+L6VMRCPU6CENltmVVdpx7fLrQWd:AlYJeXmRUuEE6ZU6CENlc7dpJLrQWd
TLSH
T1B955122D67AC34E1D2A94178D5A28564E372F8A627016BEF52F0D53E4F379F42D3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 d18e8e856b9127c3fe4218c092943cfc2008662ae292cc0e38d93103d8a2b9cb
MD5 07f5ff1bc6d1f45cc1c2aadc771acd5b
SHA1 ca81cd4a957aab458948262e1a787c1ad82cdbe9
SHA512 e44513027953d3a5d3279108c28fcffe5c97808ae1d269fadf3b7278507744f01e211f3ce1c8753490997d8d0414232d5368af8d2aa5b7dede03e781b6c29b46
SSDEEP 24576:H7tyq+L6VMRCPU6CENltmVVdpx7fLrQWd:H7tG6ZU6CENlc7dpJLrQWd
TLSH
T16C55121453A429A1E7F50238D9A381A0DE39BC615F105BDF61E1FA3F0F36AE46C36B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a0c3d6c99384a9524f6979f3c8abf19ee9b0351dac76a2539a208e2063e9df80
MD5 5b6346156ee79a9ee2ecdd46b6f9c268
SHA1 1b600116254785d201836a611921fe4994f646df
SHA512 8e7f88b63afc356134e9b52e6efb59b1333495ed779c0b967f0baf2c9f1ec202cbcda6e1f3d8f3787fd3011211df3fd2c978b6d96eef91538c4cc96f52deb73b
SSDEEP 12288:XPU8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:/v+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14245233847653D52DBF00178D16291B1A569BDE56B002DAFA2B6F83E4F398F45C3BA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0315ebbff9a2222af5f370e2fb2abee93d96da083b35ab8eef460b8bdb052b6e
MD5 2f7f2e04c10e0bdb246ca13cfa8761cf
SHA1 08d55a5b6582fee0ecc14c1d3afdf7e439cf15f5
SHA512 123b75916250f7a7d5cc6712ff97bcf0426c3b9f09e9d4ae4acfb8984cdd6d44e61c660264ac9da79254c7a30d3668165cb197864d5ff38b919288cdaba28332
SSDEEP 24576:zC+TyQIu93VAumZr7jmM+L6VMRCPU6CENltmVVdpx7fLrQWd:z/TfIq+YT6ZU6CENlc7dpJLrQWd
TLSH
T19F558D1DA7F91DCAE2B6C575C8A34493E633B872136196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fe3115f1c60376487b5b69228e318f1832e6b001484f3166a750a3938aace79e
MD5 4b58a0242023d4d99ca8b9d80d3788d7
SHA1 f0fff5c2f2e20bc8502c472b588dbedd8f23d10d
SHA512 1e126e7d6d85cd2d5dea8208c55abea94e982f72e3dc4b50339c8afb5f15691aee468051b6429ed584a1c71676363ebcad5b99aee4b9e8706c14b3134b770077
SSDEEP 24576:2LQikZ7+L6VMRCPU6CENltmVVdpx7fLrQWd:sQikK6ZU6CENlc7dpJLrQWd
TLSH
T14365F11EB3AA10A2D1A7823CC8864152FAB3B875571267DF42A1C73E0F775E97D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 287b108ef5ac5988ed61b4eb08622aa3c52bd415e4c958e4b0d42901fd6086f0
MD5 e9f89ba72ccb118f058399db3039cb3b
SHA1 406e9d5c417ac3b0f1b825c7475f790a4871d628
SHA512 19b478c552fd132fdc006428d22c9617f8d3e61a21e7490b5c0761e1ac5f6c7ae0338cda61864fbddb3027c7023e644cf4b253ce0a74edb178e88950a20a16de
SSDEEP 49152:7pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPx6ZU6CENl0:QpC7b4+80GTkm69CEN6rV
TLSH
T10EA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aa1c03eaacf1becca579db508c0d8731c61351562e08a2cd1912a796d14b8817
MD5 4cf8d739a11a72e70b840caab29b49c8
SHA1 4db18e1d5c94ba57643cf7ba0b3f5751563b433a
SHA512 d6cc9b65ee84aef338c43bc635a77c5063abbfafa76ddb895f6b119dd16a9bf3a6f85f9e6346e6aeb4644262d46283720fd84b78582431790bc95d88192aa992
SSDEEP 24576:FSAwJPE1IDAo+4Kt+l44135UQi+L6VMRCPU6CENltmVVdpx7fLrQWd:FqPCIo4Kol4/QZ6ZU6CENlc7dpJLrQWd
TLSH
T1A655B029A7F956E5E1BAC7B4D663C511FB727823133163CF9290813E0E169E85E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 211fa8aa891731d4b58b9d85386c959b16003161424f5a1bf0e24f412b72a1b6
MD5 d3dc7db182e2ae4bd9ba7d8da53e6e98
SHA1 94c55edd248ae76c35877d392fbe18aabe0ac9b1
SHA512 79ddd273acb3a688dd3af4d39976b342ebfb19c3fd6c4220d1b696b4e62c8bde38f3a761ab67d67bc7a04b808833e6c0bfcc6dda47f1854e29b20cf119802ec6
SSDEEP 24576:dyLXPLcM94ty+L6VMRCPU6CENltmVVdpx7fLrQWd:dy7PoLtp6ZU6CENlc7dpJLrQWd
TLSH
T1C275E13ED76D08E1E57AC27CD6A38506F6723CAD033166CB15A094791F6BEF4693AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 2dcedb351d44978bf4955b63e5e2dfa4db30bfc71d5223bdbe5ab3b3acf4352d
MD5 5088a1e473261d806b7dc7d964b6bc4b
SHA1 5b1dab4b042ab8b121762bd394b63b45e8102b71
SHA512 9fdbef261289a01c8afb699219559e266d264c82b197631e7e11289e4bed1de6acac245d0e7e684ee7bf4828291a6a50cf83d15d51f406f8e97de73a8efe9daf
SSDEEP 24576:2Wv8qjpr+L6VMRCPU6CENltmVVdpx7fLrQWd:2Wv8h6ZU6CENlc7dpJLrQWd
TLSH
T14465122E47A428D1E2B80238D56281759472BCB617606AFF71D9E93F0F35AE0983FF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-48-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1308-179-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-54-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1848-90-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1848-96-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1848-122-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1948-145-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1948-137-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1948-143-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1948-266-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1976-120-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1976-114-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1976-253-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1976-125-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2020-205-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2020-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2020-59-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2020-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2160-485-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-486-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-476-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-477-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-478-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-479-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-481-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-480-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-487-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-488-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-491-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-490-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-482-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-483-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-484-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2160-489-0x000001EE7E200000-0x000001EE7E210000-memory.dmp

Download

memory/2240-255-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2240-475-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2240-250-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2240-244-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2484-89-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2484-19-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2484-13-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2484-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2564-470-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2564-223-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2564-229-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2564-231-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3028-269-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3028-492-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3028-264-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3188-203-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3188-469-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3188-206-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3496-32-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3496-26-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3496-34-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3652-124-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3652-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3652-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4472-135-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4472-256-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4472-132-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4472-127-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4860-0-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4860-535-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4860-9-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4860-67-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/4860-8-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/4860-536-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/4896-87-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4896-74-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4896-82-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4896-80-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4896-85-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/5056-68-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5056-44-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5056-38-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5056-72-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5056-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5248-371-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5248-169-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5248-166-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5248-160-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5272-154-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5272-148-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5272-473-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5272-267-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5272-474-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5272-155-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5416-437-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5416-171-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5416-177-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5416-180-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5540-191-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5540-192-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5540-467-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5772-304-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5772-324-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5772-280-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5772-272-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5772-288-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5772-493-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5772-278-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/6084-240-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6084-234-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6084-471-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6084-254-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6120-217-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/6120-219-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6120-221-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/6120-215-0x0000000000780000-0x00000000007E0000-memory.dmp

Download