5e0fc8d1d461c5fdb7dda08c0ff43026baf7ff57f57f5f11cda71527f58bccf1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 11.7MB
Sample260731-mx91ms1xes
SHA256 5e0fc8d1d461c5fdb7dda08c0ff43026baf7ff57f57f5f11cda71527f58bccf1
MD5 e1431bf818bdf2673062dc9b4cb026f9
SHA1 8a4b8849c4d08b4aa55799c67fa55ef14bbef9fa
SHA512 d986d35a83c4666814f2c60804dab5aa91adedf58d6194ec6643363e550c82de0a02099d283d40d0acf739abc2ddd8c851dda9b4138ec74cf11dede70d51fcef
SSDEEP 98304:BpfXgO9/D8Ysznw5nv9Klz2rEvEFLOAkGkzdnEVomFHKnPZwFRKIh:Bp4OBwnO2z2wMFLOyomFHKnPSDKI
TLSH
T1D4C6D342A9F8C484E495CC7EB5A2C5FAC6E2BFC04262424764F87E5BFA7335D1D06272
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3500	alg.exe
2428	DiagnosticsHub.StandardCollector.Service.exe
4080	fxssvc.exe
3384	elevation_service.exe
1992	elevation_service.exe
4836	maintenanceservice.exe
4476	msdtc.exe
3816	OSE.EXE
4840	PerceptionSimulationService.exe
3104	perfhost.exe
468	locator.exe
4352	SensorDataService.exe
2072	snmptrap.exe
1668	spectrum.exe
5104	ssh-agent.exe
1656	TieringEngineService.exe
4084	AgentService.exe
628	vds.exe
4260	vssvc.exe
3172	wbengine.exe
5080	WmiApSrv.exe
4512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\71617cf3a3ba122.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\ResetEnable.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\ResetEnable.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c80787a8da20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a6162a9da20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000569271a8da20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006590afa8da20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000409452a8da20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093a784a8da20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061e622a8da20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdd02ea8da20dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4080	fxssvc.exe
Token: SeRestorePrivilege	1656	TieringEngineService.exe
Token: SeManageVolumePrivilege	1656	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4084	AgentService.exe
Token: SeBackupPrivilege	4260	vssvc.exe
Token: SeRestorePrivilege	4260	vssvc.exe
Token: SeAuditPrivilege	4260	vssvc.exe
Token: SeBackupPrivilege	3172	wbengine.exe
Token: SeRestorePrivilege	3172	wbengine.exe
Token: SeSecurityPrivilege	3172	wbengine.exe
Token: 33	4512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeDebugPrivilege	4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3500	alg.exe
Token: SeDebugPrivilege	3500	alg.exe
Token: SeDebugPrivilege	3500	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4932	2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4000	4512	SearchIndexer.exe	111
PID 4512 wrote to memory of 1252	4512	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_e1431bf818bdf2673062dc9b4cb026f9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2984

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4476

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4352

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4000
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 22cc8804d8fcfe997b9c8af3d20cf972e7874ec1e7d6c23f44a810621226a6b2
MD5 428def4f018011cefa27c78ad888a650
SHA1 b7d97cf4adc660afac41b296d7ff30748e264394
SHA512 773744772dc3b5993f3a83ad3f91c52df90e66d0ac627523fc08f0d0f88d92d428021fcc35f873450ef65782276a1ee12b359733fbc02779b4419dc737dbd35b
SSDEEP 49152:Rb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnjXozsr8zlLwJIh:X3q60jBywFRKIh
TLSH
T124D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 be21f18e2ead4f6b08c0e2b53253ec104d3cbb7037dbb4c26df775a926747db9
MD5 fad87d6c23d4d04c80d63db720c8de94
SHA1 8b42623a9f215df67e4c8c21f1cd8f89d72b99b5
SHA512 42478aeed756b76efb7a023b873ec450d28866e685730b90c728caf69fbaa0f5c5a66f9ec5d7b59576f48b1328ade0ad653bffd2f4cfb562f45828e905c9be92
SSDEEP 12288:O1XLsswWkxy2lRq2czA8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:8XYfDtczA49Xozsr8zbhN6GwXOGIh4
TLSH
T18A850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 642180c19f2660d1286c3b8889b1357d60e1a2d400496f19f7293f09054fd5a4
MD5 0c3f129d007a35ba9c75236cb6a6c773
SHA1 3f1c7a9a688a5248fc9f14751d02462483f101f1
SHA512 9688d59b6127847de84f2b04452324c28f6401f3cfe85094a7949076bb23ba05d0470970748f0f747127c0433233943c2a32ed1c1a72d555becdcac58f71ae36
SSDEEP 24576:V0Le5ji0hmx3rM59Xozsr8zbhN6GwXOGIh4:VPji0AhUXozsr8zlLwJIh
TLSH
T1F5A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 497203c1d947b837095eada466ad62cc1a4984351179f0f93c6526e7d0f96e99
MD5 1be6bf52e325db66b5fe882ad59a9fc8
SHA1 e3e59516cd3fe6264c821f157a3f5dd063b05089
SHA512 2cebe852ce6e013e1ce0e1e7374d7e88792dd87fc6417cbfb82f7b9d1f85f6c1e2f28d969914870cdfa44fad8736d0e6ed0038e6fc55f35f93a7629743240d49
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWr6q8wyuD9Xozsr8zbhN6GwXOGIh4:n/ezSC6vUzPviHjywXozsr8zlLwJIh
TLSH
T1E0755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 68d4ab5e851296fe32ebfd8e08bc215805e09c1e3a0a1cd61598b440b9eda98f
MD5 a8045814104992659d40f657d4541e92
SHA1 659d95f2fa92e82d051f37f04879a526900aca37
SHA512 d4379ec82b1665a51ce03c517cd74b3ecc9b4c903254cc4bb7c32d2280e8952468d0a9d387c0ea984bf393e40ee3f9222102619d6f68e1209b9a1525768de935
SSDEEP 24576:eVbqPb88hv/l+bs9Xozsr8zbhN6GwXOGIh4:eVO88hXl+KXozsr8zlLwJIh
TLSH
T1D255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 84808d29202f725ea98e852c41952464a9e94b2e41dd54b3e16055af3eca30a0
MD5 9906223e7de01ebb8c216523ae729af5
SHA1 269ea2822364fae67b851c4e4e3850e94eb683e1
SHA512 b474c071597fe6c424c095dd6a55fc32101f2d98978a5f6ce14dab31c80653f5911664f208b1b12e223a893e116fe37e910a1f727326fcaf903368c5752b6758
SSDEEP 12288:PRPksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:PRd9Xozsr8zbhN6GwXOGIh4
TLSH
T1CD6523B7E691A442EF671F3139916AC4DEA7FD9E49811B8112382186CC7E476FE31332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ceee36f44c2ed15353118e2ca0268d38f13f8b88e73422de28cfac55d905dd49
MD5 31836b2cff81175fa70feaaa236e5066
SHA1 6de74c18de9e06568ce2265902284aa70f43d96b
SHA512 5663838917f8e90089b21571c2ecdc675370af9fb5542a5f6a2766c28f3cd8e238a6535bdc0c67b7e03a81d7bbb1ef37ce1d49d35e7df41b3ebb4f3f5186fcb2
SSDEEP 12288:VeBNUbTVO86U4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:VJIUU9Xozsr8zbhN6GwXOGIh4
TLSH
T19885DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 16ad3fc9b8740fbdb9a849379f695939254d3a7343a321c1504b1b7221b3c75a
MD5 a9e3069d3801b104f027e7be391ea5cc
SHA1 5ebddb0381e7bfad6e0d5b7125d4013a9e287efa
SHA512 70503e550ee94013f6fbe37d8b1d5671e75aaad4c4613232b0c28124dfab4b5050e35656342c0a40745f91ce1075ac1fa0fda4ddd72ecc3c6f6e29cbd3a5d631
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THJ:TQvGAdlCEL8c/RRNw5CNwFRKIh
TLSH
T136267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4feaac47a1cd187dc0af6781071cbaea76fe75c16b64bf60cc44d0aeeca3c0ff
MD5 c5e57dbef61498405e677d15dbcdf786
SHA1 4403644c9fa639e0d783ef4a4c6c9b2c461d0a94
SHA512 9b9bac1829b297243070f448d95e76d212e5fffa21cef019ecacfa48f55d7eee56f7ed657c49c45692a38b09cc79b7a4d9bd91bf80fb0fbfd0122e325e415fdc
SSDEEP 12288:qAwSfxL/2Dc3VDLLmt0LDQewsAjSksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:/4ewsAj29Xozsr8zbhN6GwXOGIh4
TLSH
T1BC85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5f78bc2ce1dba8798d099e67b2db847500d0306697ecb2135c89d16ef62c48cb
MD5 194cde1035e600982ea5fc36e16df6c4
SHA1 213efb5018381a53b01ea6680df5a6f063b71cf5
SHA512 15040188ce9f5e11e000b6b005a3014964286541602c7348c96c94b0f20f8aae852f66eafed7685ebe7ebafe70052ee664446daddefd7a00178e6a35e5393c5e
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH7DKI:UUEtQevvqc2W1cpV2RI327D
TLSH
T1C4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 efb4ba0130301708aed2e63ac05560d6b28151ef4fa057ec0e5a98b9b13f1bd9
MD5 1c60e9e985ed379ef47ac8f16359ffc7
SHA1 37e66e973cf31ed54db58c80ec4073853ada3fe3
SHA512 4b05655493a3e44ea8ececb3045a1e3901c3232a739a16346207f25e4c684b606a3d326dd714f04b5e058652e9220db94a1cbd22060f8f680b5b4c1c70097542
SSDEEP 49152:NCbRquA/m2yL5zifFiV+XenmE3/zkXozsr8zlLwJIh:qoqHVjnmJwFRKIh
TLSH
T163D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c8b1942343939a4d19aaf64f4d17cae15c3d98bef944ee576aed93cc5eb6ee83
MD5 b15859ad53c82eb8d2df9a71e6a71e9e
SHA1 36adf05b87f88f4872c0d0de3e9c5c87f87929d2
SHA512 c9f9a8b6ca6eae98f89d7f15eeefc7009b0e3b7c1adf49580e24fcd8afa6d2c631345f58be5e93cc7a46f90b3d43dbbc54d7cdaabecff94ca56801a19b6c1936
SSDEEP 24576:eAhGL2IFoiwtA5l7S53P9Xozsr8zbhN6GwXOGIh4:eAM1Foiq5lXozsr8zlLwJIh
TLSH
T1B5359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 1894507e009ab8cb9a873b2c586275540bb784c12ac513676a50d4e8800882df
MD5 2a9e79b970523f88b4afa7ae5380e74d
SHA1 c893dcfac408190f88866227f3ac7acfaa3bab6f
SHA512 1b7a47d4f66c6cd77bc053a754773e928a6138e6c4a4769e62b7fc1e06cdaed6e1f9cd198fe6eff2b9431234e01db8fae7a899e482bf69f250cdc38dfd4f8b1b
SSDEEP 12288:7mw5HEjsChNkBFgl0WDm+CFksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:awuVOWC9Xozsr8zbhN6GwXOGIh4
TLSH
T19E85F14A76A41CF9EA6786398597C535E7F3BC062A21CB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4a134a61f8ab5edf695c8ef3829fd7cc537e7e27ce9c38367e05c0b1554d1acd
MD5 1de8a2ba6199d8d28a3d5f99835c6783
SHA1 f91e58ea88adc54aebb66b60c335ba1713c2eef5
SHA512 3866d741ff1f00a8f876e825389208a55fde4893ad702b1e0fee3bce0721ba648f3b28ceba588cb5dcd14191b31ce1566ade0df55b8bef88f62ef16a365febbe
SSDEEP 12288:TZZ1IyCksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:lZuh9Xozsr8zbhN6GwXOGIh4
TLSH
T16D7512AB73E030F6E6A3573898E15A44D7B3B856577203CF1238025A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 11b350340e1958fe1c82cfba3e20d5d422255c03ec9c26c2b84362959fb95480
MD5 354854f397754ed17374969b5ce2d34e
SHA1 d8eda937515af068bdedcc17356e24076361e760
SHA512 8c2d7aa411d1b0a7ac97e9935776e62cafcc00eae9ef97bd07f3cdf0c4e59d65ed37dd53e25634a7dd8514d3dae8813152fbdc3e075bce94ef1bcedeefc436ea
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ut:XQRQyi36YOcPhLvw2gAf+PN3WwFRKIh
TLSH
T1D4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 835626ef0f0d443a657086e9f565649b7069e2b5d1e1bdecf04dba377277478e
MD5 81997e1cb50741efaac984a8bf0e74f6
SHA1 0a9328c217ed691e166bb0537f6f749aa9803549
SHA512 5c6553af536ba696423bbf7f4b6a71755d2bb65fcc974b8b6a228eeb1277a13a3940830a6ffaf4c5aeafcc4d120c9c03b9bf0e7871990019862a81fc94a1a4ab
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ut:0QRQyi36YOcPhLvw2gAf+PN3WwFRKIh
TLSH
T18F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a06658a38b6c953222e4341a2772540b6875dbb83a5fb3d599229f32f4cda95
MD5 d9b80d732d490151555ec712c07455b0
SHA1 484918a901cf202537fd1eb8861a56c64b4a26a1
SHA512 78160dfebdef681c5489db92dd55975222bacd21bb165bc4bf970bd22e4ec261e9fc38a2e779ec904c5898111a4741261b9ea9ef816b9603447d10b3fcfed8fc
SSDEEP 49152:C68Qg55nhceWu7PNU3/UXozsr8zlLwJIh:AthLRc/kwFRKIh
TLSH
T111B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a14be414ec8593432fa903193dcf625b1c5d840a2c6cfd496c1a543b8e05c16
MD5 2a063532a60f6cb64e8d3541cc49d57c
SHA1 7b7c0264805e05b47f11baa31c8a3adb8162040e
SHA512 03f486f0070e3768a0a909712d54f7769cc7fd4c8605bef2fdcdb2b27e5a45afacdff502ed986d73a2e2b4a51632fdd36bd3b219d2ec9d291bcb859dff710a4c
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99b:zy5112gYy5azzVva69nLKnhZ/wFRKIh
TLSH
T18A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e09d9c098ae967090263481d3c4a069cb51b4747f28b81064a48231683c1c1d8
MD5 ac2aa3001251046598a4b1bef6573616
SHA1 79f492f37b57a795f4d0ba0086528796dedb56d8
SHA512 b1c8ca5ba50fd0f1a1a9e9d8b06260b1dfda279d0bca37ed5b4c4a8eaf276bc30e714fd249c4e81a0623be92468aac94632cf72816fc728f87c4a3b7b74a3675
SSDEEP 49152:PB+taZ3usBWOBr4tEG20bqx0z+n217aau1glyXozsr8zlLwJIh:xu6JmUxd2d+wFRKIh
TLSH
T102D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3e130c0dee096d41658f9cd25145104dcacc0914c40183d552707b0eeda5562e
MD5 6aaa1ade7cb39965f23d08723b6192ea
SHA1 1ae5b764a2d755fcd8917cb01a15ed6bb4941f25
SHA512 acfeb500df463e639dd9417372eb784a81fa01566096284435a29e5f8c30e4144b89f6c218ce500d3943d12fb84b11d0a8c0fb2dd4e1a34291abee8d3ea7bd6a
SSDEEP 49152:31hpsNoJpF1A6BU44CwH7R4xuXozsr8zlLwJIh:3mifPkRJwFRKIh
TLSH
T1D8B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 37313ff2b876cf53a4a64e0ed192d6a5cc239dcebe295ee51cc54ce7a77475ee
MD5 f9c679a1525a68527f301480b54cf46e
SHA1 d6b019841c731e9baa5766daef95a108c77eb810
SHA512 b861f6c3e4061c078a9ec737ab79608b1472de6abfc1cc08aa33b3764d11876253b80160d5fb23b31823ade060286006184ea89a82a1027458eca58829561273
SSDEEP 49152:WSuZQIY0Be2KNRVtOnks6NMHqTXozsr8zlLwJIh:45dKvi61zwFRKIh
TLSH
T192C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e29acb7bb56d0c4382444096def2fac0fe2bb795d2a2d9cc83ebbb0f463e7dc6
MD5 709bab02a5f4a47e20c86fc0aef8a834
SHA1 3bbb60ff6f5afe7b09a61432f48faf4be80a7005
SHA512 4b6b7349c931a00ed45d922abbca84c89cb524272b0a28e38f345c34cd7ddb72fae68a39d58941f91ac28f276c4dc1194b34883f2da0ca9097fa45f8a3db9c21
SSDEEP 49152:UhtSn8EApI0figXgiDn0AP5wiXozsr8zlLwJIh:1X2iyphFwFRKIh
TLSH
T11095BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 14fcce7e6f70dd0328c6a34cb630e06741d7cb3126f09aa16e8afdaf9018d262
MD5 eaa622b68a6d9cd9600932d34eaebba5
SHA1 15683a31e1713b3ca22e560fad877c53bc165b91
SHA512 489138ab717e18a32c205cb51733b402c6626eb0d73ff7d2e706e4dca2edd858c5c4456c61cdb73e09e745b547be47ca0bcbd2d79ef98ddf4d83e1b0615c7e0e
SSDEEP 12288:vHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:vl9Xozsr8zbhN6GwXOGIh4
TLSH
T1946523B7F992A442FB575B32298116C4CAA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1f814cdf5745c9fa7f650d3395cfd5c5cf07519193be3295353776fbf1158df7
MD5 197fe0f052796cf3cf833de5b4b245e2
SHA1 d9932ef2dea12e64c050101c84417182542e906f
SHA512 b93f0903712ce2078be5b5fb0439251b5ef5ce837c61188524ce06f44f8e4d39dab96ba69282e0c023e60b3e1be5e1c92392ac66664d4f6e4b9e1c1e96d2ce1f
SSDEEP 12288:92ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:9a9Xozsr8zbhN6GwXOGIh4
TLSH
T12C6523B7F992A442EB575B32298116C4CEA7FD9FA9C20791333C1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 763b565b8e0d94438c3a21770d893433c335ea1e061dceec9cb855aff9240c8c
MD5 f9a9b9c8de335ba5643c7daeece9d568
SHA1 1a7fde7f95798944915738c3d02934d841da3b5f
SHA512 c15a54e6333fb9283fee2ffec692036fb2be8bc3c84e9175411977a2ec60c22c257b270becc4580db93f18e4c43700350e2cda768b77974e939f28e5163f6242
SSDEEP 12288:fQksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:f89Xozsr8zbhN6GwXOGIh4
TLSH
T11C6523B7F9A2A442EB575B32298116C4CDA7BD9FA9C20791333D1045DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e9af003faa4fe714b57e7db8bbb0bef76ee0731724b6b1453bcbefb20061cf1c
MD5 6c9fcbd91678534931614129a4ee3a84
SHA1 aeb7460be90817358e4237519d483be605026142
SHA512 9fa6b4f4051c3fc401fadfe2d0020ae6062866095ace6cc2ba32b5a0354fdefe057591aac079f967f839c8257c45ff6d8512ca2c89a295c80f839c067b2e0311
SSDEEP 12288:8VRksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:49Xozsr8zbhN6GwXOGIh4
TLSH
T11D6523A7F7A550C2EE639B3199915684DAF3FC9E9B5207CB233800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8d49928e03a6001a9d9d8ea68c4c2b473a1c1d564f9d2d78a615c8c3deeac04c
MD5 82dc39640462e4d48d3c9122c51a419a
SHA1 95288d4204b3e9efc42e18a1e29c135b73779aa9
SHA512 1f3204e54625b08541a11ae70b2312bcce8cc4ff4509d1cbb721f9a4ddc57ceefb8d0eb6bfd17fe277cae09b01ca2fe8d1ab68edcae986343091ebc1bdf33a9b
SSDEEP 12288:U5ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:UH9Xozsr8zbhN6GwXOGIh4
TLSH
T1286523B7F9A2A442EB575B32298116C4CDA7BD9FA9C20791333D1042DC7A87A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 291aee8ffc095a16b8b09b2cff803dc74fc07bc662fcbafc8626288d7a5285f6
MD5 089ccc8922334340fe399fbed1abcc80
SHA1 253cd01c16ce9b787c368274890561eecffd58c5
SHA512 cbcbc090ada2e4aa303b05659b3db42f6b3f3ff6a9a557bbcc387615707da0f1ad42ef959ac4a8f068c3671fc1068942dc85c0103e716646772236392a552dca
SSDEEP 12288:WqksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:W+9Xozsr8zbhN6GwXOGIh4
TLSH
T1706523B7F9A2A443EB575B31298116C4CAA7FD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 de5a594401f07bcced798a300faecaef7589d36cb9906c247f3a3b85a1f8657c
MD5 83e9494eaf8331d4ca775f14ce946a45
SHA1 bd77616a1c847fd1d7ae60758d056b736d955f41
SHA512 c903c8413cf7e7eaff864af8d5ea0c3834889055b8fc4e5f358210e110d7f9ecf43ffdab8f5a69f7c709fe1312efaf031374cd9d8bf1b537da635065a370ba72
SSDEEP 12288:TeksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:TS9Xozsr8zbhN6GwXOGIh4
TLSH
T1766523B7F992A442EB575B3129806AC4CEA7BD9F99C20791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 9bfbdf1f5cc27aef675486ff1b24d0fb50fbd7bf0b3ea17ba3d015c42d309832
MD5 96f42fc0b2a8c78427f55923eeb5191b
SHA1 543a981a6ba4d90995920b6c2989d7e01554b265
SHA512 7c4814afc923daf0048085449ede1559dbb6579abf76ef60aece5fc7e6996d1073911e0d654bd9af4b59d7bef836c4d9f71a5b609025f0381766ac571635d055
SSDEEP 12288:AiZwbWzzFEoS2cPvyWksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:DZMWzFVSO69Xozsr8zbhN6GwXOGIh4
TLSH
T17D8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 750b0f709e261b38258b37b05ee6a1f7523a00048bff6cc10398a7b9cb1ad3d9
MD5 40ef9d7e56b858f7fdc4593f08c700df
SHA1 d77437056d113769d503151e61861bc1cbb1498b
SHA512 fedd1ccaf9ccb577b3326d0d99e4d5fce4b29d26f669f90c357e5c05daf15bfe96411b648bc91293eb3fe8da0626868baaef9010fe62a536391889cdc9176324
SSDEEP 12288:BTksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:BR9Xozsr8zbhN6GwXOGIh4
TLSH
T13D6523B7F992A442EB571B31298116C4CEA7FD9FA9C20781333D1045DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 98a400b13a4b4e70d5220513b0e1f3f294242cec6ace807ae9f2f128aa5a6f99
MD5 f1ef0d627cd0ea44b78443781be5dc30
SHA1 c40476853f1a2d4007a242461d3de1fa9d397a02
SHA512 b59773e9e1304289ad73fb48422c9185c596e8b00b01f5c8ad641677d6fb376dd8c0bfea6709e72f7292ebcaf4fde39e8a11a846c9cbed20161c6e6e0a7c9755
SSDEEP 12288:s/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:sN9Xozsr8zbhN6GwXOGIh4
TLSH
T12B6523B7F992A442EB575B3129811AC4CEA7FD9FA9C20791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d7a470999446202b5f47437c1b86e16f9bb7dfd2f48f5702eff378b948135c1a
MD5 3892a8dbc06b86f2d248b61517987a39
SHA1 a2b5dc58543fa3e2aee1589cac8d7de03a2afcf9
SHA512 d15b02f7a85aee1d90aa872a6b29575ec5eac24210b96a1a7ef782aee26530c803807b8761d88fc4d3b445502cd54ec150952415b08066a35ecf3190b9732f09
SSDEEP 12288:jyPz5L8CksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ozym9Xozsr8zbhN6GwXOGIh4
TLSH
T11C751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 afe90067669626d193600b42a764fa77bf353151809aeaf5bb4b3d185d3c9fda
MD5 1635311f7f0b2bcc700405df3640172f
SHA1 6e30b55e6b5ae09ea8d21832ca7347fc45787e5e
SHA512 85f45c4b1639a4e6aeca63ffd4bdd63c6f48c74745051fe8621eeb0583ed211d3d58971329beca57d70f7978581cae2d07c2b6b18f8a5cdde69a37a1b5686967
SSDEEP 12288:QTksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:QR9Xozsr8zbhN6GwXOGIh4
TLSH
T1046523B7F9A2A442EB571B3129811AC4CEA7FD9FA9C21781323D1045DD7A83A7E34335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 dc58d598dd1f680417272c4878729e98028fe094cacf6b6cdcc6a23a8c2ca8a6
MD5 eaa0213551a42088d410a60e6d8c5169
SHA1 4e0e3888f49d8968a8d4e23551e147b16a574f2d
SHA512 1e4cbd9a93c8af97319e7fde546f1420b5e87ed24765fc4ed3ab6131aa6268ba36897955d679d6c105e2d2d192cd3236da13869043f89b1435d97885b50b3e44
SSDEEP 12288:VTksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:VR9Xozsr8zbhN6GwXOGIh4
TLSH
T1606523B7F9A2A442EB571B3129811AC4CDA7FD9FA9C21781323D1045DD7A83A7E34335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e685c4d84bbce39daa9a31ad6bd2a8c6c6745b9925019d7b82b4ef533a1b5c85
MD5 6555bb5eb4aa6308ff0a0e758e628bd6
SHA1 43751aae5bd9af65eb0b9e65a90ee40f78daa271
SHA512 41a9d6df6a1275215f197b517920a2e5f3139682d2523b771a58d6238c2930a9d17c7c16027a5456dac2aa292d9afa20be49e52f3f9f6c4d026373d76ba4c648
SSDEEP 12288:eyPz5L8CksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Dzym9Xozsr8zbhN6GwXOGIh4
TLSH
T1B2751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2f78c5131fd47b2018657b3d434de666aa2832f63330e9dcba71107e50c47caa
MD5 7081a30e135c693c7a1467909dd40477
SHA1 d7ed2ef2c6281b2f8a4e128af3398d733717b254
SHA512 ec32065becace082963db4f5ac830d18699625f39e2e124e8ec9eee903eba8e2b342ab5452f61aba7672aa681ea8ce2945d6fbf5c7e6e8d5e564180ae45eb474
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71SNKbrh/8KBJ9Xozsr8zbhN6GwXOGIh4:9P4m4IpOO67N8KZXozsr8zlLwJIh
TLSH
T13A65AD2DABDC0096D0BB913885658A49FAB1742A2F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 04c6772841c8dddca572434e8d1c8254f568464077d4e6f05c8f6f98dbbc3f01
MD5 52fb71611e28f5a89f3822d02e1b051c
SHA1 de42dc0e2cfc345f11b71020f86375aacad2d27b
SHA512 003cc4605e531b85b2415b6b5e1f13add1f3d1bbf7dd7018b9a9780e7ce489ac0dcd4cf4fd43ff2c74dd9766b69e41ef02263ac5261d21a58c6b1586ed959e78
SSDEEP 12288:rQsfjksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:jh9Xozsr8zbhN6GwXOGIh4
TLSH
T15D75F15AE29411D9D16F6235CB414A80F7737C6A87E193CB12E0F03E0F7A5A1AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 014b5ee9958ef3812b718631784d4446d7543c66102575ca6521eef652f6adb6
MD5 ad8f69039537b91ecf42cb9a9495a021
SHA1 d4585ea0b868fd2547ff3f0adfd3aad9f13a269a
SHA512 7ad56062467c0c1e133ff018199ddb1b2ff363bdb73d1c9633bb2d869f847f4f508d68be9abb14b9d9c0fd9557dc8e960c867657359b52d4309e2cd57cfed9d9
SSDEEP 12288:qDksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:qB9Xozsr8zbhN6GwXOGIh4
TLSH
T1566523B7F795A403FB776F30284156949A6BBDAE9E81078332381145DC7A876BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4fb0e77884409d9668beae0b06a8de040725b180ce8ca477aff2fe050de2cdfc
MD5 7e63ac8303cea5b272cf53d360413751
SHA1 118a43d5a7ed5c5dbbbb8a1bd8458743afa81d93
SHA512 e7ea52d1a2d7f9caab69e5d4e7cd40b0b44aa14a13bd26a62a9e4e640f357b3ed0bc6bdce640ef97b3a8edeb1b8c7687c20db013f09e0d767a96fe7b235c6f79
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQdXozsr8zlLwJIh:ia0hNYG4JwMwFRKIh
TLSH
T1F985AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 7d3519c48b2b2a17cc1f8092c65d500c8b5538787397abdb8928a282dd31732a
MD5 14f87459945bc91ea2a3b361d00f6599
SHA1 81972f45712ea98abb0042b30c52581255da067c
SHA512 c29abcf6cedc4e6581f02ae61e06d594cd3e8454d8f6220d741aa7b416eea08d78bd60800aef1627dcaee848737ecf476bd2f8073095d8e87394451ebb880d80
SSDEEP 12288:whbHjfXGksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:whbHjPq9Xozsr8zbhN6GwXOGIh4
TLSH
T11C7512BF66AC20C5F673A23D55814645C772BC2A070253EF23A5417A8F3BDE56D34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8c70185c3ef0b062fc193c7c724c44f8b74cb80004000f2b75db934d933a13b7
MD5 c02324235abd4a778e4a0c565133908a
SHA1 1553c83cf2b97996dc70ef36cb21b0edd191c9d2
SHA512 033092de4bc9426639a0eb49f168d200cb3aec2e09e611cd202ad79c7b79c4f5d3b66af5bd470bd3b78eb5fa0264922d826fb11d9aac227e2e3dcdd04eb02ddf
SSDEEP 24576:03YgnJcRTk4yti+R5dpR/C9Xozsr8zbhN6GwXOGIh4:0IgnaTk46ppR/QXozsr8zlLwJIh
TLSH
T19645BF2EF2B910B9D8AAD236450147B5FB71782D1F209ACB0174C538AF1AEE85F35F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 cfef7e634c9658e5c6a42f1ff2a47999a78c70904d2a89bb321c4c50d5f45ad0
MD5 bf16672707371209155b6198f24284ba
SHA1 69f282da030125c50bc6f49eaa9532eafbc5a80e
SHA512 3ce37b76bbb32b44acdbbeeaaa242f835e22a6b3f90a777a9f5a456f44ed101a052644d76615e0a0f8e5f7f72bbbc5578abf01e526d8a6921e75216051976a6b
SSDEEP 12288:NvksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:N99Xozsr8zbhN6GwXOGIh4
TLSH
T1E26523A7F691A442EB675F3129815A84DA97BE9E5B8207C3213C1046DD7A8FB7E30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2adad9bb18045669df5207cc2d3da0465a8280b62e594b6d4904a888d7c72ab4
MD5 51a7b0a6dc47e52c0c1918b332337437
SHA1 0c67ec10743583eb5e181293dd7ccb27ca569ccb
SHA512 29da44cfd53c7bb668b5b27c69b533ee3b3a314d5e1f202e2853e4dfe89548714986c873620d2918b69dde55837838cb5702f5105140305b8e7ab03c2f8bd98a
SSDEEP 12288:nOb9A4LWOsvAYFT8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:IpL3UT49Xozsr8zbhN6GwXOGIh4
TLSH
T1CA950156F7A400F5ED7B823CC9A28A16D6B2B85D0760E7DF03684A551F237E25E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 4b3c4ac01819f20312022a9eee9106042a912091d16f71b39b7ee27f9dcd641b
MD5 dea1bfa1d8e744f0b44eb019653383c6
SHA1 d85f044ca47c1cfa7da7690ed429abb39c594a29
SHA512 1d2712163de74bd3a4d28828b4d147a4ef0633500dbadaae243cecca988e36f8349141a9351f45ec5c906904057c7a75efa56836ed5766839e152c2b4f74543c
SSDEEP 12288:mpFtaOYksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:bO09Xozsr8zbhN6GwXOGIh4
TLSH
T19775026B36ED20D5E677A23D8982434CD7B2B866075217DF02A041AE4F77EF86C39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e4ea05ca8d3b9c01c5413c12732007c56eeea37105aadaeeb29fcf28bead03f0
MD5 71e2872782bd87601b6a8975b82f506a
SHA1 280334333e5b4a6b9a07efcb9e7b9b0c30073605
SHA512 c5b9ab1974c6a7fac39d05206a41117704825493609e3a5f1401ed33df5f714b98ecb878680119f35c4c5c9ec48885c0c6b8d4cca78a3f1830f0060fb07dcd27
SSDEEP 24576:p7NM9YmZqmWMUkPjZM48Mv6bEhsR9Xozsr8zbhN6GwXOGIh4:p7cBWMpPjN8DbEhIXozsr8zlLwJIh
TLSH
T1FF65AE2EABEC81D5D577D13DC9A28205F6F2B4611B318ACB1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5bb75531209959d26556414bb519684872cc890092e067cc922577a4a838b420
MD5 f6bd276c478525f4cff819552e7c71a0
SHA1 630372327e0c21d7bf39e535f47619c70b52d60e
SHA512 8292c895458b7e4c9d515a1e8ee6654da4e457d26e65302f2ac80d23e28ef59cd5932ef7953e45d7d6715ab749bc62adc298f19fe2d8052c803552b5f8ae07fc
SSDEEP 49152:DF2YuHNETovcvNYf8kmjXozsr8zlLwJIh:y6tCf8kKwFRKIh
TLSH
T13D858E2A27ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3a08f7f6b2c8c7e890a7247a1320a17e36b9b3d8858e5aed341e60321b5d88c5
MD5 f171b39335a746ee105d5d2680a36941
SHA1 2944b869ff05a26e262bb1638ff9e8e5364f8cba
SHA512 76053840b91df0c1effe741a0327cdf928132cfbe845d91f3192ab3a6a5645cc0fbc87ba068ca42369a1ec4d4d42bdad937c281309d3f7a44bd228ba5e059efe
SSDEEP 24576:3AFs06+OmlfQNXEbToA9Xozsr8zbhN6GwXOGIh4:QFs060lcXu9Xozsr8zlLwJIh
TLSH
T18865AF2F62EC00D5D07ED17E8997C91AF6B1746707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 2b7124a834ce3718c820244fe85fac8d3eda78a338b85c832cf4b07ae2bfc3bb
MD5 86efec6a0738b2b773c93cd99d7fb7b7
SHA1 963f00f3e45eea9eba48d448c4c95fba2533124e
SHA512 476dab74c219d9b8a1edf034cbcaea8a7bb67630d245771c42f0ee5595dabbaf655d0c9eb99311999c370c56921adcb17e1d0770084fc5ed2ad42c1bd0a3ddb6
SSDEEP 12288:jCJnJ5D3Vkr2zxzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+JnJ5D3Wen9Xozsr8zbhN6GwXOGIh4
TLSH
T18E85D02DD2A810E4D4B7C374819A1B85FE72387D2F226AC72478D5357F12EE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1934449d0c86ac1a6b33065b819a758d01d7ddf8d3082d48b4aa92245e5c8045
MD5 8babcd76401443dd273e745380bd08bf
SHA1 2b0f09225aab14cd90484a5e054d37ac0c87b4d9
SHA512 8365cbb037cf390a163ef7bedff7a5164773fa757a3de380ced55820d2914b99b85499fe2b02dc91f1b3faa310e812d46e5de2a9c11e67d0f074e783c432594a
SSDEEP 49152:fo06DIKdwc+eQnSt65aV3Xozsr8zlLwJIh:g1wFRKIh
TLSH
T1AF956C16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 02cc9aff98a10a59466590d485ff06c00727da5c029a98a0198e5f05c9d59aa1
MD5 cdb10820767bcb5d8017429e67fb353d
SHA1 59f29711ab1b53593e4ed16aa8174ea66418b04d
SHA512 e2757e66b49defee5e6a8f725f0b66fecd33e6d4690a6968991c5d7fd9f86d7d286e539c1d3ee54baf61658dc25422ca25f9db7392a6022ca1473964f061ba58
SSDEEP 12288:rEP3RxFksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:wxj9Xozsr8zbhN6GwXOGIh4
TLSH
T1F97512AE779C70D5D627923D55918644C3B3F4751B4227EF12A4813E8E379FA2E38B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 ce3d381c322453447ab28dc241510876ba1b87a8d5760cec3444b9ddefdbe1f5
MD5 933a1ee1fbf845df48016d86cc1dc0e2
SHA1 79b4f6408dcf65402c686cd0320a99c0f4e35e9b
SHA512 1f4aee08067696aa890415e027048e1207403b641931aa7684a153d04918e4c26e6d8492ddd37f05d425fe018857e36715be87e0097b37ff6c5e2ccffa99aa55
SSDEEP 12288:Ejky2ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:EIya9Xozsr8zbhN6GwXOGIh4
TLSH
T109751256B3946081EBB70B3899A242D4CE76FC255F1117DF2160A23E9E37BE5BD30722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 dcb3b3db3bad118f15fbd166d63fc4a8ed08c97a85ad55f8cf2674a4fcf95958
MD5 369482ed85fc9c3142af4572c52a6b4e
SHA1 259ec29c734e88b36d387c8f75176380a2a119a2
SHA512 d1657d41192dd2a0532463ba81c64a6c85be97a33e103f5d034dafc5f4df5fc194089aa359a5faad993a17cb88786f8671c18aefa9d32c8da6a9e743ca476e2e
SSDEEP 12288:d7IksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:dk9Xozsr8zbhN6GwXOGIh4
TLSH
T1586523AFF6A17442EF171B3119501BC4CAA3BD6E5B8217E721785061CD7B8E67E30721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2f586d49daf4127f420244dc2a351025ee1b2bf358688aa26fa45eb83e097d67
MD5 de1b1a30d969d9439379c70dc82644cb
SHA1 d516781f74095c64bfdec437e58f74ab50b506e8
SHA512 a7d8662e9a5f325c7485b7e5df91af20d7ac50cabaa524945bcf467335a7436bcb7d9d66e27f13fcc0c99f3ba0d21491689081c17d7c8c7061832c6a64d9c735
SSDEEP 24576:UQ9MxZKdcz97w3Z9Xozsr8zbhN6GwXOGIh4:UVKX7Xozsr8zlLwJIh
TLSH
T1B4558C2DABE9098AE177D23595A250C3A673B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 1b68f20ab1bed41b9bc2b94a81bbf97eb792142fdec7ff45821e904b5dde66de
MD5 f2dc09169fb9492dee556b3c63f30aba
SHA1 bd7746a3c34a68759d5ea126bf4419edc672b124
SHA512 78d4fd86f4a7a90c47c6b5463032727cd3d7ee58ffa2058c52314390f3ab82cb6a92a763091b39e98279b18dfda5833eca3bf6ec7d6f96b5c52c7ce0d07f6fab
SSDEEP 12288:zyoKo2xRple9pSksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:zyocLAp29Xozsr8zbhN6GwXOGIh4
TLSH
T16185E05FBBAA40A2E177823C89818744E7B3B4745B5217CB6291C33D8E379E9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ef5e22fd50d9417b5cbd968a89dba846cda26cbc1ce114f2a5cb164abf33d93d
MD5 62a083ae4938364c92df5612128e9511
SHA1 ede55536ba62c91fe41a19ce1fc3f6466dc0e93c
SHA512 fdf2f9071ca0730b9669cc7ce3c4d38b1bdc6713ecb957b57119e4982528140d9536a5439e7583a023da256d0b06dcc05b43fcfbc3217e66e3e47deeaf390499
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKEXozsr8zlLwJIh:W0zuNIgwFRKIh
TLSH
T164A57B3DA2F800A9D9AAC375C54513A5EA71742E3F2056DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 db8ee93bcbefefdd39acb58b0949e6c7326bf2c7457e71ff229b8ebb37c2d52e
MD5 272224df0bdeb14cf55ad3c428fe4076
SHA1 19becfd50fa9320a0880b673023fbabf832dd063
SHA512 5cfc200e31de01e43d85d656fcb5b5063dbff0a0e8e56fd6400e08d3a83160be91e571b2c0d7e8c02846c2ca74fa8594edd5585c8bcc6d0529acbfe911912e4d
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYsjMqbj9Xozsr8zbhN6GwXOGIh4:uTDxR+N5YzTujMOXozsr8zlLwJIh
TLSH
T13255B02EA7F815E9D17E86799A23C512FB727821033153CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 9fe15fb9ad93af9fb4526146c1872c01e9ceb500808ac47a74ca5b946211a6b5
MD5 fc2549f2bbc815fc87dcd8c1d7c3641d
SHA1 ae585a043203d6ade6a11300561416622c15f61b
SHA512 29887559465f21c92c3ec6c5f9d4dd2e364077c4819be74c99e8b3a85e04afb25cf992bb499abfcd9227debc679694e3814c7c9e52e19e8b6ef5ec6709b94387
SSDEEP 24576:cTMdOz0FFS+/mSLv9Xozsr8zbhN6GwXOGIh4:00K+/mSL1Xozsr8zlLwJIh
TLSH
T14E85F17FA3AD14E5E57BC27C9A438906E6733466032267DB06A0C0792F5BEE43D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 90247d25a7b9968b0867a86b6237fed7e7b3cd9cc45bdaba451dbf2e8003597e
MD5 55e5f1c780923568439b923ac5e8faf5
SHA1 cdcc0b2a00e5a5d88c83309833eae899fe49c1fb
SHA512 14f3277ae975e8aab0ec08b04afd30c8f0b44f076bd44cf35e1528906ac065f40c71cf03f7e7084a6e3c7be4859aa76e55f98341b9911f6dd32a1147ce3df84c
SSDEEP 12288:L4Z8ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:849Xozsr8zbhN6GwXOGIh4
TLSH
T1F875126EA3E83081F97397359A620284C672BC6A175117FF31E4C17A8F379E5AD34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-129-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/468-135-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/468-392-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/628-204-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/628-210-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/628-398-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1252-467-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-473-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-471-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-468-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-476-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-474-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-475-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-478-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-470-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-469-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-472-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-466-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-465-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1252-477-0x0000013F6F2C0000-0x0000013F6F2D0000-memory.dmp

Download

memory/1656-397-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/1656-187-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1656-181-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1668-166-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1668-395-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1668-160-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1992-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1992-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1992-404-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2072-150-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2072-394-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2072-156-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2428-34-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2428-35-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2428-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3104-391-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3104-125-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/3104-120-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/3172-224-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/3172-230-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/3172-400-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3384-388-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-460-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-49-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3384-55-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3500-447-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3500-18-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3500-12-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3500-21-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3816-403-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3816-97-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3816-103-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4080-39-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4080-94-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4080-83-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4080-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4080-45-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4084-202-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4084-200-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4084-197-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4084-191-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4260-399-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4260-220-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4260-214-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4352-458-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4352-456-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4352-393-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4352-145-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4352-139-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4476-85-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4476-389-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4476-91-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4512-462-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4512-251-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4512-463-0x000000000CCC0000-0x000000000CCC8000-memory.dmp

Download

memory/4512-402-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4512-386-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4512-269-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4512-285-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4836-81-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4836-79-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4836-69-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4836-75-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4840-107-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4840-113-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4840-390-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4932-420-0x0000000140000000-0x0000000140BB7000-memory.dmp

Download

memory/4932-6-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/4932-530-0x0000000140000000-0x0000000140BB7000-memory.dmp

Download

memory/4932-10-0x0000000140000000-0x0000000140BB7000-memory.dmp

Download

memory/4932-519-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/4932-0-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/5080-401-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5080-240-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5080-461-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5104-177-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5104-396-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/5104-171-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download