Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe
- Size 3.0MB
- Sample260531-tyf8aacw9v
- SHA256 4f5241b28bb776bc20912569967d80b9b379b630f1e5f544546b8c3d5a15ae45
- MD5 1b6a7fed0265ea3d691840b3c9e61f62
- SHA1 fa551a7f7a6e70070981ff2fefb0a3843f269c94
- SHA512 83aabe5eadb630b3edfcda191d31aa2e1405aeeb4fb29e630ab2a4be97781ed82627ca2774e4d512be8fd9248cf3a9cae41eda7ae4a9a61ef06a04465c3132bd
- SSDEEP 49152:+lLEkH4q8hy1JWFeIrk/agsMod2ZPyb8+9ZjeLBzNwui0hBdH30Vq0re0d37JWyF:Q4q8hyyCi6LBquTBpkVqOe0bWG9
- TLSH T194E5CF4A73E840E8D0B7D778CA669616E7B17C525F30CB8F11A1999E1F337A09E39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4428 alg.exe 5928 DiagnosticsHub.StandardCollector.Service.exe 4496 fxssvc.exe 4008 elevation_service.exe 5300 elevation_service.exe 1652 maintenanceservice.exe 3956 msdtc.exe 5208 OSE.EXE 4928 PerceptionSimulationService.exe 2080 perfhost.exe 1780 locator.exe 4004 SensorDataService.exe 4412 snmptrap.exe 3984 spectrum.exe 3312 ssh-agent.exe 1732 TieringEngineService.exe 596 AgentService.exe 5036 vds.exe 1372 vssvc.exe 5700 wbengine.exe 5276 WmiApSrv.exe 5316 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bff5d1aa396076bf.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\java.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-af.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-te.hyb msedgewebview2.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-tk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-ta.hyb msedgewebview2.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_772909753\manifest.json msedgewebview2.exe File opened for modification C:\Windows\SystemTemp msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-gl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-sq.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-sv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-nb.hyb msedgewebview2.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_772909753\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-und-ethi.hyb msedgewebview2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec7dc17b1af1dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041ea097b1af1dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f3af97a1af1dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002854f87b1af1dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fad8b87a1af1dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c75f47a1af1dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1405e7a1af1dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe - Modifies registry class 58 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\"" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 680 Process not Found 680 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4372 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Token: SeAuditPrivilege 4496 fxssvc.exe Token: SeRestorePrivilege 1732 TieringEngineService.exe Token: SeManageVolumePrivilege 1732 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 596 AgentService.exe Token: SeBackupPrivilege 1372 vssvc.exe Token: SeRestorePrivilege 1372 vssvc.exe Token: SeAuditPrivilege 1372 vssvc.exe Token: SeBackupPrivilege 5700 wbengine.exe Token: SeRestorePrivilege 5700 wbengine.exe Token: SeSecurityPrivilege 5700 wbengine.exe Token: 33 5316 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5316 SearchIndexer.exe Token: SeDebugPrivilege 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4428 alg.exe Token: SeDebugPrivilege 4428 alg.exe Token: SeDebugPrivilege 4428 alg.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5316 wrote to memory of 1652 5316 SearchIndexer.exe 105 PID 5872 wrote to memory of 4372 5872 2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe 106 PID 4372 wrote to memory of 1820 4372 msedgewebview2.exe 107 PID 4372 wrote to memory of 5568 4372 msedgewebview2.exe 108 PID 4372 wrote to memory of 5568 4372 msedgewebview2.exe 108 PID 4372 wrote to memory of 5568 4372 msedgewebview2.exe 108 PID 4372 wrote to memory of 956 4372 msedgewebview2.exe 109 PID 4372 wrote to memory of 6100 4372 msedgewebview2.exe 110 PID 4372 wrote to memory of 6100 4372 msedgewebview2.exe 110 PID 4372 wrote to memory of 1960 4372 msedgewebview2.exe 112 PID 4372 wrote to memory of 1960 4372 msedgewebview2.exe 112 PID 4372 wrote to memory of 1960 4372 msedgewebview2.exe 112 PID 5316 wrote to memory of 2272 5316 SearchIndexer.exe 113 PID 5316 wrote to memory of 5836 5316 SearchIndexer.exe 114 PID 4372 wrote to memory of 3648 4372 msedgewebview2.exe 116 PID 4372 wrote to memory of 3648 4372 msedgewebview2.exe 116 PID 4372 wrote to memory of 6028 4372 msedgewebview2.exe 117 PID 4372 wrote to memory of 6028 4372 msedgewebview2.exe 117 PID 4372 wrote to memory of 5112 4372 msedgewebview2.exe 118 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5872.4196.184069335923039426222⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x13c,0x140,0x7ff91c5db078,0x7ff91c5db084,0x7ff91c5db0903⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:23⤵PID:5568
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1872,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:113⤵PID:956
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2136,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:133⤵PID:6100
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3436,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:13⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4324,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:143⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4316,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:143⤵PID:6028
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-05-31_1b6a7fed0265ea3d691840b3c9e61f62_cobalt-strike_cryptbot_icedid_njrat_satacom_stealc_vidar.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4564,i,4843270182491858455,14592222198634682124,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:103⤵PID:5112
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:5928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1656
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4008
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5300
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1652
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3956
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5208
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4928
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1780
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4004
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4412
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3984
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3312
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5344
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:596
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5036
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5276
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1652
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2036 2760 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:2272
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2904 2900 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵PID:5836
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 7852e7d96399bb79cc96e7419bd4718e92fe45aa0b5d2da6853615c953550e30
- MD5 4f5bd7156cfeeb217a4663bad7f086bb
- SHA1 8b4520c550356bec059f7fabefb74b2cca48634d
- SHA512 1edeb4383f118c1c848276c2c5f45956f498ba90263aaffc95ff96d6ba19c8f0ea883064329fd1d362f95311b7e7de30163cdb23989d4cbfb8d41788d1e61c27
- SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn8q0re0d37JWyAqAu:D3q6mjBhqOe0bWG9
- TLSH T176D59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 94f6e5601426e460bec72c8e2b44fa6351cb827b4c17ef87c0ab295b9a04e0eb
- MD5 459a5a7cc9866dd6211111db7f217ec8
- SHA1 5399489b366535dae68293c712f1c9690eb43b18
- SHA512 426f2a55b4d2f3e83b89400e252d740689383744e36988934e583620c9092d43bba58a60a1d344695402b78c45f94c7300b2a828b498292487742e753cbf96fd
- SSDEEP 24576:yXYfDtczAVqtL+SgvqFE1d3ddJW3CAqPSbwL:Ztc6q0re0d37JWyAqAu
- TLSH T10B75F128B39409F8DCA78279C8B28515E673BC5547A0E7CB03A4A5361F337D89E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 f5260847d7850a95e8da3c864f8ffd14cd2e9cccedd0fc037515ed32418ada2a
- MD5 87a240113b35eff768cfedf437842bbb
- SHA1 79cc040a19544f47453b9b302c75c38027bd746a
- SHA512 8a5020badc68eb4a13d19f41ec82ef09f7c60334d833d5ddce6b3b8bad5fb0d454cc200bf59974bcda3cba0c029f34a282f75353dc9ee3d6f9c89ea474a9fff7
- SSDEEP 24576:C0Le5ji0hmxArM0qtL+SgvqFE1d3ddJW3CAqPSbwL:CPji0AKfq0re0d37JWyAqAu
- TLSH T138859E16F6748731D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 2463d7b8e6d212f5f99629185d4dc3a31f22421a8265e87fd28a82982ca38a70
- MD5 bfd77d66569fe879f93d78d48bd9a860
- SHA1 5b3386cfc69cbc126be9bbb55c5461c4a2b48435
- SHA512 1bb9b3a12c20daae317da34ebfd0898e9d22c60db16b9f8c321120f3aefaf687b0129c98b3371f8f08a265e94fa2a37a1067ca32d9867c3745b5d06086770c8a
- SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWj6q8wyuqqtL+SgvqFE1d3ddJW3CAqPSbwL:S/ezSC6vUzPv+Hjyzq0re0d37JWyAqAu
- TLSH T15A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ed1a13c2f05876ab7d526694f70c8a5978cb29f0a28bc76d4cd0f5503d258014
- MD5 56bf78b6cc252dd6004bb1324b44b421
- SHA1 786154af0734587d60682e8940868e0a449657ff
- SHA512 78d92fab8fb011613f09c2436ce107e1a8577595c6cb306a46b1186cf1336c7ffb582f74df92c3bddd3afcf2f2fa4f82f913160ca221f9a1f939d7f5471392ae
- SSDEEP 24576:8VbqPb88hv/l+BRqtL+SgvqFE1d3ddJW3CAqPSbwL:8VO88hXl+/q0re0d37JWyAqAu
- TLSH T1F0559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 7e7e874cf81628deaf11553ca5a970c10b639a850be940b665c0f91640ccfa60
- MD5 431f23f6fddaf9721df683eaffe1cba1
- SHA1 4259280cd14c339589ba7a955583f4415d31c54a
- SHA512 2a4bdf27699e0153f9703d6d5f38d84e1dc32615d2b4d5cc1b9881064a1d2b9fddac7931f4b88caad7951e60f9407c8461d6b022cc9389d7a5a7a278f706ad03
- SSDEEP 12288:2ID8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:2IgqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T192552349E7084E90CEF417F1F4FB1068E599DD059DC0B6C9F008366766B2AB1EA6622F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 0040e405ae4fcdded54a8117720560485263a3640c3872a9bb0da0e99a9920c7
- MD5 71e4fcb5203ae14a5da7ae750bb7d3cd
- SHA1 3cee73fcb03dd0e571d3af1ffa1fceb4bc424d0e
- SHA512 fbd13b966e8a359606e33b2d039eba35aee247321725a86c96cceee9a2ae84948b73f8fe395c72e46d9762393e0efd52bd7716c2c1f76950c6a7ab62330dbe7d
- SSDEEP 12288:reBNUbTVO86UU8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPl:rJIUpqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T1BA75CF3BEE28FCD1C67A5DB95A918600E77278304F51A3CBE164830EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 5c7690cd5f6ea3da9ba368ba56bd84b31428ce14bf299b977e7a31cfbff71e74
- MD5 bc4f212592fc600d322ab73f9a4334c3
- SHA1 d0af0930d00043fdee85bd48d24a676d849993a8
- SHA512 a6475e08c55afe736b316f986b1fc26e1345b8a582825db90d3096a15a22b60868b9c6491a63e48fccdf97dc187d0f2993dfaa3871ccf94cb73bc986c0f39b0a
- SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THf:iQvGAdlCEL8c/WRNw5CaqOe0bWG9
- TLSH T1B3266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 230302708606ce48b4ab8cb3202c0ab8844addac3689c139d5603aef304b9087
- MD5 ea37b4929d5f2be2e523b3fde7fb1c4c
- SHA1 abde1d3fa4d8604591474399d53859667385a382
- SHA512 a38d46715788dea0079ac9d68adf2e41f77b5c56c6b72e02f74cbb1ea177d6b0feb18ef4efa0571b82cddf59eb8166c43c454e8e3a9fbce1b1b5968140836628
- SSDEEP 24576:SEewsAjPqtL+SgvqFE1d3ddJW3CAqPSbwL:zljPq0re0d37JWyAqAu
- TLSH T12375E031FA74D432C6BB0DB22B36C716542CBD204F911AC3F3A85E9E59702D26776A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f927bbbf69b3d0dd736b65ccc2a4349c382c778fd6fbf42ab255dfbaf52a9d64
- MD5 983006c7ec1e143ff0a97b9ff0fff6e6
- SHA1 c618bb7dac854c99c4f091af8598aba76d41061b
- SHA512 77e2ee4a2a4ca2d8dfdb0dd0f397533403f45d932671fc715034615354522cd6ef974cac50e32fdbafbf0faf40697fddeccc8cf898f38257a20593bc5e134382
- SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3qO5q:rUEtQevvqc2W1cpV20I323x5q
- TLSH T10B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 9400748e5c090237075449582304b1bd2f8bbd52e505cadfc3123b5f73c07943
- MD5 3b8de708ab6fabe8b5159d846128b282
- SHA1 889d3e299f013f4a8b1cc0c40e3605c4a03e0763
- SHA512 94cb566353d4cd6ae39b2af72987812caa7da44eb07cf16faf2b4fabf7876f3161f0733be50943624c68bbe5f0621891c5ee42919e5d22d2ab9c7962d61f5727
- SSDEEP 49152:iCbRquA/m2yL5zifFiV+XenmE3/zvq0re0d37JWyAqAu:noqHVjnmeqOe0bWG9
- TLSH T190D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 3966dcfb2d88178d382f7259778e2fe9a6a78b0f5271426d42c9cbbd5b3e5d2b
- MD5 a02792b1420718fa64efe948abaaf459
- SHA1 8260aed6886a09356c557506ef2a85d44039a4b4
- SHA512 8a21888c3d2740eff1a2d414560ef2df707329cd237d917d7c67966c1ca910ce03d35d36acaa05488e17c66f1bf7642f633261010cb760dd38995e8c7863fc6e
- SSDEEP 24576:nAhGL6IFoiwtA5l7S53+qtL+SgvqFE1d3ddJW3CAqPSbwL:nAM5Foiq5Oq0re0d37JWyAqAu
- TLSH T139359D81E7F945D4F5F3AAB8A9B68170EA76BCA65E30D20F2150D11F1E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 230631770e2a5aabc1f65fd8bc3e2aa1afa4807161b52a260966f22159ad1223
- MD5 8c094749ed9e03c98efd1f7c4cdd1bca
- SHA1 a62f1b5f7724772c94009089131ab7752144d5a7
- SHA512 495594d494b929ce5129d694687fc3e202ae70b807e78601c01f1de1d2a4de2cffb4ca297ddf10c4fc26d550a50d469c66198fc770d9639efe1ac6ed11831e60
- SSDEEP 24576:wwukOWTqtL+SgvqFE1d3ddJW3CAqPSbwL:wwvOiq0re0d37JWyAqAu
- TLSH T10865F14A73940CF9E9A65279C5978136F7F2BC022A21D70F5760C65B6F33361AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 a4a828dbc95bee5f8a4a2cf6520d3401fba833d15d91abe8c2fba019b8f6663d
- MD5 3fba39e8da22aac4f193ab05f4759f6f
- SHA1 57cbe2bbcf5d4443a9e751aa238dc6134330ed6a
- SHA512 fc1e7a037ea26d801833e3b5f444aed47d5cfa5f3acb913f048ec20b212438140401b24e1a845a885744f7b21f1f5ba1e33b4f29dba387339871fe8ee9264336
- SSDEEP 12288:4NZ1Iy28quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:SZusqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T1E4551249338825F4C9E653B9D8F64504E7B2BC126B7153CF611462662F73BD2AE3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 7a1f3b614ef1b0d569bfacf536663813d58a809ca57ed0464351677140d3a506
- MD5 20939515d1ed48ca3172df9c5872bb18
- SHA1 50400eeb2c12c79fd80719cdf1ead1ae1cf5e264
- SHA512 fb8d8b5ad9deab8879470dc2336270681e96464136cc03acee5a2ba50cb48d0110645c59fdbcdb7e927dfbbbf4ec8ab7991624da5a18357b1643d47158fed83f
- SSDEEP 98304:EQRQyi36YOcPDLvw2gAf+PN3tqOe0bWG9:LQyiKanX+PN9qO5q
- TLSH T144667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 97e471d530c4629a113c72f7d73c6cd40ec0fe6d911b23488832262d4093a9ba
- MD5 fcf110848f608082040f4f142c999545
- SHA1 c59244cd812de5079d3980171ca6e465b38741bf
- SHA512 a6974a4f7c953afa77cebfecb3043bdfa847a881d9f408492d7198f973254591dd5e6d3e15831a8ed334956b840fa25e26d50cb8e5b5f26f4d485160d9d808a8
- SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN3tqOe0bWG9:gQyiKanX+PN9qO5q
- TLSH T104667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 3a08c09ab3f024b989b6d53c83a681a6a13fbb222f4cb752de9d8b6bf9510e63
- MD5 d0d5662a6cc2e6216afea4a0c100b38a
- SHA1 c44649806ab1853e9b1ea1b83c48db10de476ae8
- SHA512 df1a924d5da5f660bb7dcbe1f6d16dce3dd064fb7ae1edd6523d4f10c6d87d27a10ebb8fa9ba8be8812ff02c1c59b59ad6d978368b48b170dab071285ee9c2ac
- SSDEEP 49152:z68Qg55nhkeWu7PNU3/fq0re0d37JWyAqAu:tthTRc/fqOe0bWG9
- TLSH T121B55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB850572161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 bc5f91c8187778654db03deaa33ff04ef11b3722281edcd47123fcb609990de6
- MD5 cf68c163cd03ec84142232379860cb70
- SHA1 8d21e2fc8fd7cb6ed23235e31201c8a0c4be8177
- SHA512 b199542223f95589a4447cf76356c9cf6d91343132f676f5c81229ca3524b3d136995168de6e29b8426bad394d4bfe50ece14c67d4843ab723c5b51764020ce9
- SSDEEP 98304:gy5112gYy5azzVvU69nLKnhZgqOe0bWG9:5LIHRWhmqO5q
- TLSH T18E167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 c02aa984839a38f48fd1d5ae602761268826da6bd7f87df374d196762ce23deb
- MD5 f7decf74b2d6cd6c679f43ce733d609b
- SHA1 57ab37a40d6b7aee093c95995fc0007e66e37929
- SHA512 9d3c854615cf6069d819c32a212af8cd10dbdbdae224692bb47af952ab9b5a712be8cec451428c87be4810f4d848a022276a81f916daecb66dd1c2753ead5f3e
- SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllq0re0d37JWyAqAu:Tu6JmIxd2dlqOe0bWG9
- TLSH T1FDD59D13F1DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 3c6bcb62840b9f3662f0590c3cda599fab73f9fb8c2c10ca64f6d4df1ceef4bf
- MD5 85477d309b6f105db0126135b443a164
- SHA1 4331189e47a5d8665a4c2014cb663721f09f897e
- SHA512 bd6c4771d2b2d182a5ff2a9a1f8df99f971075d68b03873a255befa28394476f1d3b0dce1d1dbd620a7eb76583412df7f7ca63d9e8fad76f3e0e926e13615d68
- SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4xJq0re0d37JWyAqAu:wmifPqReqOe0bWG9
- TLSH T11BB5BE13F29901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 3513d546d30ed50801237e4d5727e2a3534295b79055f30d6f10c9be62e67266
- MD5 e3a8984573c449e8158c7a2b850c7899
- SHA1 0751182c651cfa712d290cf3647cc84f5740f24c
- SHA512 4e28857f7637000e525179ddeab67a965f44c2b8492240febe68d2b95facd505c2b13d813f89431398e830f3302ebe975ea8b1d80f47a0ab2c37f884800f814d
- SSDEEP 49152:CSuZQIY0Be2KkRVtOnks6NMHqsq0re0d37JWyAqAu:c5dKqi61sqOe0bWG9
- TLSH T1D5C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 c7d0a86654191637324a77293643dcb2c85de938eefe3d7080c8ea3fe9288daf
- MD5 a1f69108ca140cdee88f7cadf8907778
- SHA1 cdbaa591a549df73f8e351350fac2d00e8131528
- SHA512 50030d2bddbe623b062ba73478f01d7f3acb2dc968e576abe1d6f9438d5495444477683bd40b3a349955031ad7b66b211847855f3a48d62b162ab6b6802f4ebe
- SSDEEP 49152:WhtSn8EApI0figjgiDn0AP5wVq0re0d37JWyAqAu:3X2iWphCqOe0bWG9
- TLSH T14A95BE13F2D901E8D06ED178C7568632E962BC160B34AAEF0A50B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 d6b57f5b4b8b0d986a1daeba434bbf046045d64fd8a69d12fca6b3ec2ac49d1a
- MD5 d746a14fa6a2d28a9e5a8be5c52583f6
- SHA1 8d87012fc45ba65a1bad8ecefaef09ce6e1bc95d
- SHA512 cbd76ed8a49bcc785c83ede5a14b54c956e2056f2325b4f44ad61e183c4021587db6a9eeb9064f2bc6077e913999f553bba4fac8e42ff57a0dc1f67db87d9553
- SSDEEP 12288:378quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:3YqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T184552349F6094F90CDE417F1F4FB1068E59D9D06AE8062C9F50C312367F2BB1EA6626E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 b8670615c2279bc15085c775b6f62a45f0cc46ac04741097bfaa3a3ab811e495
- MD5 34c15c73b71d9473b6f2c5ef3ca0732b
- SHA1 cc3e4be4a432dd30254ce0b00db2db4bf19363ec
- SHA512 25cb195968a0b8ae56e0873712420a22b7e8427efdc2c378993ca7d9cfb700c2b7470e4c5be71cd8937c87c2eb49ce956e9f997776c0e3952ebf061cd254d7fe
- SSDEEP 12288:Xa8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:X7qtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T1A0552349F6094F90CDE417F1F5FB1068E49CDE06AE8062C9F50C312367B2BB1EA5666E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 7d4e6601d3474237d03d3bcaaa72152eae977bd0fae089b40b6a9d648d755a75
- MD5 f026be89c154016bfcc3a8042145fb80
- SHA1 6827dc2a3e0d119d326b0432d04dc80f31906371
- SHA512 86e505b307ee55379308aa62ba2dfb935060feef0583f09ff1a2ce0ec44f23b014c5daf677329208fb2ae02b2c93f978fb42565401bbf313cdac7669e12ff845
- SSDEEP 12288:GM8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:GhqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T18F552349F6094F90CDE417F1F5BB1068E49C9D06AE8072C9F50C312367B2BB1EA6666E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 21355126a538cb83a57f4bb83ae8c913ff561650f234715647092c77332076e2
- MD5 4291b35f44a6cbc99660f5a4b5cd4a72
- SHA1 85b6ef1cfa9654be773ad0caa548630fac27cf25
- SHA512 e7f03b9eed611681d4deb47a408d165e33e8434ef5177fbe6a510fb720e98700f5098a1531b1ef59e717591d7cffb90145b8d8686aa4977566cf3c097c647dea
- SSDEEP 12288:rV98quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:cqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T1FD552209B7090AC0CCF597F5E4B70024E2A9BD56AF5063CFE50435272BB27A0EE3576A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 aea988f588eafdbe907a2a72f2c1493c3bd10ce61e82d269bce521552f1fbbd2
- MD5 03f78efb83633a3120d3818168b4a0b0
- SHA1 e21b1dbff680a233a2e4cc92d091e5d1d7daeb09
- SHA512 0b20c650f8e9ea1b6a7ce72ab26e5d220f58280fd0bcb7df1f2451183af7cdff662233684024f7fe13f6997eeb0babe033533cd2428a129b6612c4aa5a06d507
- SSDEEP 12288:Dl8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:DGqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T13F552349F6094F90CDE417F1F5BB1068E49D9D06AE8072C9F40C312367F2BB1EA6666E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 d43a5b3af21d6344485ded498fac65d1b595a3c3a439e9b56ee5e1683e700f71
- MD5 6708867e2dbb648a059370fbfc015135
- SHA1 84cccc8fac09bab018f12b6fbed9a83863e18f7c
- SHA512 b7d153d8cd94610fc96945368b05a2c2979369dd0a1102febf68cf152ebe2abb4cb29db2a5aec8e27cacac210027451e29ec6c4fc841baafe83847d0086213ba
- SSDEEP 12288:me8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:mnqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T11D552349F6094F90CDE417F1F5FB1068E45C9E06AE8062C9F50C312367B2BB1EA6667E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 5755490d733bdfd3df887d19403ec77a4fac9cba29c13205ce906f9a6d8fcc14
- MD5 cd9cad5c926f6b5b43703bb73ff18ac2
- SHA1 09bbd811101c0a2aa771b053767b2a66a7187825
- SHA512 67dff404275853eb34af3c160ab801a25efeb57bfd940c34e3c119c9acf4154d26ae3af49e14a58510ddd4471220f7271d40551b19e1d25bcde9af1a93ba3e90
- SSDEEP 12288:Bi8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:BjqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T101552309F6094F50CDE417F1F5BB1068E49C9E0AAE8062C9F50C712377B2BB1EA5667E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 56bf0596b11004bc9e8a2eec83a185df29a6fd4621e4fb3b1d8e85725e5afc0e
- MD5 39458899bd1ad6f64cd0b8507528ac88
- SHA1 3b98c15406dc4b6bb6c2a826423b5fe881fc2067
- SHA512 9a5667678a9c1e151080e1f7ff8b6228a21d644a07a8b4ce346763330bbfc07f3c9d690902692c99b442e07e91c0a93b5caa2d056834b757c86f18c2636645be
- SSDEEP 24576:ECUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA9qtL+SgvqFE1d3ddJW3CAqPl:ECUAPTY+8Wg2lIL8lrIUJLWwGq0re0db
- TLSH T1B365BE1DA3DC0896D4BB82358A518A06EB727C2E1B21D6CF2160C33D6F67EE55E35F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 ea3ca4ae73047135a01ccc913eaef32eb687a57dbc5744ade0fb68a623dcbcc3
- MD5 c55f2b47c6214230d8df27a22487b10d
- SHA1 15090c9904984ebad2aaccc34a38615db30e0666
- SHA512 a1fff1f3f4ce9c91e345e1b1f003e1d6ce9dda6f0890a1fbb44800386dba088ba39fb202006f3d426c1244c74f0a8a748f00e7a2faefca7920faf4d26824f745
- SSDEEP 12288:wWsf38quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:MsqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T1C765F109E24802E4C4AE62B5D7A64640F3777C2597E1E3CB62C0F53E1F76690ADEA713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
- Size 1KB
- SHA256 c27fe3c5ef34ee94e9a2f71b89361276a06f3a1fadb85ba484f4782fa3b98294
- MD5 a0a74df0900c26207c7454df1a9c753d
- SHA1 8f8cfba013416b19c4c9b4eaec5505bd45d1d464
- SHA512 cabd56b2a7e538f588f33e67b3555461b5875bb67e324fbb6a7a1a50eb9a71631779573ebff24c09494dfe958a405351df5e6a85b2e5abaf8b88f50380465b48
- TLSH T17A11FC169ED51B21D7F6DE3482E66321D6B57CAAEF956F0E004081492870D00AE65F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3c7fa0f83da8106e64231dc017b0f5080cc4f9348a64bb29a35f0b4db03dcdde
- MD5 e1eb3efcc8cd9a2b70b1932f2cff39c5
- SHA1 6a92f61fc73adc2a1b928f0dac05c5d61190f71b
- SHA512 d201f308ff95d04d04601c6c2b1f0f4e0e8b6d22e81e5b0c56c6f994e6d2dd5473ed8b21b67b1da229407000d5dd7aa5a51faa375514ce675f570f30827e382a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1626c34f5c7ced33687559416e3318e496528cc1782a72b48218599197d7a504
- MD5 899b43090729ac8a1fb56145ffa91ffb
- SHA1 a25341a2fd36ca67bd9c34484e0c019fcca4c0f1
- SHA512 5d44e8e1cda2220cdb32dbcc430b856b3593c64a23492cc6cb23ae854ed2e667cb0b3952dcba3e6f7ebc1f9e236be69cf7bbb7857706d0424feada312d3b9d8a
- TLSH T105D0123232010134C110387300127D091C21C20F41054100942CC52D3A14154390A841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 6a989f2ff9e6a61fe492ab5596350208bc2bd456aaac235736c7866f92d3ca84
- MD5 3fd2e4e53eb87b3fba2082c85e4c1d94
- SHA1 92bba10f2b74840361b08f2fc7d051f061d2711f
- SHA512 7e414c002ccf3cc671cc70637910cc7f97e8acf74bba2e96e016ba83f5a00cebfee4a8af7869309fd69420b8527af12d8962089a1ceba305a0c150d1c800d37f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 f5cd65d0fde0a0cbe19b36cfe0d28b5af471c5f6191269d10769c0a6da0e5ae9
- MD5 7f3fc26d2ff1157449b9ecec51621369
- SHA1 a490513b380f4a1b98e640ffcc1bf02dc6d1af18
- SHA512 be9fc0c77a142d09662d53e28a8c730b50f35e74ef228613f4b4a497f888d9148a4ad632c9b71e8fa9504a9f2e028a3ab562eb51a849db660fb9214924d4a110
- TLSH T147B024D4413044C3D1C003775450504F71343F3113010F04D34340C1FC71304F100350
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
- Size 957B
- SHA256 7eb178b5819d0162a067588844c554eb45a267a1b360061dc4fd88facf018380
- MD5 3ca4b1a9254249003722eaa4c024855a
- SHA1 959ea02cbbfe1c4bbb3227d09957810e14c934ff
- SHA512 642b500c1a89ca67c7e4f40c9307566896c96e8db5271fcb76e5e84ac0f409e29ec42c726e5994250e7336b34590d36929521ec76a54ede1a36b13c526dcec2e
- TLSH T13A11D0E3C3E4477DC94103F42B706907CE6E18A043683D76C5DA7B0653E15E1D20444F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe595654.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
- Size 6KB
- SHA256 f9c74f22ef946695440d1d18e1b6e31ccfd36b7e3cb2f0c04373c92902523ff4
- MD5 4d614233d08f40627c722f22342e56ca
- SHA1 b6b7f553f21887ffcf69758933b93a9a7d46e49d
- SHA512 16582edfad91543e60c8e7dbe2df1a77f6518c5d6f5906c353ec2e3d80ee7fce5b40326ee06d58faee6d664189dd502a09ebdf6fbac52ed8810ec8f7050a836a
- SSDEEP 192:stG0WDfeZ8pawl8/S+WioNyw+/+1RKrMC:stzWDhG/VvwBnC
- TLSH T135E196035E28697B8CC7E6597A25BB13E2FA103262D51E98ABFDC71C05DA6DC520780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe58dba5.TMP
- Size 6KB
- SHA256 2bd7d59ef7dd4f6de5024e749e2a326a94b9c6453a957d5435ca2a11314cb490
- MD5 1bb112967ee6e2f6564c04df6e872286
- SHA1 21d27fdcbd7bd62722946da42b6ecc18234fc496
- SHA512 9e0c1876413344c90aa5da42c3ef26c146528ce6125d802a0872af71c2df992cc84d831c56f5a29ae2e68d773e460430c01c426dbe51ec72630e2062cb0f1526
- SSDEEP 192:stG0WOfeZ8pawl8/S+WioNyw+/+1RqrM8:stzWOhG/VvwBH8
- TLSH T1B8D197035F28697B4CC7E6197A35BB17D2FA103166D51E98ABFD861C08DA6DC620780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
- Size 2KB
- SHA256 b88e7baaa3e2704312268b10c085f1d77c935e79a59e728f6e075e6398c4fc82
- MD5 be7be47b8ace6ed7adcb83a550296467
- SHA1 561db3e301e4616ed286014d28a8b343859c696d
- SHA512 c64fbdf254927b6d759355202827b5027bdd5fde3d7e90c7979d686bddbac14cbbe312ebd96a22cb3f440bf0895f11de7efb90e1464dad4fb67f01bf80e19ed3
- TLSH T19051D7B3A8186B378AD35E44794A3F13AB35507196613F6099DE4B1D01DF79C232AC27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
- Size 3KB
- SHA256 0120fa41b94b4a25b3fb9ec06e9135bde2945e245fbb65a339fa149d404e428d
- MD5 ced618767fc41f74e91c8003a784360a
- SHA1 6a3942166cc0f7866f81a413e8d75ac43cbb4669
- SHA512 6f4244af829dea68c277936191fc6df1a2c56b1f884cb9c6dc7e1fdf86347c9be35bdb5e18f7ceb68b6cd9d09df354d2e5b075277dbb416c1c8ee0570bb0227f
- TLSH T17371C777A968AA2B4EE39E44B8863B03B7A15033D1913FA4C9ED0F1D01DB3D81356C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
- Size 15KB
- SHA256 6ef2690d5fcf96d82b7dc0f916b85edad7068a67ea9a87f20ed976ea33d4879b
- MD5 12a13288b9bba3ade9fb7ebe4f0663b0
- SHA1 6ce9a900b53580738e5cd2461e5fa41af1f4709f
- SHA512 3ab4829f61a59ed77043694c4e20c3e0de0bb85183bf375378b06c91f45a7331cf290da986ce00b01c8095e8142490edbe542104c60340cf3ad5a4d172c9bb2b
- SSDEEP 384:zIsr8vAVy7dG5UI6limIfB8pNbso3uYZ2y/F:fr84y74GVzVP
- TLSH T16372AE3695386E2A8CD2DD00FC0B66077E7885A9C5D52FB9D8EC6B1C83DB2960362D53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
- Size 1KB
- SHA256 f105bfb7cbade5a9858441f498ac7b8a02bc15a344d8c6797e9817d50253d4e2
- MD5 27ab3cda45b8b396e7b2a3e180a7e188
- SHA1 eccbab5243ddfdcccdc250409ed0ca1434c64e7e
- SHA512 647f09127786575a795b4029a4bdcf629f12275f9e9d054a2c5952147614bb6ae71859b131e077398916df0f26187726e4d838c22b33b98b0768cf2ed6b43443
- TLSH T18131C7F3D4942B32BD822A557606BA436F201426C2205F44A1CF872F02DB7CCD73EC22
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe583d52.TMP
- Size 1KB
- SHA256 f10c5523dbccbad0e44f0efe05148655cff26cce332d3134a4b6a6c4bbb4d9da
- MD5 9664e753a104794fc8bd203beee45a23
- SHA1 a836396e8cb79f23c14470682ee055761e86770d
- SHA512 0236946b2d046c393ebbc77cfb0cf3b265a8eb82d1abdd3416f3ce42a759164596f84ae4232fe2df08635b3b495ba423bafc67e4c4356479098622db3b1e155e
- TLSH T1102165B3C4982A36AE8619557606B6876F50542582205F18D5CE832E06DB6DCC73EC23
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 95dc64e0283b8652f18c1ddb717ea81f7fca95ca427bc230e1ec15f8cc70801a
- MD5 b038c267307aa2b43fbe3b72e4e51f14
- SHA1 e90abd97947701582a2242754bdfcdb39fdbed3a
- SHA512 c94770bd3bd18a1d4629da4bcaf5e505bd3f1c2e5dd32d99eb41c1e89b8991a1fa1b1a9078251c64f18c23296e4d4b0941030893255dec12904bab7addde7a41
- SSDEEP 12288:Ts8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:TBqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T1D2552249E3094E50CCF927F1E4BB5034E15DBE159F80A1CBF408326766B2AE1EE7572A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 379aa2758bdc0f10466f7318f880f75a2e0590e2458bf6f3fad4aa8bc18c65de
- MD5 9d9dea269a106986edf3ab3f2f4d9454
- SHA1 c4b2941a5f49cb1020ea07afe408fb2c63a24942
- SHA512 01648c4741e49d3a48125425aaa0d58079dc3bb650c7e949b8ec0e65a2229212ffef91088d924ce41083649a2582c2de3c901306644fd695a6abf624de4dd36c
- SSDEEP 49152:zRZwQCyiHiQEaiPnMUq0re0d37JWyAqAu:19xPPLqOe0bWG9
- TLSH T14385AF1E62DC46A4E0BAD2B8CDA74407E6B278165731A7CF1150C27D1F27EF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 c2a4deed38f0cc760e34e9bf27766d18647f35480d80189ac392bd688b071808
- MD5 0748ef82e5841e46d439528b83d8a7cd
- SHA1 30d71fc137333c5421936dabc5a7f8f60d32783d
- SHA512 1cba9f1eac690fc800281930d6a2e27c92dacf3a855d8744c99375a0b81a2489da12d8ac35064ed21aeead63785468ac65d231fce4f8790de217a0fdba5fae56
- SSDEEP 24576:xbxA1UGxqtL+SgvqFE1d3ddJW3CAqPSbwL:xbxA1UYq0re0d37JWyAqAu
- TLSH T1FD55122EA28C19E0D9B5A679D9E68005D331BC165B10A3CF6084927B1F37FF4AD36F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 c32964b9041e4897f088b249ea510b113c8808ce261040c775e95aad21853545
- MD5 089ffac5b862f23a5ac92a4a4b739b39
- SHA1 24a128129396917c6880e2610e0579a817db4d03
- SHA512 668de2e71a618a7bc2f79d5c6838cb013b44e2f5c2cecdfe2ff355ffe2c29ffb1df4b83fba81fcc116206efe12b10397eb91ca66aaa73aafdf5bd415e35686a6
- SSDEEP 24576:DjsmP0yHaqrVqHra44KDzMsrnOqtL+SgvqFE1d3ddJW3CAqPSbwL:DjRP0yHfVqzlAsrnOq0re0d37JWyAqAu
- TLSH T12245AF2EF2B910B9C8AAD276454107B5FB71B82D1F209AC70170C235AF16EE49E35F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 94c0f1564517f74445ac6bbc4767cc2778907e629326b75c44a057604a59c3fc
- MD5 21d9e0c3b1b2587929bfa5041ad59eee
- SHA1 7fb58f2ebecff0c489bd2568271b6f4f22eb3f77
- SHA512 799987295e1326fb8b8b07181de562544d2596932869f5fd58197382195a1eaaee23daae8ca7b5fcfd26cd4cfc6508caa65d543db478a3344c091a6f0cf1fd11
- SSDEEP 12288:M+8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:MHqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T134552348F2094F90CDF417F5F5BB1028E558AE155F8062CBF408712367B2BF2EA7626A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 dcea5c538a08dfab2f5ebf4521875080c9be5fd4a74c340676510151e7ddcf37
- MD5 af3d7c1325d8304e3bbac2846caa95a3
- SHA1 dda2c543687d5a693205a80bf3f42ac5edeb5624
- SHA512 96212d3e87e21521d48e9caa21abae004c242c8a87fd92182c86d4ccd140760ef9d1317db985f3b1cf905265b53a97e1940e5bb7f275cb15426b3524b8159adf
- SSDEEP 24576:UvLBUTVqtL+SgvqFE1d3ddJW3CAqPSbwL:UvLBUpq0re0d37JWyAqAu
- TLSH T1A775F149F79404F4DCBB927CC9A68516E272B85D0760E7CF03684A661F637E28E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 ad6c8b658bd133125101bff017db37a9adb0a04784a4ec74c26fa52a5e70cc35
- MD5 6e51d018c30fc603f78172c9a10a861a
- SHA1 6efea3ede4b247d8175fa73019518bd49600f708
- SHA512 dd32bf064c09824c48c7f4daf8aaf7302bd5362a4574b27bb8dd5002cf463f4cb62e46fdd8adf454e56ccc1d6401ee9d4d670efe49242840041f6dba8757ef1d
- SSDEEP 24576:qIYNHyqtL+SgvqFE1d3ddJW3CAqPSbwL:qIYtyq0re0d37JWyAqAu
- TLSH T12965F11EA25D0DE4D57BA279CAD38109F272BC56175193CF10A0827A1F23EE9BD3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a16e91e216d1d66932ed34817954964e9971130dc5dd30e519a4b680ee2b0787
- MD5 2feeb33767c238b84f2b468c874d0d2f
- SHA1 9c725931cdf584f065f7ba03a6bef3ed34628c3a
- SHA512 be0f2da548b9b142e2dbe372ca945affc51e11717f469b6a7cfbdb1848b11806ec152c05e29686f50c8412e0d9923d7b22b5bc1866b86a739fd0b8f29425b0ef
- SSDEEP 24576:bnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK1:bnXoJJYH84VVS6AmETJas+cHBjSSKHPl
- TLSH T10F65BE5EA2BC04E8D5BBD17DC5C34506F5B178661721C6CF022082BA7F27AF5AE39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 e26fff233017f17dc4c8f9fc2a1b7b1f5b50597f0fe39baebbdf4e4d3a42b34f
- MD5 3a4101697acddd48f54b6f00d98f2dd0
- SHA1 746b238d5eb7de81aeaa1b78447f1b0fe842088a
- SHA512 8160ab6e0914da80b4c6bb91dcb6f9e0d106468ea1d5063744293c243733b9ae7b350fe388066263e55121b23b2ad6bd16793b9eaec7079a1753463726ae0de6
- SSDEEP 49152:ODLL9TuJ0M/TYj2Pnq0re0d37JWyAqAu:tLqOe0bWG9
- TLSH T197858C5EA2EC42D4E4BBDABD85B79046FAB2B855173081CF1250856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 4d9fb0968575f84da1879de14e416fcd98334f3d3a9d6df6aa7c382382e9302e
- MD5 b3a23fda2acd88913a7cc6d97eee4236
- SHA1 d393671db01564faf6c92572fa1f1092bf7526ed
- SHA512 0c3cbdd5fe94bce7ab759f75ca5a64e3df73b19c1358e3664e0596b8b7e0b1d8c3c14aa47291d4ec7a32d01e6add842676ab739b061b0b6437e20f1ea1b81978
- SSDEEP 24576:regJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wVqtL+SgvqFE1d3ddJW3CAqPSbwL:rngOJOmPOHkVq0re0d37JWyAqAu
- TLSH T19355BF2FA7BC05D5D07EC17DCA978816F6B1782603255ACF0160827E5F2BEE46E3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 bd54aea608d34bbd1eb0e79269939a0a7b133fdff31bdf15c38b76d35513c8a3
- MD5 5b2f79712c74a8dcbaec9b4a4ea9779f
- SHA1 e2ecaffc2a4e2d5b528a3c51fd31cd30e68d6f87
- SHA512 1824b3defa25f2fc785d032401098c2513531bf121919ed008f0d7f03d0a1a7341955d493c821f2c45b889a7c5fcf55043dff31d3890d0ce6364d905cf2a3bd5
- SSDEEP 24576:DLJnJiTk3R3waE4JrOnqtL+SgvqFE1d3ddJW3CAqPSbwL:DLJnJK8R304leq0re0d37JWyAqAu
- TLSH T1D775D02CD2A810E8D4B7C2B4C15A1656FF31386D2F2169CB69B4D5313F12FE0AA79F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d1bfb117008f5e58597a7d22cf0442a23ef592e153f8958a4f5f0ef3322f1129
- MD5 8336f35b6255db722398b58a94474b0f
- SHA1 41681f5c4e17203c66046ad179fe5a848f0a8d4a
- SHA512 97504e44adc2990c7b15ec5b7a22ed8ee3154320317ef2c179b04d5c527eab111d29f23a2810b334870a61fa3daf89ec9bdb46b8de2515445a12e7041559ba25
- SSDEEP 49152:y9mqCzDScAZmlvTcFg8Ph6jq0re0d37JWyAqAu:USqOe0bWG9
- TLSH T18B955C05F7EB5298E8B3CAF1C96294159B327C409B34F7DF4A80CA6A1E32BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 a2790ab2b7fbff565bfd23eb77a37790c8260d76f04330d4a663ac571355f4b1
- MD5 e94dcf366507699ff3e22f5381c596ef
- SHA1 286ac04fdbe16d573dba77b1f523b3020f2de188
- SHA512 1847a0225c1ae7fcded8aa5257792704bc4c2113ecf5aaf06ababaa42c7bb78ec36365e97308f01b812ae623a7bbc211fa830a18618df925d1d6f5b437b9f1b9
- SSDEEP 24576:TlYJeXm5jUuEFqtL+SgvqFE1d3ddJW3CAqPSbwL:TlYJeXmRUuEFq0re0d37JWyAqAu
- TLSH T19C55124D764C25E0C5BA92B9D4A34514E371F8611B4163EFA090E27B8F73EF2AE39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 77585f8e0bc66347f6cf5c79cff0b04b80b8cb3cc1f9ad974c3fdb90fe524efc
- MD5 638374cf6708297c8de559044437e628
- SHA1 898739f2ed88a17e9bc99c09657f75df58ed53f8
- SHA512 bf0808a32c75f63bb98651f611249caa08ea833c221c65d4065ec779a03f5d1c09f4d473fa425337ab39b7827f34dd042f54afd73b2c724745fa3534e68ccfac
- SSDEEP 12288:XNu6kyt8quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:X8tyuqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T167651208A3845694D9F517B4E9B34164DA79BC215F1053CFA080F63F6F72BE0E935B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 b9304af5f398e4fb1047f0f575263a24ba16362d62b8025391841ca49af66bd8
- MD5 4ae99b96d0b1579ff433418c8fdfd385
- SHA1 cd9ad18996bb2497bd8aaa96fc073cc1c7e810a8
- SHA512 8502c444b929a0569f3d002423c6bdcaae5527102ab0c2d784d2f56acd13dd150a995c072b8ee27d9ee5f7d2b90e97885df699825f7758402866fbe54b8156d7
- SSDEEP 12288:lP48quMPLjg4YqLgvB6dMSJ3oecwJE97O8k4QrsdJW3kFk9huIFYPSbwL:5VqtL+SgvqFE1d3ddJW3CAqPSbwL
- TLSH T11355234CB3095A90CCF417F5E4BB1054E15DBD255F8071CFB048B133ABB2AE1EA76A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 d1fe0a3731d628b35dcebcfdfe21992394d0dd6472776ab86959fec19e5630a6
- MD5 e03beb7c89a4fac76ffc385be6652902
- SHA1 b2806fda015ddbdf02f9d4bbd06313f9c8a8f983
- SHA512 8c0dc8c850726f9a716aca9f9ac19403ebd6de6b383f4a3c24d36d1be65b03f8de6fe0d95f647c4c25af3011902a43ea586d6daa6d33ee60bfbd993efe665fc6
- SSDEEP 24576:cC+TyQIu93VAumZr7jmMqtL+SgvqFE1d3ddJW3CAqPSbwL:c/TfIq+YMq0re0d37JWyAqAu
- TLSH T117558D1DA7E91DCAE1B6C675C8A34493E633B872176186CF2044C07D499EFE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 c65c21924f30a0d0f31561fde7341bba57a359d2e583ad262f551da4e51c6fc9
- MD5 b779350948d37d2e53ee1610c8beef42
- SHA1 808f1ed2f5cd892c6a26c96d271034e0bf40424c
- SHA512 d3771cdeb812b6c3bddd405d75036358936913c2fb483bb65f7c06313bce846461022ba06c16f46c7452bd524789b44c0ad5f8628bc49c68d47fad8a74fa7010
- SSDEEP 24576:ALQikZ5qtL+SgvqFE1d3ddJW3CAqPSbwL:GQikPq0re0d37JWyAqAu
- TLSH T18665F10FB36E00A1D4A7827CC8964115F6B3B8355B1263CF5290C77A4BB76EABD38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 c901c2a70b246aca9b3b532ba3288739882a295b83320f5a4b9741e21add3f8d
- MD5 668ad175042ae3a1621e64329b9a385b
- SHA1 22454244434eff795d51b7d476ed042606f62477
- SHA512 6b026321557ad4df797dea4447b1385a53d120a9920ddef3283f24163e0f618953305ca2ea931b861564a5e7cbb6f04e410914c4c40796751f83da40f2deccb8
- SSDEEP 49152:RpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPuq0re0d373:ipC7b4+80GTkrqOe0bWG9
- TLSH T1A1A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB10B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-af.hyb
- Size 70KB
- SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
- MD5 ffa9db945f0f0c15b8bba75a6e064880
- SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
- SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
- SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
- TLSH T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_2093216522\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4372_772909753\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 8c59b83c0849736f1e9d924e9ea8f81c33d81314503e06ac6071cddd07357990
- MD5 892fb939d339c8ccca7fc938e5984911
- SHA1 1bd1708c15800d7196c46012da1b8d19e230c216
- SHA512 c097d952c744f8fc1229779ee0c0026887fdce7bb3f086239bd40d9bd750050e843fcca66b03aa7a3e308c3d21bff58f0082cb552fac2518d06081ab4ae13df7
- SSDEEP 24576:sSAwJPE1IDAo+4Kt+l4413lUQmqtL+SgvqFE1d3ddJW3CAqPSbwL:sqPCIo4Kol4jQmq0re0d37JWyAqAu
- TLSH T18F55B019A7F946E4E1BAC7B4D663C511FB727822133163CF9290913E0F269E89E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 119eb68a17907c17ab2c08f9a54bb34fa89cc95b363c9cde7fdd2ca9186ba835
- MD5 424b2d79cee944aa352392d28b32cf3b
- SHA1 c2a665ca66711b82b4218503b738f93770e0c75f
- SHA512 83ebbdf3c1f9b1a58adb702cbadd5d69edfd51f0b1ac26d90e3651ef921ca7ae111a9f27581b821f0c500897862f19b69b2635665d4991a4e2bf8e8305ccfc89
- SSDEEP 24576:NyLXPLca94tWqtL+SgvqFE1d3ddJW3CAqPSbwL:Ny7PoNtWq0re0d37JWyAqAu
- TLSH T1AD75E03EE75C08E4D47AC27CD6A38506F6723CAD032166CB15A4917A2F67FF4A939B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 5188535018fc007c3daa974be8ebb61d3f73a189a3904e051f5381749160a723
- MD5 809d5346414c76c2316d273a0efd6dc1
- SHA1 a320ef6f4c3bf8a9ce17ea117352b3a7cae8831e
- SHA512 f9b6091e88aa618f188cb96477193f105dccf6ab257297e0d943c15022eac3d9a746102fce5b17c8fffe3c588c2e9600d5dec9167ae870febaa82ed0c98a5d61
- SSDEEP 24576:OWv8qjpJqtL+SgvqFE1d3ddJW3CAqPSbwL:OWv8+q0re0d37JWyAqAu
- TLSH T19D65124EA28419D4D8B943B0E5774024D0B5BC361B94A6EFB0C8E57B4B72BD0E93EF25
- MD5 SHA1 SHA512 SSDEEP TLSH