287471bea9812e51f9a69b3bf1627e37b15396604c209f411225104ce06a8ea3

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.2MB
Sample260804-dze4lsvtfv
SHA256 287471bea9812e51f9a69b3bf1627e37b15396604c209f411225104ce06a8ea3
MD5 1157baa211b23a89cf8daa155c378f1f
SHA1 42afcd90bae40607434941cf318459a626002ea1
SHA512 77d8b7398b42d9eaea8e09aff88a07834b23aab28a2ceb03651aac4af018c783d233dfc6c7fe1a8577d4306a6a3a1c7b48fb62772732a0507bf13b9cd9ae4709
SSDEEP 24576:6FlGpYoWd4yiHNbnnKs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0lfd4pNbKsLNiXicJFFRGNzj3
TLSH
T14045D056B3D012F9D0B7D13ACA568A61FBB2B8054720A7C703E45A592F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4124	alg.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
5084	fxssvc.exe
4952	elevation_service.exe
3552	elevation_service.exe
3908	maintenanceservice.exe
2308	msdtc.exe
1080	OSE.EXE
3368	PerceptionSimulationService.exe
3452	perfhost.exe
3400	locator.exe
3456	SensorDataService.exe
3468	snmptrap.exe
3576	spectrum.exe
1592	ssh-agent.exe
3024	TieringEngineService.exe
800	AgentService.exe
5012	vds.exe
3136	vssvc.exe
796	wbengine.exe
2984	WmiApSrv.exe
4348	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aa3c685c2d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036241211c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef07d811c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feca5510c123dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028555f10c123dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a214c110c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000865e4b11c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002768812c123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	5084	fxssvc.exe
Token: SeRestorePrivilege	3024	TieringEngineService.exe
Token: SeManageVolumePrivilege	3024	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	800	AgentService.exe
Token: SeBackupPrivilege	3136	vssvc.exe
Token: SeRestorePrivilege	3136	vssvc.exe
Token: SeAuditPrivilege	3136	vssvc.exe
Token: SeBackupPrivilege	796	wbengine.exe
Token: SeRestorePrivilege	796	wbengine.exe
Token: SeSecurityPrivilege	796	wbengine.exe
Token: 33	4348	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeDebugPrivilege	3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3040	2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4696	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1372	4348	SearchIndexer.exe	114
PID 4348 wrote to memory of 876	4348	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1652

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3452

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3468

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3348

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa45572536f3ac9953dc43145f02f858c05d8ccb94058cb13207a1265123342c
MD5 dea26a151cff3f4fdb3924711c11bbd6
SHA1 fd365344e32bbb08438ba47748951eefc3a7e780
SHA512 8d7f2a36963c3ce536aa18da0cfca59ef8d8b8bce5dbda52063cdcc24c58a6fd26b9c10e2a662750fcd502dadd4bdd401b837d74b827114b2ece1d0c9e6d57f7
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3LNiXicJFFRGNzj3:93q6mjBU7wRGpj3
TLSH
T177D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 458c42c25b51e5b5493ec5eaea8e0f43335668c04979dc19d8d1867c74a9b9d4
MD5 4ee61169868f0a7414237209ab0148e5
SHA1 e74f5a94e7a9f91d1a3e9631bb8e9c0a2eb8fa4d
SHA512 c622fed21a30bbdc8fdaab4c6f66b1707fc3004434915488b84d25a57ad9bee5ea44ef80592919999e84310efba05d04dfc7df901adc16ca8a906e5b964115b9
SSDEEP 24576:DXYfDtczAg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GtclLNiXicJFFRGNzj3
TLSH
T14275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 80fb4c0634e56047d0d555270fb901e2a352a0044e3171a22e08b89f5fffdc6b
MD5 9e38e232fe40fe7670f6e853493b7202
SHA1 0becb63f137bfd6aa4c13596b62130fed1986aa9
SHA512 4d9008cb33e28e79220962e7abadfef218e1ad979da5a0061c985f3c70580f1f28b0f1f8269c84e375de899ebd35b2acb885217487dfbbc6f636a5f403c799e6
SSDEEP 24576:T0Le5ji0hmxhrM//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TPji0AziLNiXicJFFRGNzj3
TLSH
T192859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7bcec5f3fe9ada711f3b4a6bb0a17011d63082c216510de3a6f9b43b92c6422b
MD5 58eba1cad1f16cfd639c307e1b901968
SHA1 246e003711e793c74b08e7b6cd75bb8567c1ed64
SHA512 b6f597b9ee534020f6595276a3c6b9022482606be0c6e3c11e5d42ba28acadd7ff66691054cdea8696630b86cd3282d2486df24afba0bb82b7e9e9a7eb1eb900
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWj6q8wyu1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9/ezSC6vUzPv+Hjy+LNiXicJFFRGNzj3
TLSH
T198756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c021b21f0a8c64cccc760c478884befbe4bc02040cda8bc7202df21d50ec0900
MD5 59e207c7a9fb811b7396fad37e38e83f
SHA1 44077b5012d9a10400a9d80364b3bbbbcad7ffd8
SHA512 031c034c8e2bd85ee0d44f1f36fe3ddf47ee7451876fba4d7acb61857e433af771b28577283d4e8f3cb5860b2801481f63c0a8eb368be8ccfbdd377586c6525c
SSDEEP 24576:eVbqPb88hv/l+Bk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eVO88hXl+CLNiXicJFFRGNzj3
TLSH
T17D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 24c3712e93e890683952e305fa82e70c794052781a89ae82a12f902f535b9751
MD5 e408dd6f77f7247f8b2ea5d119f53663
SHA1 f3dcbadec61fe4bcda858668feac94ce8c22db9b
SHA512 a345587e5453570c5393dc2e9ff74795fe9f42cd8088332271156de274ed09318538a3a5d35b73f6883a0046a4f890bc8b43621fbd1f19a81613eff0079b589c
SSDEEP 24576:gGD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T1E15523D3468854B1FBFD003A867A5828B5845E2C8A5A5DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a1c8b36eba7322679a0e194a2c5540ed8dd56fdb59c39eba690adfb35c6f1c90
MD5 519ed975ddf49f71823690f8691302fb
SHA1 3c5dadbb19dd62036b2b2f6e93c67ee45b6e05d5
SHA512 c3afcbfc273482961cc93ef026de266db06777f2894c1815e346a519b80c073d9e20d5a6f1ab58c1b470f512f6622eaac41252a1eb66932118af6433129e99f6
SSDEEP 24576:BJIUM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BJIUMLNiXicJFFRGNzj3
TLSH
T15675CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 70a01ed5219b94fde6a6b4ed00c210d4e81a581f218ac010032f2cb73fc173f8
MD5 9c8fc5ac5bfdfeac2d5bb6c140ce90d4
SHA1 b4a9c4f5abaf6292b3675b349209d2cb19499144
SHA512 f0ce3f528754ceab79409456f393f6dc2123bb86ce92d9a04997c39e5fd3ff458f5ea3ad6dd7bfa7640eee5a3094e390e7c60f061a6ab334ef94b186360737a9
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THC:SQvGAdlCEL8c/WRNw5CF7wRGpj3
TLSH
T1D7266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 72d8411b14154474232a285273ade47f42d327f4c934e299a5c42ede2cce4d19
MD5 04fa59ae093eb58bffdf5a676098ccea
SHA1 1c2adce613145c9e6cb9003e5c4e2cdb9c9c5f35
SHA512 7433e8b651afd346bc013aff122beba9205d15a593a56ca76caaa5da9293a51f99c30e1bc4200b93400626d35b7ea5c221e1944071dfe5e3d03011dcdaa9f8d1
SSDEEP 24576:AfewsAjy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qljyLNiXicJFFRGNzj3
TLSH
T1EF75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c6b37e93e7159cf9ed0908c2b8792b86086606db9741395de72b281c07af52b6
MD5 1ee5f63820ca7765a6e52b2f511d0c33
SHA1 d2675c58c99f015c58586e12d45990188efb038b
SHA512 59f00c41a30fb06f9f19b4826dbfd25fb3aa0f7ce5da647216278528e76cb9f2d683fe95a3beb220fbc07c4bb17391b4a39dc978f5a4e7c8154a73ea94f412c0
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHeF9:KUEtQevvqc2W1cpV20I32S9
TLSH
T19F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0dd930215d2c4e6c0d0c4669c2589dc30629891e53c7ca9581b8c3f4af556d77
MD5 b519275ed034e49466498bd11c0c3117
SHA1 bdea3fc9adf3cc9a706ab960a2ddac4d099932ba
SHA512 dbec16e59c282922d6a09e5c67defe78885014dde2ed9fe74449b530d9536c0a9568d0fe1351805ccbec24c6e991d31717bc3dd52b306770277dbd5d99beba5d
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/zSLNiXicJFFRGNzj3:Koq2Vjnmx7wRGpj3
TLSH
T109D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f9319e6737b6280a64e1f18642a3e80d1393d3671eb298d79d5d870fa634b75c
MD5 b7a45cb14d6fb370c92b2ab76099c50f
SHA1 c792c3854455cc4ae8c19e9102f51f57c2f8f070
SHA512 e5c88ca8a74504fbdb0743f2d41c0f923b3c86e96ac67f9f72574d37a2afb7b28ed05f223abf2d4878fdbd5e22d7eb3d0f0d2c1ae25a616bbb0d60a0a3d1474c
SSDEEP 24576:OAhGL6IFoiwtA5l7S53R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OAM5Foiq5BLNiXicJFFRGNzj3
TLSH
T187359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ca5e1e510d45081c52453947eba5ef091cc70e4f4b5e6e56cd60303dcfae41f7
MD5 d1d72eb41bf337be11f2644991ef2fec
SHA1 1e42f7f24505423726399d3b1d79b4dadf5c669e
SHA512 280c7cd9a8dc4a6d62318970bd7a75d3f35e7aaa960254afe4fe84466eca06e94bde03869b55c4e2502baea8899d2385ccba3dfb17294d67435f1cb15ceb2c18
SSDEEP 24576:MwuROWe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MwSO9LNiXicJFFRGNzj3
TLSH
T13565F18632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3902650329ea7c5abd8945370fa9f336fcb2d9bdbae1674549f7d3fb4b8f6546
MD5 91e5bf1ccacc0eeb1b3278d224369ffb
SHA1 971f47a539c7eb016bf07719012bbc177bbc61af
SHA512 f0addeaf29cae45d9ef62fd1fd310240d093cf913ab34546209993068cef2303e5eaae796844d3f5523c601573d02a49be33634e5beda74b710db404dad3b78a
SSDEEP 24576:/ZuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T1DF55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c3efa0fdb28fb0bcfb083a4eeaee20b5ca9d71359cc9517cc9e2c4494cac61ea
MD5 bf062c07f603a51c5f5b6f171e93fd11
SHA1 f5835944dcccf47c12af6fcefd60862c136bb4e4
SHA512 c49c1dab65996faa380dbb0c0fa1d69897168d5961676bc42a8c0da32b1ce603a1d5b07a98759d0e54d260509b491f0abce3dbeebd113d098a60cb7808ddccd2
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3o7wRGpj3:kQyiKanX+PNEF9
TLSH
T137667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6aeacbde0b872d7066cfb49e3dcf7db271275368048b80844d01789d45982f12
MD5 d60dd1e72d2169ae5f0d914a7e512204
SHA1 c8c0cf00156f7c12f7b6fd489814400709720a9b
SHA512 4b8ee71cf23149117f8ea1783f686f22e8fe81a5e96c2832ea1a2ee667b088cb776a7e12e3269e67f9709e41a6b39186a279e8a2e08de73cc79ca3c0a4d362d2
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3o7wRGpj3:BQyiKanX+PNEF9
TLSH
T187667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b8842677fc53939b91010067e3bc842dbac9b30bafeed5405b175ad74fd6079d
MD5 86fe7daa19fed83be8de84743148f3f6
SHA1 8fbb5403c4dd602f8b6fc76cad524a16d7a8aa34
SHA512 5e3c81adc4629b05cbef28c88ede3b7a4c77393053e3502d9dfa9b725bda138f0f1d502f4ee31f4a59b83468ab8e5a6399a545dd4cb649c6243cc4a6f5ffbe52
SSDEEP 49152:S68Qg55nhkeWu7PNU3/iLNiXicJFFRGNzj3:QthTRc/i7wRGpj3
TLSH
T10EB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e2087162b8f58bb80ce4f22055f64efe98dc1734cdefde73bea1961f1872a40b
MD5 b39fb057f5d7ea11eb086a3e2ba64976
SHA1 d8dbc89d37787b64e8b8df870580c39f35e2c58d
SHA512 6f1f8978cfb081f7cdd65cf145722a8d6d694a7180f97b9dc192b212d48aebf554faee1a7c28b4fac8eaa2f43f8257b2fee788a0e4e6365ad4d289d5d6dddb11
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZD7wRGpj3:iLIHRWhdF9
TLSH
T1A1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dbab426f1d7eb693484e339c438803e41f3423f52314f8c0630dbe464212d0c4
MD5 43365c39315cb02157ca3b53a687bc1b
SHA1 fcecd0a1be50c972c3992e6a10aa9db9d9a12b2b
SHA512 a28e39d408c8ba65ba52c1c732f7c0ffd9b5984bf078d7f84d9efdf8ecc14f22fbd6dcd45f33af0cf914c1412df408a4696bdb0b868bd0bb0279ea4482128148
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glQLNiXicJFFRGNzj3:Mu6JmIxd2dQ7wRGpj3
TLSH
T196D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6548c396b4e09ddb571e28bd52e68e4ef63241e250dc6057108a9090635af0d5
MD5 83a1c67ba50013f8adf1060a95dac2d0
SHA1 08ebece77ef64a750d3a9bedf74e5d34077d0b01
SHA512 d0fc94b2bd0ec832196cb1f78f6040e5cf2d46c1fecec4c831741f3c51f5b66368d4652e31f4c21823faa1de77651fae0dd081efdd393f9f1b76c88c8c98699f
SSDEEP 49152:U1hpsNoJpF1A67U44CwH7R4xsLNiXicJFFRGNzj3:UmifPqRx7wRGpj3
TLSH
T120B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f159bbfdddb0a38b89704dc7a4c689fba296bc7df7d248e0f3a0dc6d4d51b5b6
MD5 37dddab8684976103de1b49bbf8cd0dd
SHA1 0096e8d2929fb38f65784f7b184e0da24fe49655
SHA512 c43f497019a3af0879f3b5a9a434f024b307d7e1d4288f3e7fde96bc49cd998fa908e2f371c1f42e319f92f05316cbdc7493bfb3e4ef9c74ba10f6efd0ac385f
SSDEEP 49152:/SuZQIY0Be2KkRVtOnks6NMHqHLNiXicJFFRGNzj3:F5dKqi61H7wRGpj3
TLSH
T10CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c5c4ebba3f1cb196c9b0e01aebff923f1a4c2da5362e2568ecd266c0293c678
MD5 e558592673d7a7362594fed93a523977
SHA1 caad1cb932929b1a70bb307d3a7edf7390e0b349
SHA512 2a4512000ce6caac1717b16d2af449181e8fc367959ddd3775ec54afe8437c2b3001c6bc707f692498a5cc9744682b973dafef865e27f43180985a39ce066fcf
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wgLNiXicJFFRGNzj3:iX2iWphd7wRGpj3
TLSH
T14495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2f57bde5823651aa1ac78d8c750b733e3dc255181efc1744404a41982ae5e034
MD5 a428620f989286493f2e555a77cb269d
SHA1 321073206e894d2bd32b9696b84d811767837a33
SHA512 423cb09292aeb029407f4042c193d4886e627fd7afbb2de1a0b3a76730ace57bf43b2a66ded3906987eb48bfe3fddbae58408e885033e1168410f105efc87f9c
SSDEEP 12288://iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d7ec5f9a9eb7e6f0636370facaed66eddad8673ab1912c11e5ea294a94f64ea3
MD5 dbc0a0f36d24b74815443f4a84588bc2
SHA1 48803d5be30ac504e42f5b24c8f040d5efb830af
SHA512 13b741d4b844b39a791d6f65de7b174dbfb3a04e3b2d41d17a47e64675d42c5dd5818a6c8caf4b3bfef9d752752f137955d51830611b8c825f81ccc0cc56744c
SSDEEP 12288:3siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3558945B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cecc52132c9ae15dc1fb9c3d71fde55366b2435b4d30baf39b90aa1ce29dea8c
MD5 3b1ac7f18012dcc5aaf8d50dcacefbfc
SHA1 a220447e33020d3133df28192f5495a2437e1840
SHA512 318f9372dd8cd5f43a2c6c1752b6a62b0a6316e0f4cd4f33b162e0b5cc35b433216f39008f0255584ecbf939dfa2bb2badac421ddf3435df84aac10a25ce191d
SSDEEP 12288:jyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3558955B1FAFC0039C6364428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9fcd8e89f0759e43cec44b5b423c1457705e426db8307c008e969b08eb69ce28
MD5 4589f9958c18b8c0347d67193414a20b
SHA1 0526d7285447f2e13fa69eedb9cf76e869aa7946
SHA512 2f020b3445425aeefd296ee0e345c670e92da1c629aee6e3a48074ac28034f144e34f632cd22c258ca6176c257d0437ff65ed75831d1970cbd148fda4db02321
SSDEEP 12288:7VtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T165552392168900F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 40d8de1108d1c0b075aed732e3c29f55ea9506f7533a54affc3b42961556eb81
MD5 d0b8df5eaec54516900ece0ac201ad56
SHA1 ad195477e286acaf96e69079c2a31f63132da46d
SHA512 eb2df543e7063dad89de895107fedb8d9b46e0308b649843d12ff129d672043801d07c679ce439d9200821b1cfad6758dc655ea407f02ef19ee6fa84530d8c01
SSDEEP 12288:tFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f0582979ceb8494542449c7a134e190ae17dac59e4e61e078aa34d4f4c711b73
MD5 f5c3fb38efef02dca335ee473e079bb8
SHA1 d633864a559399615df45070713fc0bb1b49aa5e
SHA512 3759d6b7ce7033ea9a3af5b983b93f1dea615617f4fa249f3689e907408e7a027b11bbfca96a0502e4c736878f4c2362eaf432dcafadec2212707bca8a042ccb
SSDEEP 12288:noiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:na/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3558945B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 016df9ea6100087609479b4a8746658fdace91472e190e884d20692f3c836bad
MD5 57fbdb11bb2c5f77670cc98aef6868ad
SHA1 80a5e4e5fe151440da3d628efc113e4f31004819
SHA512 390a4a6ca127396377df17d0f21bd0e6ae66e2ab7ef3417d634975db7f16b6a29013187e4ce96f23888f40bfb37042e087a9e302e729325a34d8d3358472d5b6
SSDEEP 12288:uEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C5523D3558955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3af4953d980acbac8229db23c4ccf3f241b6903776ca3d0751e09330c2b6e555
MD5 c453c3e69efd4a731e42bc9b17829a26
SHA1 c3636a0e325a1853d086448776f604597b7bd14e
SHA512 b58c9e0d335c350ccdd62cb43fa37f32a5af244fc85de57450c7f0ef6626c8cc08b641089e3e816ccefcdc254347793782c1ad71fe011a3be128432b930a9264
SSDEEP 24576:5ZM3zFVSO2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ZM3zfqLNiXicJFFRGNzj3
TLSH
T16C750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e104ad452fb5de79b991585afa2d6c9b33b9485ab78bda7c35c31b7bbc8514ae
MD5 0ecbe75cb155ab8b6fc83246fa65e437
SHA1 97e0fae068bd23588d177465205691e2d6426316
SHA512 84a3a2cdad674dff53f6a76992c5ad68c2ce27e81424a8c1b0fe603a2873b02205688560bbc0304062695e8c5fc49a227306c388d18d4ee3a3ad6346ef311258
SSDEEP 12288:CjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1455523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d5d6a5000dda4d16b07130c072d8d67f2ca39892f142d50087316476af51b1e8
MD5 c1f8234f40b0a021b7d7060a1ac000c7
SHA1 7055652c23c43418881aea3b407b534afb8b8015
SHA512 2868fc1e1cb645e2c2133969cac408b67ed48178bd30cd8af92da04e5f8e4026a5782a426fdb7fe13cd84b58bf7c29593d760340d6209adccef1ec50b343fbe8
SSDEEP 12288:3niJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3T/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3558945B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e1d3f72a3c76caf27bc2ea417547279cfb495770c656bf58954f4a84ad397bae
MD5 babaa0f3482602690a1976829508f8d4
SHA1 5d473fff00727b7037d8ffed95616a9b796d5da0
SHA512 500818e1728ebcb5744ba7abd25b25f9559063ddf61b62e33debe04b2d957c08058334ef0b906ad96f16c1829c46c9f241bb5f8ad1da0a02465d4fd5989b4852
SSDEEP 24576:szyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sdLNiXicJFFRGNzj3
TLSH
T15A650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a8a035b9ffd5f36985a5003a51c258c91c61e0dba9a1f08f4fab1fb1b3d9dcd4
MD5 3b81faca1e0ac5c07c1cff6426147eae
SHA1 593a2c18249bbd1fb278676cee4a86ba89931500
SHA512 b9e1f800d19d86eb48ffdd84dfb476706643c242fb03b78a717fd290b7293877aa8c1d5a5fa3dff59e907ba4b61fc3987c0187ab9ac1352db1d102d9d9edf0d3
SSDEEP 12288:fjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3548955B1FABC0039C6354428F5886E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ff4557ce42e11cf8d5a934738406964f22d97a50dce3a97ef275034806f6f14e
MD5 9949e68dda4d538a71de90d0a6623307
SHA1 4eacf3f2a0845074e9651e708269e1819d60d979
SHA512 57c66dc8ff9cee5abc50afae26bd2280c45303382c9b21da16fd1164bbb973011f86201bc7222541ab8a6163efb42611eebb6edb6d6f2b7c3bfc68f3c000e0b9
SSDEEP 12288:CjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3548955B1FAFC003986354428F5886E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2685875dd5bb13af0dbdd4969ade27d429711d86e532e0b3d6290d9742e31d89
MD5 009beb53f78be02d1903c7a9da4a569b
SHA1 da99d378bde9bc50bfa6aef335b889ddd218d5fe
SHA512 2a339e682d5009eb846eb5fc089bee5bfc0275157cc449f99dedbd8d37fc23ccef54310fa1447e2d6463a872410aa83164264767e37b52396b46812f74e5c495
SSDEEP 24576:3zyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3dLNiXicJFFRGNzj3
TLSH
T185650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ba2d0469f01794013fbeb64386a0102b5628d1eedc4f4679c1a8c94fc6526603
MD5 bf9cf2eb1afe7e5fe4d97694be0fd5fa
SHA1 1dc96e38dd80d159b20582474e1855dac88c5c08
SHA512 7ac1a54036e185e55c1b7fb6f7e102c5c215ec715b273941b52f5129746f9a38bbf084b6d8f35f0df3ed6eaa17c16afd2b214fc3de1e68318f756048e54c9f73
SSDEEP 24576:UcP4mcvIjkGOxhKP2l71nNKbrh/8KBv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vP4m4IpOO67W8KFLNiXicJFFRGNzj3
TLSH
T12D65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e6a6b92995d909bb2a97c45a0dcb4e31998440fd2e6b2420545820673a60e66f
MD5 4391684e9d763b9442e0d7890e1eac76
SHA1 4ee80cf678adf442b2272a8a9cf9519ba09e5872
SHA512 9d09a9e30568d4f96d55a2bdc788e0c1011bda89254f70814d675afb7b638a6a4f288eaf7369a9dba2a291dfb4a30f25ce94555877892bc1bd9a47b011e4f87c
SSDEEP 12288:MpsfziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB53C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7f3e57d09af10dfc9cce19474bb747d810bc443689d642787f4a7fc165a7845c
MD5 ed9f865383991c6ddf380a82e326b172
SHA1 c547de241713451e7e006451e3ed3d878bb05741
SHA512 4a0db95e73c3fff97f803e5d20af637892c669ce6a661f0edb58f46d22df792aa30101a579d157858efd0fc18169e4ed2222a05fd2896d406a9388e82f1ef054
SSDEEP 12288:qTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T138552393568C5572FAFD1039853A8438B5497E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c727c7a55a459648c1e132ba38525f238e17e31b483deb034b20c3cd4e589bd1
MD5 a47cead215c52f9b7816b59451b237da
SHA1 d877793edabe1acb9e04e76ba5738e42455aaf01
SHA512 5fb11a3639b40c841ed073b2acf3c30f603c80b2022c39e0f6ae261dd84d27e86047db6ceda92e72c85835e2271f8173bdcda3cf1f3ce9df65c06aa5221aa272
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQJLNiXicJFFRGNzj3:0a0hNYG4JwK7wRGpj3
TLSH
T19A85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0a545bf7d36a93c6de49849a083460372f981e82fed2db1b66993cf00c083657
MD5 0e0996e525c73ccca0530f0e9f5bd4e1
SHA1 5ecc45315014d7284b5402eb6cb1ea8dbc039c76
SHA512 0e89dab1091ffb38e308810706024996af3f77b68ac63221757e743cc727d98f2a422dced0a759927fbf3159fdaff134794a22f863a31c5e1149c0e8ec81358d
SSDEEP 24576:khbHjPG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:khbHjOLNiXicJFFRGNzj3
TLSH
T1855512BE129C20E5F6B5903D85668409D370BC29172293EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2cebef13f8299e66bd3a28d6ba9409c89730413c94ef99955b9d3155a44f7128
MD5 db1c25455e5a64e5b80ef4639075a27b
SHA1 22f11c9c5e9e98ddc03b88a3a43053465ad89c9f
SHA512 82cb5813dbecf6ef70f5d3b430f55b130e74641d918c7f9e03792d2097dfdd40a049849859ed0d435bc6d2c7ea1336a158d05b0c77daf2ba813430f4c3bcb176
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VIgnaTk46pBR/eLNiXicJFFRGNzj3
TLSH
T1E645B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e3db0e2290fbf893f0594dde649ed3d50be92379d2a06202676e9426072cb7e7
MD5 e366ed9b0f48593f2bbb10f05290a63e
SHA1 f9a51381b7d19c7bb6be0bc2b93ff601caf8f85a
SHA512 43f339924db15ff84b448d2a788fe3179b92a4c45c007fd565be7e50460ea8773d96bf1ffd88467cfc748e27b6c00313a08693ba9dc3838abfd1208deee517d1
SSDEEP 12288:2XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D2518959B1EAFD003D86764428B5446F2C9B2619E3E1543D1EA27CFEFCF38163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 7cb30007079afa76b8f3ea150e690ddd3d4330fb28efbb912bb0230edcaa9779
MD5 7c2aa9ae60662acb50f5851061ae17c4
SHA1 1f507e05fe008d8badf93fe7ccb3ed7c53297b88
SHA512 dcf0a502d309255065ea1f6838b436879a2ef0155ca99545f9f8fd21ea1443e94dc12e56b18766a8addd355934dfc06c6f8565cbdf70b79485cab1bc9a57073e
SSDEEP 24576:2AL3UTg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2AL3UMLNiXicJFFRGNzj3
TLSH
T14E750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 954791cee92e0faa5ee6ade27e19e27653cf935b8c14ba548e1fd9bd83ea975f
MD5 192904f7b31222414de0064f1043ed96
SHA1 410545189774b14ac59026eb89140706f3dc3e3a
SHA512 dcfc95beedf04af5803543750b495b211db24acd44daaf656a12a76d11decdf0d7d694f8c86b38ab9cd7433981cababd93abb9d57ea25a7ba1e8fd9fd363b4ad
SSDEEP 24576:xOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xOsLNiXicJFFRGNzj3
TLSH
T14D55126A32DC10F5E579903D8AA2820CE371BC29072257EF4290517E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4836fd976fa8f12c39076813f2299fb7c1a4934e8c2e9e30dab2310dafb25038
MD5 fb67bd7973ef1bc3ad0a2657f15d552e
SHA1 a765523f13d263fa4174821d3a7f8e3ad91544d6
SHA512 1d0db43d7db43e24eb03920eb899fcd64ea70ea8d21cbfbadee10f9a15d233aab3b9b7983e779ace6a1cc8bd17c9cf960a817f9615b63dff50d24432c4f8f8b5
SSDEEP 24576:k7NM9YqZqmWMUkPjZM48Mv6bEhsX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k7cBWMpPjN8DbEhmLNiXicJFFRGNzj3
TLSH
T11F65AE2E6BEC81E5D577D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 15dabbfeeff9460ebed32b31665f80702ffee71baebecf5e3193fa53a28665c8
MD5 b4ca1edcd8551a5c769f72b9b116cb55
SHA1 c9619a1ae487e2be46fbb2e01544a565c21f8c20
SHA512 b730eca937bd2b2ce38e2ff41a39442541a002993d2ff53b44ed17c44420bfb6c3872c40a1c31d823a82bf53f56aecdf92249aa97f6ed161f4bb16144a112173
SSDEEP 49152:LF2YuHNETovAvNYf8km3LNiXicJFFRGNzj3:q6BCf8ks7wRGpj3
TLSH
T1C0858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 78db88a559680a80ce5c1459b8d9a70e80ab677bc20f764970437f71b41a7b9a
MD5 626ad48b8a60aafa426a3efb6ed2a379
SHA1 7296830b64c17c8f70689f0dab1ce2a347eab20b
SHA512 8c70b53a8ccf704b6e4b964d9f514b27e160f1fc357f338c60bd1a1987851f290a5f82e496c1ef039acb754b1e6c0af3cc30ad3793ab92d4c9cf7b10b00aacfc
SSDEEP 24576:rAFs06+Omlf8NXEbToI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kFs060loXupLNiXicJFFRGNzj3
TLSH
T14465BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 33dba521c01fa1bfafeaef431c590ff4f886bfd11c6970b114a11938f7496532
MD5 2349cd455d7dd399ac1d5c530475478b
SHA1 ab0edf07f0d5c38d0f489bc8a8f06adb8916f846
SHA512 f61b911d2e25e7a8e70dcf5038b36d60418ef1bdd173b024962a054508f04a371304ce8989b01190cff3f78fd2226b97c2a451c06dda55d112b012176a64e83b
SSDEEP 24576:PJnJ5D3WXp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJnJ5DGXpLNiXicJFFRGNzj3
TLSH
T1AF75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d2a33818803849135f4f522837a961cd02ba9806c38c92d8b03ab2707ed2a9d3
MD5 a5f4e1de9fc600f0c5a7cf17b39e6281
SHA1 deb560c869bd187e316889f0fc0d557764d65de0
SHA512 c26729f33fc0edf62a1906c897871ec9c534f7d4101d9b2d4e05bdadbead1d5670ca843b86bf0d7a5b0ce9c6fe76f6f790039e185bb557d5fb3c2b82b854dbec
SSDEEP 49152:Kg06DIKdwc+eQnSt65aVLLNiXicJFFRGNzj3:jt7wRGpj3
TLSH
T1CE956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ea47ee8392286fad84777a32fc9605235f1351b860314f9bc7dd4ef6a6fc50c3
MD5 9baaca4cdfb9bb7d1d2aef3e2d2eb2bf
SHA1 8f0093f2b674689c0909d3714406ef802b74cd3d
SHA512 803a818c0cc77954e8d1ac67302abf7f21a1801e117266b11651b1634e919dc47f4d06bc457224d20e86fe93d4c8d27559cd99dcd0185f9e956b5cc96d06b639
SSDEEP 24576:MnV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MnVLNiXicJFFRGNzj3
TLSH
T1BC5512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 25c61c0cdca4ae350452557bdcacf4685c7f289074a35702c12a999687356f16
MD5 fc9789995e4b31b7a029a8b6bf0c79f7
SHA1 0d00850d8bf42390684b89a0a60018514ace1e2b
SHA512 a2215e0da8862f8d6db1d785b50edfa2e189352e89353c0498e3a6c662e8acdde7f00afde107a808ca3381d0e831b4100b9e23021859e2b0166468bdae32f5f9
SSDEEP 24576:UIyW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UIZLNiXicJFFRGNzj3
TLSH
T15865124553C850E5EAB9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 56838d0e86a782cce95f0694bdc14d9b282d83b87e4e36a5c786155cd50f772a
MD5 d7a80dea0b587ebd93a26cae9bfa195d
SHA1 2e976828c3bafc7963299036d7173205faa39e22
SHA512 ea476b60987ca24acea8c4a7461c6f4d312089fa6f10a81e26bfb9a15acc05138cf6e212921a9115c40a309b814580d6e44adbf9a05f7525df7fe78dcf154a2e
SSDEEP 12288:eyaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F7552396118964B1FABD003D86364824F1543E3C9B2628F7A1947A3ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0eb030b48e260a7b553d5b4edb827291db266761ee77c423f2bd0bd780691788
MD5 97a2b13b1958e8e149783d63003eed58
SHA1 10134b32ea91a98bc799dd7b8832715c77f79fa8
SHA512 7e900c3e06b8e1183abdb2f23021a8163e464b741ef24ed725f1a072dcebc7d7012421395ba376080a9126e487b3020bb225e5add1742bc297d15b0f55ae78c3
SSDEEP 24576:hQ9MxZKdcz9dw3f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hVKZfLNiXicJFFRGNzj3
TLSH
T1A0558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ab32d8dc58e734b299f490cba79078f00c6c6a9ee64fd59d070869b19e69bc94
MD5 052eb3de989345bbc7fed375c6217599
SHA1 259ef0318d487268d61b910df16e69c1b73a9f1a
SHA512 5426c49e2edbae6c6d08cd168c5e3b56bbf42078e80a539311459827751be6347fc975c15be8ba12015c714cfa0f5a3452402708a612dd744955cca91653f048
SSDEEP 24576:UyocDApy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JocDApyLNiXicJFFRGNzj3
TLSH
T17465E05FB76D40A2E176813C89858204E773B4345B6257DB6281C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9418cf0f6b83d7cb64e98e0e91b2282bbad0e3d8267308a573e4e4cdd7db7c98
MD5 bb8bb471cd0d8eb241ecd98f058bd895
SHA1 f3b6b25c343f2fe62fc6a98b874b0168d3f794e0
SHA512 20d2853d80b0aca1934f8f652ae349fab0848aa105d9fbf9ab3e13cd7487150c403e130d07f5614aadd5e24de1749ee057aac3edb210d01757d71c8fcea9d95e
SSDEEP 49152:tWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKyLNiXicJFFRGNzj3:N0zuNIg7wRGpj3
TLSH
T102A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 705514e36ecb0bc2a5c38f8734f52aab044aa071b0a18f5a0bcda4ca08fc9df5
MD5 711003af21dc8169c0fc81a31b4feb9d
SHA1 6220f432894b581b63e9d2b54a39b5954c2c5519
SHA512 05deb3056e8a73afba40485a491e75cc39ad8a1cbd91b648fb0b95c99152550e22a882d4f140109cd45677cb047bf541be8d7956155ca149cdbf7735e5ab4e18
SSDEEP 24576:81QT7EcpfxR+N5AWAz3ooiYzjMqbV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hTDxR+N5YzTBjMMLNiXicJFFRGNzj3
TLSH
T1B155B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e8c20b465c279cf21a00990efc37560efbecc2c48e2a16e9fe6a900960ea31fb
MD5 7c3367fc920bb1d7783f7901f4dc871b
SHA1 7bb8444a10498d0a6bd8d2cfd65cb077ddf707c9
SHA512 7b09f43adbeaba3ddc6ed1ab9ca75522d7c16b9bd050b480184e454e0d23f6fc3068587e6e56d75a5cdeefcf581e0d8a2b9bc371301096d3ca56417eb5a7a4f8
SSDEEP 24576:3TMdOz0FFS+UmSLx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F0K+UmSLxLNiXicJFFRGNzj3
TLSH
T11075E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 acb686093e09f7fdf21f9b315bca3839cf3e0a8b14c58bbf668b0cc83b676593
MD5 800b44b7231c188ed7e6c9c47b99708a
SHA1 ed34cb1b990eeae6dab96b8624d2e34b68b278d4
SHA512 2406ff9ead39a3d260685ee25c18ab4e93a48a77b8d4515c596d808a410800b4a967e1d57a9e686057f1262a65fe6e848ffc102e155437e6753eaf3ad708d0f5
SSDEEP 12288:s4KWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD55125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-262-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/800-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/876-366-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-387-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-389-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-390-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-391-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-386-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-388-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-385-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-384-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-383-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-373-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-374-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-356-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-354-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-355-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-376-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-365-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-364-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-363-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-362-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-361-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-360-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-359-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-358-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-357-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-353-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-352-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-351-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-367-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-368-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-370-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-372-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-371-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-369-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-375-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-378-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-377-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-380-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-382-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-381-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/876-379-0x00000249E7000000-0x00000249E7010000-memory.dmp

Download

memory/1080-77-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1080-187-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1080-71-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1592-127-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1592-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1592-197-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2308-268-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2984-263-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2984-417-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3024-198-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3040-1-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3040-9-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3040-349-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3040-0-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3136-201-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3368-81-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3368-87-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3368-188-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3400-193-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/3452-99-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/3452-94-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/3452-189-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3456-399-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3456-194-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3468-195-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3552-270-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3552-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3576-116-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3576-110-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3576-196-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3908-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3908-63-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3908-53-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3908-59-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4124-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4124-350-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4348-418-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4348-347-0x000000000C8F0000-0x000000000C8F8000-memory.dmp

Download

memory/4348-170-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4348-203-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4348-154-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4348-265-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4696-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4696-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4696-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4952-186-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4952-39-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4952-416-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4952-33-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5012-200-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5084-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5084-66-0x0000000140000000-0x0000000140135000-memory.dmp

Download