9b4b9daa793b0106d9091b1cbc62ac061358bb2e4464455ce10b3aa2d91b386a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260715-n8evbae16w
SHA256 9b4b9daa793b0106d9091b1cbc62ac061358bb2e4464455ce10b3aa2d91b386a
MD5 5667a898f83245aa0ebd02744cb69208
SHA1 cc400c13c4aa6be12ce1b56c6a268accac366c89
SHA512 69a94a3c282dabe96a354380be2dd6d895e49392be47aad51ee4c03de74dcaa527356910bf82f70d071f7dbf932c9a1df0a2fdea2778191e6097695978a2c927
SSDEEP 49152:8vmHGcnO2EvU/bMvo/SHEif5YL8NnjSBjNCWTPp8N7s8SJG8Q/lFTjN4:8TvUko/SzMj0I8NieLm
TLSH
T1D01629ADA6DE40C6C070A4F4CD064795E2F2F854833249CB15E81A1FAE7FEED4E39A54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4404	alg.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2168	fxssvc.exe
4684	elevation_service.exe
2760	elevation_service.exe
3532	maintenanceservice.exe
1108	msdtc.exe
2472	OSE.EXE
4544	PerceptionSimulationService.exe
4032	perfhost.exe
3860	locator.exe
4640	SensorDataService.exe
4220	snmptrap.exe
3912	spectrum.exe
208	ssh-agent.exe
3152	TieringEngineService.exe
3512	AgentService.exe
3804	vds.exe
3572	vssvc.exe
2900	wbengine.exe
5092	WmiApSrv.exe
4736	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7acc938cf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c68950075214dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b16249075214dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000081179075214dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a43f8b085214dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2312	DiagnosticsHub.StandardCollector.Service.exe
2312	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	2168	fxssvc.exe
Token: SeRestorePrivilege	3152	TieringEngineService.exe
Token: SeManageVolumePrivilege	3152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3512	AgentService.exe
Token: SeBackupPrivilege	3572	vssvc.exe
Token: SeRestorePrivilege	3572	vssvc.exe
Token: SeAuditPrivilege	3572	vssvc.exe
Token: SeBackupPrivilege	2900	wbengine.exe
Token: SeRestorePrivilege	2900	wbengine.exe
Token: SeSecurityPrivilege	2900	wbengine.exe
Token: 33	4736	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeDebugPrivilege	1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1576	2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2312	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2240	4736	SearchIndexer.exe	110
PID 4736 wrote to memory of 1216	4736	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5667a898f83245aa0ebd02744cb69208_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5064

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4640

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3912

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3684

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2240
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6b3adbcb69cdee02fc303052040a80b7396a83e5cbb0ccedcadb5d86018b624f
MD5 ec93905fce427f8a52abd1c7959149ea
SHA1 a51b7b5eaef1bbb7154b420053e5c6b9cbc48c00
SHA512 7d01011f545b11d5b4da4bc1caf10f47cf2f788d163eafa72f70f6ab5e8db76d88423b92cd8f3e842048a14e7dc3761fd3ee16a2c2e8bac27da61b4b94970f76
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuQ/lFTjN4:u3q6HjBaLm
TLSH
T14DD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2674b6cd62c45ee008e7c6e36d5e1a8d7569515acc44816817517c60fd249fdd
MD5 c8c0a0fc2549fa0ab6323288b5634e15
SHA1 4e77586c233501aee66d7527444a3f72ac51d2e0
SHA512 10061916aa983532cdc1264136c15425045c0a407ee606f64c55aefce47f39a0ed1a68b32a7b13ea111f535cdaa34bbb637accd1a18ada21c26e937f459f1a45
SSDEEP 12288:31XLsswWkxy2lRq2czA5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:lXYfDtczAJnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a373e0268a013275a293adc69246c0ab783637bd63d2038fa8ba404f67a508cd
MD5 bf8db2ae5bbccc88dfc51cb299c21ee3
SHA1 b24724ccd15e1e810dfcae482e149401ce8bc8e5
SHA512 451683adcc74bee9f8a678c897d1a5ebe7306cf284db6e8e067df2bac9bf91c077348ffa015957355969a45b38074dc710764aef5d1782520d1ee3f8245467cc
SSDEEP 24576:G0Le5ji0hmxLrM2nQ/tbw/2Mkjy6Fr7g0oQ:GPji0AlvQ/lFTjN4
TLSH
T135859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 11c41f91cf102c79ccff565c499dfac0bc4270fb47f442a9df61317743846734
MD5 9236cf46b0ac8a2432d9fcb6b36f8e01
SHA1 294b0a44d96cce4064fb1b3d11a690f9a327ce8d
SHA512 c50bf25164cf3761193e433a50c3b21f76a736234633551f120388abc9e9d2f9689c1f44fd47cbde7a42100f6da355373306a41986ed7a23ec9a782ce592ac98
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyugnQ/tbw/2Mkjy6Fr7g0o7:Y/ezSC6vUzPvxHjyDQ/lFTjN4
TLSH
T147755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b46a44343785904c286a9aeefca059d2a55023bf87f7d41e30ae34033c9adf66
MD5 79052b87f40b1737675512d44a2df261
SHA1 88ca808022049c19f0898b8282cd378bc8fbd6a9
SHA512 1bc1568d2d2c2695753c39f60ed20f93b8532f635fbb8d715b38dd72679db8c03c798e82ebc7e452ba6c2f9dcd5b0341576b89d5b0b82c4884328b890af54d68
SSDEEP 24576:tVbqPb88hv/l+6lnQ/tbw/2Mkjy6Fr7g0o/:tVO88hXl+KQ/lFTjN4
TLSH
T1A2559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ba65451f6c3e5c1c992212a9ef6e9ebf882d92a241422379b673e78f64f17025
MD5 9672cffbaef78004239b0e09b663a763
SHA1 3192e0ca214062f78c9bcc719e50204441b2410c
SHA512 e747d5a101637b28b9010246882304e4aefab7325173b8872f2ed4c3befff21706c3461e052d5a0bd6bdebf7f62db13644d67fb856c02389c4175037306351d4
SSDEEP 12288:3zCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:3zCnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1FE5523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 53c97652cba121743fa5a8e7e40f83bc716d4a5ab1c7a18fd2683d6ba697adeb
MD5 b91602773d52ea47b310d70617c10d31
SHA1 76a3ddaceaca562d4004085cd89e473a8d2d41c1
SHA512 d7819945bb5679a4499210e848416ebda255e619a2d493d02041cdc741d97c62b12af5c018e74c47ae5b16d72e6a20847aac1cf3efe726d470a1072023c72281
SSDEEP 12288:seBNUbTVO86UtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:sJIUNnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1FC75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 035e5d7a59216b03fcf58e3b15a3d3417fedd5035ed14cd19679b31e832a2ccf
MD5 1d9c59956f930a4cb7f390976b9c0b89
SHA1 3dda86b55d9edbcbaad32a00704b5ccbc43c9710
SHA512 36d686312fd2a2ad9696eb0a4953155fbaaa9260589e12b3ac5e0cbd546877c17837deead1e72400a57323230b65b9c1a8e689881fdac555569b2ceb22088d25
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:TQvGAdlCEL8c/yRNw5CjLm
TLSH
T16F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 980684e28b2cf3ea8b4f5a47fdb6a59eb5332da6de6efa4ad7f72ca7598c2268
MD5 52802cf2b794a1033067d4556d8502b5
SHA1 b6e6d5dd674b65e06703a9ff5d3f98b1ebd00c74
SHA512 398cd35524eea5d4361ec3b040f9688086d7961c47f5b85b124d4536f4e621ddfbe54929d484eddd5e6e0ef955230c98974cf7e54ec96f316beaf8715fe4b6da
SSDEEP 12288:VAwSfxL/2Dc39DLLmt0LDQewsAj/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgo:2QewsAjfnQ/tbw/2Mkjy6Fr7g0om
TLSH
T15775E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 644a43e5e04ea2f112735b757d5b28ff7ea27ec2e7bc5b0f60801aa23432cfd0
MD5 dcea27ca5d9346aaade9d4039b0b9d8b
SHA1 8bd0ef9df3acbe039b5a5d6b87a1bdccb826cdc5
SHA512 b0144f495f00f08edd8a9470f7f2bd2f39515867339dd5785e566e36ec5af295ab75d8c505f2a358b469271a3d342b32d785c4f0fe80633569ae06ce0501e0cb
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8L:cUEtQevvqc2W1cpV2EI32
TLSH
T149474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3f6b8e5aaef124ef185c73bda3e17b1c4698d7b870810976af4dc1a97533d770
MD5 e8ad4ef497b33e8d6dcd666e09ac3e5c
SHA1 47dcedf4e170ee8ca2a2b8a8483246f976bd7224
SHA512 2b849b0777961e6d6db717b565293c6b9d22780cf904ce2f4fd824dbb8188159da048318e098821d9421ff38b544d5515452ee68632c4da638515bd4424a8bf5
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/z/Q/lFTjN4:boqtVjnm3Lm
TLSH
T16ED58D0976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dd0299715da4e392d6ac0469d80d43041fd1e725597b1d422f30ee12ef1b5d40
MD5 0f91a6dfab58ca58168b76c87ed091ea
SHA1 c41698fb447acee9e037a4e181d715b6d1495643
SHA512 ce7efd6b4186c40d3d17e91af71dd18aadc6ce0e6a7a9f9c28629e415bbfe9351f447f7790e35d1ccde2e62551ba76cbb9b330750bf53a6eede08dc78821d261
SSDEEP 24576:9AhGLJIFoiwtA5l7S53knQ/tbw/2Mkjy6Fr7g0oH:9AMyFoiq50Q/lFTjN4
TLSH
T1C935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 08be81f230b7c1030b88127638b43f76820accd8b1e2d92f4b308b81d85c32e6
MD5 f99a1f77f8b11a3547c630f8e733c2e6
SHA1 52b1e698697472f2093584a2b41b4a8d0266f819
SHA512 63c5a5be43edf8eacaaf8f537d849482d28d3fbe3e88cdf46e2f2409be14eeb2b85aff7fd8a7b3ba816792437911cbbbb466722f3220283501b22d99fc084684
SSDEEP 12288:omw5HEjsChN2BFgl0WDm+CgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMG:FwuHOWjnQ/tbw/2Mkjy6Fr7g0or
TLSH
T15665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9a6f2c7c295260ffc77167b7598b1e2d9129c1b3a8205ccd32f52e40aad308c1
MD5 d95a08cfd808d67fde628ac1d25935c6
SHA1 8cb6086622a8820998d01ef669bae731f08854aa
SHA512 694882e8a0110c0c668536ac861a54e733c0c4f90db1b56a21dcd311e5555169f24bb42860675f18e364da46f9012291d170ec0d48a202b6930be20b55707bd9
SSDEEP 12288:xXZ1IyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:5ZuenQ/tbw/2Mkjy6Fr7g0oC
TLSH
T18655126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7d6d649862f15f9b2b1f93e37cf8fb2d1ac06fd2cbd6743267dc07d18dc783ff
MD5 423c8a2c2f2fc25869e7f53c1ee2faf1
SHA1 cbf0d71a029768beb13ec76bef0f2fcebd228073
SHA512 69066fc205ffa92957766d286e9510798d465f1b25b14018abe156b006696c41a55b23321de0ec871b87d2ee9ebd563880347c53528eb3197d58817a61ad4fab
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:pQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T1F1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f19c20d5ecd7fc19d540c411d4a290f70fcc7afd503bd9b7e565defe05828117
MD5 09c6841098e597fff61f7b445b145152
SHA1 f4ecd52274f4698c092d8c1d77fa688f97379d9e
SHA512 addb3c03fb652a5217400cb64ac94f3a18433f7218c4b74397b289bb713c23fc7a17a1f5a69ac40c003e4f1e6dd8dc59372e2429e8bb5d317644960612c2d9c5
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:JQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T188667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 74306edfcc82a83ec5584398e9e4c45b3870dc70ae4b0d4677347546b95466dc
MD5 1c78e25e07c976f84e6aedf41206c719
SHA1 2c1757b56bbec5500701c9d0b772827e47c07a82
SHA512 a0d950b51dd6bfd1811c03b8fc645e36559a44a1ecb9ba0061fb15577f0a55b6650debfcc977319cb92beeb93341c2bc7b7f0cbdf952493c23855b4e85b32d26
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0unQ/tbw/2Mkjy6J:D68Qg55nhheWu7PNU3/vQ/lFTjN4
TLSH
T1DEB55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b76a1c255ad68b402da3a232884d0f2e3e392cae2728936103c9d69b83f8533a
MD5 18bab8a8a2dc3691bdbc74a7c4424644
SHA1 2c53985b4688c94543ad8be0842a8edef3b0f167
SHA512 87116e37e24941865d8bd0dadcfd97ec1ae10235a2e9aad8ed3ccacb90f08c968f4289973fb8b79536449529127f137c7a306f6a9844ddeba6d58695fae0d314
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:sy5112gYy5azzVvL69nLKnhZNLm
TLSH
T147167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e1816fb7ce92588e106463542bb90a1aab01bc00b451c05a1838e9f89216687b
MD5 503cf1446012bc00f6e5e39eaf2690e6
SHA1 80fb7409a24bc426d5e65f172b543556bb3f94f3
SHA512 6a1eca68a8569de83ac216a46c23af6d5d0062a752362fd3280d8928720fb31fbcec9f3b2dbb9f310705d3d3846e12d0336178f6c6660938ff20b83d2de994ba
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZQ/lFTjN4:8u6JmVxd2dOLm
TLSH
T18DD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 901928acb50166b94f4da7025e4f2417a89ffc9761453e24a21e9d6a6693548c
MD5 567146d752e7f11e7d8c1e2dd7044db9
SHA1 e0496c33b751214f689bb86c479e06508953b52d
SHA512 b466589eedf58ffb7b91abe752ab9aa7154a74405fb29f6b8ba0fe319f35d2d5c28314708ac2ed39e760a720bebf462b604ddb5ea499944fead0057bc446a00b
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4xtQ/lFTjN4:/mifPbR3Lm
TLSH
T10EB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 77eea8fdee23154a4e9e942ee2bc9531eeaf15b6bc1e11cd6793d1763c7d9c3f
MD5 c04287df87aca674009e0a571ecbfc39
SHA1 5266799a2a4752830fb2ecd80008b936f7deb7b0
SHA512 640d3c4b15d13958864acdceee8969d8841024f95f953b8bfe91e18fb1de5a23545cdecaf6f52a564a04f90a835829bf332359ddc6a49bb7c4856c9933faac86
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqeQ/lFTjN4:I5dKTi615Lm
TLSH
T1B0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5acfde6def03e1f918a98d4d9f169b2d8f19f72b2c8678712bfe276a58026447
MD5 2cde96132a0714160312605fd24c6ba6
SHA1 d59d45eeeac8c5d0d6930be5994d671d54bd33b7
SHA512 8f7b108849a21a146571be816effb2445e3e7b5fc595411f855900f4a30857d8b2f97b6f86bead1526487e4a02bd1df39acbf95f999bb2fc807b1643971078d5
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wJQ/lFTjN4:7X2iyphrLm
TLSH
T1F595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b71675787976fe5563508eb234c8976f74bbc65aa7a39b6fcd617abbd2f6721a
MD5 dec783d6e4791e8cad0b9f0ae7038bef
SHA1 caad7d60671e09cecd4664817632bdb2f37234dc
SHA512 9f19155f6ddd67ffbb8e4433c7c397f498953a349c8fa3ba10640a783483f00492320ebcc9ee239480e60c62d7446577733b0cc6b783ed81d360aee44f70ea92
SSDEEP 12288:HKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:HKnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1035523697964F98BFB1706F14C828182A77F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c4987ce0431b39ff1c154a089eca164831db50091289e331822397c91f477079
MD5 1c93c2d77c5510cb6a921dfe6700601a
SHA1 f48be55497f2fe138abb78c2f6c259c5cf5c9e92
SHA512 b5a158b8eecd53351a0c06bb7d75962517da59bd302f3196dc431c2aa467488570090bb76105ed905b94b6aa495fe3e681aeb98b6950e903570ebbfb4d78f9d4
SSDEEP 12288:WrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:WbnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1A65523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7befec2ded59789bf99e153d4a799e0aaa69e3023741451354e9d1b7354d3b80
MD5 4115512c0434988734aa6a9deebe3ab8
SHA1 2d659d34eb97a8a9e5ff5c91bbb8c7652be8a869
SHA512 1203b1f8da5bb27a1cea0b403b11b8ee65dcb8777fce38ead87c3caa3fec27dabd92b029fcb80a81f16094e59560ae5fcd1ef5b51a4be39ec252c456d4b670d4
SSDEEP 12288:RVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:R1nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1395523697965F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 beb8019058441cc8b2eb15b88ba03e4e623059fd7e02b6969526a797edc75627
MD5 6fc8d73f504a701cb04cdc78f2f53bfb
SHA1 ff104a174e932f24248b2177ea546f0e6734e6dc
SHA512 6db8ebaf0ce934ee7de4cfaacb1df4b037d2c445012fa2f283388fe7e14932fb6d60761bc157e24c09bae20a74b16c8f0f2df694a0c3dee3cc05661046cde214
SSDEEP 12288:NVkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:8nQ/tbw/2Mkjy6Fr7g0om
TLSH
T11E5523693A69F4C7FE2742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cb3f2d348987c9bfce712ef11983dc58b0fef4bfc15ef5560d70bd9619c8c418
MD5 0a61a6c893d98796d0d3b6c09f52b929
SHA1 86c97ab3ef322c5e2aa37e4ade0be7be70418259
SHA512 5d7848ebc821e89eecc930dea163fbd143ad74070def94fa99718c971cf615120cf30f1168e0dd4190cc5ddcf06801360089a9c20727c462d28213887f45b27c
SSDEEP 12288:D8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:D8nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1995523697964F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b1ca623f4755e877368ea263a52fd8461239ec119a77e7c3e35aca2772754b40
MD5 56f1828d6da63663c600f31343e6860b
SHA1 8fb1ae9ada0f7358d2e4703e18521dfaedd92a92
SHA512 a44f03d0e488f33cdfa2b30c62e0ae062cfaf0ea545f642c69a60b9bfeb058cb9729631e6ebc86ec0f6315ebfbb00c06023d9c90d50f028da252ca1be6808530
SSDEEP 12288:inGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:iHnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1925523697964F98BFB1B06F14C828186973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bd0d8bae22869587e362613be696f2c41af5383e7bdbb43831b1f3fe850eddda
MD5 598ecc11fcb403d96917d0dfdb869991
SHA1 6dd1ca816e434f1c806835e98f76b12b36195a97
SHA512 065da8da5513aa3200f7fe8c20f4a1b9b1f0028b164e376c4ddf160456c87e95313202dec05757c919198a8f36fd668222127b6947d45ee213c0e65a739cd8a4
SSDEEP 12288:uDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:uznQ/tbw/2Mkjy6Fr7g0oy
TLSH
T18F5523797964F98BFB1706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 29d2dfbc8d5a969473509b82a91334d84deb86876849df7c50f5eb859c1ae53a
MD5 f1e60e1b82adf60b617f3f7b1be5d912
SHA1 6d891dd3362ed08221686e064e1d62dfc1838a7b
SHA512 b7d42c6575928884782d0228958eb35db888793bf6d3b77980d8d52cf666dcd629dc66a391e109b4e6c1b396580c06c6072fcefcfb199bb8ba77a281a93f12e4
SSDEEP 12288:3iZwbDzzFEoS2cPvyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:yZM3zFVSO7nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1D37501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a1d1e4fc85bb77a286c936ee4810191236775359108358f5fe8aeaacc82e60f5
MD5 8c087862af055e942f15a7b9c83549db
SHA1 fa8f6d228ff01c729ba0c9db54d1edd4dd8fabb1
SHA512 4640901a0b913e1064ef7209c270645139ef1cf602d75dd9f414d9522ca26d12b319a44b2b6bdd5c5943eff6f191ca1e7c50392730fea3b59306b8704d1cb8fc
SSDEEP 12288:fOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:fOnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T18A5523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 574e4d46f6fb55d431b607bb1cb2d9ae4dabb7992ac8d9ec3290f97b74aa6238
MD5 a0f82387f44dae3322d1a3adc0e2382b
SHA1 8c7a0df0fa4a63588fd0b34047f06cc378cbcd18
SHA512 7dd37130515dcc3174e3bbaccd3299f3958185580c3cfb59fce8b7d6e632762e65ce5735bd2189bb655e19db5a2f9454d9679d94c2be69dd4a35847e93032235
SSDEEP 12288:pyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:pynQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1A55523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7471d217a02cdbcab1fd24d06b21d7fa7e52232c12f85cb8c54e2a472f4181ee
MD5 afc236c7f50f1fc344b6b275e055b3eb
SHA1 6121a7201b599202ca4df23906bd9b05449439b6
SHA512 6d89ae63f69c529cd5b9084558cae9cbc2fff35ad8e30fb7f75150347852fec50e939d127ca396c5233478a04e996d05057dfa5b7bcee9c2decf464f067de29a
SSDEEP 12288:byPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:WzyPnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T18965021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a83bdf467cbcbfda9fe478d5eca490c9f425e8ed78049198fa77805c0957ee9f
MD5 8952c4d27c817da002cd6ab1bfe81bba
SHA1 2d5adff7ba7cd9526e549862ddabad613aa44f91
SHA512 e2d5c8f036446efa228223a77c2475f7c1181de0c7d07140ddf7af5f428ff49e483477737a9d66802bc8baf89f343271026d00a0d11eb033cfd9fd973fa621aa
SSDEEP 12288:0OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:0OnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1045523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e0e223945a7ef8a7d017365e472c276aadce928a67b1e20dba88962569a9a475
MD5 b37ee04d38a886f107c2fc333d24e86f
SHA1 aaa89d90776603fb14ffc6aec7dae7bc3bb5f27d
SHA512 e7b990b09f45246a1eec9568273d5ac506274a722d17d2a52b3e9085398d9686568a38b5d7fa0066229d649bb15c69afb66b3c1995a5675f48a8a863cefb7c7b
SSDEEP 12288:QOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:QOnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1245523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5bc490531e6967ae2a5c94c6889100a4f49d30b7b46674228a9bc9256799b751
MD5 69ff68dd32f5d4e5ddc462bb1f4ef76f
SHA1 25746329b6e2b6af74946d9126a6070f8d83d163
SHA512 d7baa580ab6ef2b94880316492ad7dfa068bd965a1b47aa022b633a137ceda943a279278eb3c02fef72c18be09b7df2dd5962723f5d352d21cc1ec55baaa1ca6
SSDEEP 12288:VyPz5L8vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:8zyPnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T15C65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 70dc4f0d8dcfcb85b84ac02123f6f02cc5fb5be91bbcbdba3edd085c03a942ae
MD5 50495e233377b22dbdcb66652c9b8df9
SHA1 8594823eee5f69a44841bd60e5579bc8eb249983
SHA512 a4150a966fc13723ad77d6b47815701ecb191914184b7155131247b4502e30775e72591e475a3ce5601bde2054df5a78a9725c32ebbbfcfdc47bcf0bc337ca6f
SSDEEP 24576:icP4mcvIjkGOxhKP2l71nNKbrh/8KBGnQ/tbw/2Mkjy6Fr7g0oL:NP4m4IpOO67W8KQQ/lFTjN4
TLSH
T10E65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f715678c4ca43a3deae586a4c3495735bd979d0afa4f98d297e719d48e61a63c
MD5 2b6e8cdeb09c9601b5d082f7d5680dc5
SHA1 2df7ff3ad3a108ecd2c7f4e86dc566d3b6d8667d
SHA512 82882b63db52abd35c2e5047bbf68599a44c279124f25d278d4bff3aea8ee3c92806ac321fc7a5ca1af43afa994cc1d11bcb0ead1a322d38c964dba9a71d9d32
SSDEEP 12288:YssfeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:2enQ/tbw/2Mkjy6Fr7g0ot
TLSH
T16265F119E29852E9D12E5275CB828641B3373C9597E1D3CB67C0F53E0F3A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b13dc690a5e817d61577bf40bbeb9a80003dc89db510e40868e73abac04dec4c
MD5 dfa10555e83384bb89653053c30e7cb6
SHA1 6875c945e98be37b08c0cb958b7e1ff885368405
SHA512 17b11f8af1de88d3a1c23ac7af0191902bcd18a57e566f7473c745af0f33d5bb16c606338472d1fd36bffd2287dd9a01115c7f138c6b160d2a62b86f88742168
SSDEEP 12288:v+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:v+nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1085523696668F94BFA3B06F05882C151673F0EC5BF90D38FBB08222D967C3D41EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8a3100c9b57abfdbcd611d988244ffb39d06bf465b11cc100a303a3cdb32d915
MD5 f7d96798a732e47a037ba1143e5dfb25
SHA1 f73046d881292c9162b57f07e7cc28c0cb91ec08
SHA512 937e0f1edb270cc71928702b1ee0393097f350d7742d85784291ea9055baaaaf3a45c64f96879a62dc3d7de19f071ae3cd1565cc7687e4ac4374bd2a6584cf5a
SSDEEP 49152:Va0h2GEkuAe73q3pp46zwwQ8Q/lFTjN4:Va0hNYG4Jw8Lm
TLSH
T15F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2a0eb0c8a7da68dadbee8407607dd8b896c29edbb7d7c938dca1bd0edb4561e3
MD5 a09d694b724bd7ac0e906ec4ffc3664c
SHA1 b59777edb8963925a47c13dbce7bff3ad9f003da
SHA512 3a927914f4d0ee5819469de105c5033282e618c944a824cc9f99f0b92e9283d9b6a089d04b099f71650531a30cd5e9687f801b07322632e892069d28be94fe8e
SSDEEP 12288:YhbHjfX7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:YhbHjPrnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T16455027E26AC30DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6a577aa00c92fbf2b0dc241e5368ed1aff6371df700dcab4b6ae1c8a672cb210
MD5 6a5cb19f771253fffafb255dace8c564
SHA1 8fac668adf588718f43765e66ccebd0f1ebee865
SHA512 da781624124b5ac13fab2793c09a5b43e306375a9580696d6ebeadd600c1060ea471802ce6712dadb758053bae4bb404112be34debda69c985cd1d36b102d736
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/jnQ/tbw/2Mkjy6Fr7g0oU:bIgnaTk46pBR/jQ/lFTjN4
TLSH
T10945BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f879ef53c3fb5c25af56e3dfe44a0673cd19973c8ae75a0df282f3072d801be5
MD5 31de906085c2236388825d6041cd7234
SHA1 68ebd42a1cc58c010b56e468e887e14485941e5e
SHA512 81481652c3ca0acd8986bc6db0f5e6b1ddfee449484e8e6da501ec01d2dc0ede0a100c0448473c54ffc4f36c5e26d80f3fd8793e42b52ebbd8b8c27ef28d3bb4
SSDEEP 12288:yiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:yinQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1A95523696614F98BFA2B06F54C838546673B0EC17F91A3CF7B48212D967D3D41AF6380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0a66028ba3d7184bfad8e0604f02095b04b5faba582b0e22fed89f34862304f5
MD5 d9c4d059a54855d3891779a50b0eaf0f
SHA1 39b715897fdd123f2f573a2cc3f46ab8e75f7a5f
SHA512 d8d015ef135c66316ff1d860a552f6f99ab824bebbf2248bfb41b4b73256aec137a52e663dd4d117afc91f9a51d1f202ba9fb4cb0d9470e698ce3b5243a6dbe4
SSDEEP 12288:yOb4A4LWOsvAYFT5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:jwL3UTJnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T17E75F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 41f548ffa3c5ae8c5c2233f4a2e493d5ddeb89d53be111425b26c3e878e60b4a
MD5 cfdc844c7bafe2e746a4b8ed5778fb2b
SHA1 f286a64a898edae2dbd421f02339cc7ffd32f0c5
SHA512 5b815e3435121a41f32518f2d4e94f8dae09734293040d9aaadc650c2c20e53c4ad36eab3c28c1453ce6693801f78be70063596a15945fedb23332475fa7328b
SSDEEP 12288:KpFtCONGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:3OtnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T18255022D36EC60E6E53A527C89838249D37278921B6253DF0780817E5F7BBF81C7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 489b1f80235eb10fe2b1df2f5b02488a86228b581da6d5f50aec894838ceb667
MD5 f53dc515a22ed9baab8b056aa4e78ebd
SHA1 c91de1a9b2aa2a50a2fc29df58954a11367566ca
SHA512 391412e564f06a22b163f9d4abefb1c2e106176cbc16d5dfac0f6523905fc474e5ae205ab51d098ee4e589983da2bd9ebae7e6c35c4e5ed7ab1ca47edecd20bc
SSDEEP 24576:l7NM9YqZqmWMUkPjZM48Mv6bEhsOnQ/tbw/2Mkjy6Fr7g0ov:l7cBWMpPjN8DbEhLQ/lFTjN4
TLSH
T1C0659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 48f4a6be2715a98427530345759244797a578cecb001764ad07c781803e1c507
MD5 37942ed2c6192224e69e6e7d52483c03
SHA1 0c6fcb0e5f58a637883471de649c609ca9e91eb6
SHA512 c40d8311c9ea193c2013542af331d7ece3e9058fd5b364def96ed4ddbd019ce7855221df686fb1628cd522de9deb60b07ca55afebe85e829ec6b7a692149915f
SSDEEP 24576:UW6BApg2YuyuNDYTabvcdvNYf8km1YnQ/tbw/2Mkjy6Fr7g0oA:UF2YuHNETovAvNYf8kmuQ/lFTjN4
TLSH
T1AE857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c08f0a35eca471de733973d0ce591203545efa3efd63b38d4f5ab45b04b82581
MD5 e1cc1f46830d7ff2d6733f19f6d23c16
SHA1 b07a303cd6ab17771ff810c16d366d83a4de6820
SHA512 dc7bb17000b50f89a8476081186769e54735ce5c234c1a851f1ff83fda95def686172fecb1319a146be832b8edaedee27cf783b8666ef8df76aee897c20c710c
SSDEEP 24576:ZAFs06+Omlf3NXEbToRnQ/tbw/2Mkjy6Fr7g0ob:eFs060lVXucQ/lFTjN4
TLSH
T15F65AF2F66AC00D5D07ED17D8997C91AF7B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d32b2987ed3354a707a6d44b34f4ade71595b90ef7d9c1c20df09b4a8fa503d8
MD5 ac358d1f54ff4c81e37559835f48e440
SHA1 1a6181c504624064d251c921134960f86044a098
SHA512 ad200a809599b8c2a7bdcbe79678aaf5d2369a6a145d0e69188019fa819eb76de5df5cfe6ee8135d8b8ec381a88234729ce0f410664217f8a3383892a2ed9185
SSDEEP 12288:wCJnJ5D3VkrqzxuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:FJnJ5D3WacnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T10375D03DD2A810E9D477C2B4819A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1a5a42d888f3c5449ef43a923d4bb3e1da70060b172ff019282534a7b49aac9a
MD5 30e81d27defa0a2862a9433a20a719dd
SHA1 322eb33dbad7ecf058b37ec405850994e6873dae
SHA512 1de8d4910aefecb441164d64a46f4e9dc05889461e7f68a5b9591d82f5c45f8cb0618e7eed078f9d6c6388350d70baf63bc9a98fa7ff05ba4d5f067eafae24a6
SSDEEP 24576:wEPghm6/7IIXdwcXrif7qQncjlP65i3VujnQ/tbw/2Mkjy6Fr7g0os:Pg06DIKdwc+eQnSt65aVKQ/lFTjN4
TLSH
T15E955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 569c89892aeaa3bf56e211e039ab3a09b6257a0985042242bff726359ddb725d
MD5 be575fca329162a299dbc424b01d605b
SHA1 8dd8d454ecc257bb271d9a55e1513bc6c29f6444
SHA512 8ba7687115594ec2a25b984b5de724c0dc626e72b8f9281623c4c101b46128b73628c9793ab4ea712fea0444e9221ba8fae9ad4b0e0ed36ab413e42c2c4589a3
SSDEEP 12288:GEP3RSgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:FSAnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1B655126D37ACB0EAE52A917D84918545D373F4A12B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 5cdc60e025728a9005f9181a1938bc063830a5a8eccef31ba80b77c22225bb4d
MD5 b529db1c591242194bdbe09cd0b068d4
SHA1 a741add242650bff6b66066d70dd10b216f54e3f
SHA512 cfc7a81ab8843284b41222e17715196727c5398ef87b119aaf733a0445964215a30ed22eb70421b95976e2e51c3f0beeb3b78e15d20e31eeaa5b80b5702d0cdf
SSDEEP 12288:YjkyrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:YIybnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1166512182398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 42a677b04ef0c9a119a54347a3031e8d25a3ca78ff24647883379ba01ab1b07e
MD5 75022d52d368021e198e3d292d5e69a6
SHA1 69e26c8084fae3ba3784bccd06dd72688d4c1dc1
SHA512 23fa49a01c65a078988facdf38cfd6df059aee8ccfc7449df655bbb2fffcbc875081bc9042353a73b7a9c89cd6a88c533f23b42e67c38f16551117c8384659d5
SSDEEP 12288:Q09GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:LdnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T14955236C2665F89BFE2706F448928542973B09C17F9163EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 540e6767298ef2f6af4ba77199f75e33fc33bfa698a25ea3d215f25cc53a819a
MD5 dd560825eeee92772fd9679f43caa2fa
SHA1 20bde0bdcd7a765413a372b1c11908f1eec44a0e
SHA512 3bbe1b4107afe8580557976d4b82e84b0995266c1e397b389d3e7558fade14c35fd2447059839a35d6cb970edae08c04a30fbb1585dd755591ea79cf080a63a8
SSDEEP 24576:HQ9MxZKdcz9dw3WnQ/tbw/2Mkjy6Fr7g0oN:HVKZWQ/lFTjN4
TLSH
T1A0558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 103d73424d06bdd50352592f9bc8643aaabe9e9877b5032f383271360cb3f6c2
MD5 2cccfe9cbcd85c60cbc9effd94df1ede
SHA1 8c322f0735cb1bdbc9b298301e1241c489e715c5
SHA512 0601f65f88831a5e19f50483b760225b4b26cde65696de78d8d55e4e86c36f0c6a1d8075ce0232b644624bfc369beafcb734e6d92d3ad60a5cdbd49025deeb79
SSDEEP 12288:0yoKo20Rple9p/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:0yocSApfnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1AE65E01FBB6D90A2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b3473b3fb31ca3f5f8229ab53c9d6fe56f131660f2e36b58cec792aba68d8c55
MD5 c0159e8fca9db8c2f18a235e69eecda4
SHA1 f1e76a54e728729b3ec0672e192173aa4cc980bf
SHA512 9bc2817d9d13def86a7a4795bd08849f4dada7c3e2a1a2daafe27645508b1f77181005c9c2f8e269f992605dd4873564ef6109bd378c9b511228b916de94d332
SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKfQ/lFTjN4:g0zuNI+Lm
TLSH
T1C5A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f3581a362988d47ce5472d6611be95b07da50423842639cf873bdd62d42e9935
MD5 127eb565fd91f42be180ebe404a58c75
SHA1 5c3e027a00a62270bf634b61a224d19000f9e727
SHA512 6c2a4afedd2b417844fca0f044f5cedca09816c2f4f834aabc84e9593df7f6594442430d522261664978ee3e22d88891ba4ed0809e0bca5da619b0e834a3f9a4
SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYtjMqbAnQ/tbw/2Mkjy6Fr7g0oQ:UTDxR+N5YzTfjMNQ/lFTjN4
TLSH
T17255B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 9ce9dbc144d244c3431d6340ec436f8d4949c7375f6828bdf378e35a4f5c966a
MD5 24abccad6234b704ee2f4e74811aa1f3
SHA1 4b6fa12727775b35115654489f9a8c601ba3d2ad
SHA512 e2d7207e0c1a3bdb16fece129619e64c7a4e16240c502dce081132331f1c5f75d35ade0c009f4a0f4f5decb769cd227ba394ee7ff11d9af41e89508ef3c8e9c5
SSDEEP 24576:BTMdOz0FFS+1mSLEnQ/tbw/2Mkjy6Fr7g0oP:r0K+1mSLEQ/lFTjN4
TLSH
T1F475E17E636D14E5E53BC27D9A438906E67334A20321A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 4403cc980a3c705f7815486050d36ef8ac0aa44addbf5dbdb25a967bfa494caa
MD5 347a25f80d679241fda0ec01efb88f8e
SHA1 3bf773bb91d8ae00979f1b635d761d3baf6bb595
SHA512 b6d53b5fa1c5f0d1f6351ba07c4449b871d98b0707a7afe6939a236775107cdb0d5518bd56662e6ff48a39271c34fbeea4f7252d6046c86af9d37454ce5eb581
SSDEEP 12288:r4T5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:WJnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T15655122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-120-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/208-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/208-276-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1108-283-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1216-353-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-372-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-367-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-368-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-369-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-370-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-371-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-373-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-374-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-375-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-376-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-349-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-352-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-377-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-351-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-354-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-350-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-364-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-363-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-362-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-361-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-360-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-359-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-358-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-357-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-356-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-355-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-365-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-366-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-388-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-387-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-386-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-385-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-384-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-383-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-382-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-381-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-380-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-379-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1216-378-0x00000283BA8F0000-0x00000283BA900000-memory.dmp

Download

memory/1576-0-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1576-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/1576-6-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1576-284-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/2168-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2168-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2312-16-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2312-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2312-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2312-347-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2472-268-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2472-76-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2472-70-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2760-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2760-269-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2760-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2900-280-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3152-277-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3512-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3532-65-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3532-63-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3532-53-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3532-59-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3572-279-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3804-278-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3860-272-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3912-275-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3912-115-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3912-109-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4032-93-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/4032-98-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/4032-271-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4220-274-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4404-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4404-346-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4544-86-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4544-270-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4544-80-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4640-348-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4640-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4684-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4684-31-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4684-37-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4684-413-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-166-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4736-184-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4736-282-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4736-447-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4736-150-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5092-446-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/5092-281-0x0000000140000000-0x0000000140171000-memory.dmp

Download