stealc | b66a8d41abdbd353853b88f31dc994d41fea786a2a58a3a69aaec18c97c9ed99

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260910-d9mw7swelc
SHA256 b66a8d41abdbd353853b88f31dc994d41fea786a2a58a3a69aaec18c97c9ed99
MD5 a33229b172936cb7b99671a6b243c8f3
SHA1 e1cff46c1864331215789b58815341cbdd3c9cca
SHA512 5c0d0e95d5802d0fcb0cdd8dddffdef82ac6843678bd508897204224f34ee8c011668b5af98eef248ec204300ba5507cdd99c84ac88581edea0e3e5ae222b774
SSDEEP 12288:yIYlcGG6N6HukZVI/njZU8Fo+U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0Zu:yJle68uTOByxknw4FYnshx8OfVe247
TLSH
T19685E115F7E810E4F5B7A2758E725902EA367C9A0730D6CF13A4825A6F339E08D7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/2684-347-0x0000000140000000-0x00000001401C0000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
1740	alg.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
4380	fxssvc.exe
2440	elevation_service.exe
4428	elevation_service.exe
2612	maintenanceservice.exe
936	msdtc.exe
3716	OSE.EXE
3812	PerceptionSimulationService.exe
736	perfhost.exe
4944	locator.exe
5036	SensorDataService.exe
3104	snmptrap.exe
1480	spectrum.exe
724	ssh-agent.exe
4876	TieringEngineService.exe
2940	AgentService.exe
4824	vds.exe
4280	vssvc.exe
1284	wbengine.exe
3028	WmiApSrv.exe
4532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\73c880f02d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f46a37ad640dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000930f4b7ad640dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e714d7ad640dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039fa1b7cd640dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec8c4c7bd640dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bab2727bd640dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
2844	DiagnosticsHub.StandardCollector.Service.exe
2844	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4380	fxssvc.exe
Token: SeRestorePrivilege	4876	TieringEngineService.exe
Token: SeManageVolumePrivilege	4876	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2940	AgentService.exe
Token: SeBackupPrivilege	4280	vssvc.exe
Token: SeRestorePrivilege	4280	vssvc.exe
Token: SeAuditPrivilege	4280	vssvc.exe
Token: SeBackupPrivilege	1284	wbengine.exe
Token: SeRestorePrivilege	1284	wbengine.exe
Token: SeSecurityPrivilege	1284	wbengine.exe
Token: 33	4532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4532	SearchIndexer.exe
Token: SeDebugPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2684	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2844	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4844	4532	SearchIndexer.exe	113
PID 4532 wrote to memory of 2068	4532	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1740

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2760

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:736

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5036

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1788

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4844
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2062c26ccb3a70d89e94b6603b63362d5b84f7000a2363fe657a1f7cc0765efd
MD5 b5d3e0581b2ade9a3991c1eb8d08912c
SHA1 99fcaba03c210c2cedab95a9f74201d21fb818f4
SHA512 d94254551d42c9488a0df41ef60eeb32849f4c52aac8751ed3591e5827f5463d40eff5187ca3f724d559c92b951fd29e876ffebc8d8d60ed407bc0d66dd566ba
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6x4x8EVep:N3q6mjBtix8EVy
TLSH
T106D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 502e3d06a4663dcd8609fa01dd5b3564b3e1c8eec9b3c2a5bf64b5abadab0909
MD5 629fdcd56d091cef9fd61e1402903a14
SHA1 2a886f1dc0ec36f8b56ddb76bcf5cf9f245e6ece
SHA512 fae84625dd49724b038e7211ee47c0e81a98096418fd26a42d9be8e574402899516366dd0a0b0e429f23081a878a3a7b43c9c989d337c9996dbe2886d588cb06
SSDEEP 12288:c1XLsswWkxy2lRq2czAG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:qXYfDtczAGyxknw4FYnshx8OfVe247
TLSH
T1FC75F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 84ca2ad3d94490a133c866743dfcc0b9fce52e54696ae71aaa2e56d22dcfefcc
MD5 c6728572a614479cf8346f1a239f28a9
SHA1 963d9da07fad03fbce7919366e0f585e0f2f96bb
SHA512 2fec56f25321b5f3ca599fcf1cf39cd925bd3b691db323ff6a9d2698918e6eceb90a0601cf680e39611074afae6e3f2102d5151c10c75f4f55e7ee749d55f172
SSDEEP 24576:s0Le5ji0hmxSrMHyxknw4FYnshx8OfVe247:sPji0AoHx4x8EVep
TLSH
T13F95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8ba223f541b5c6ea2f18b59c592aa067fa530cfcc3f6bf9d68d3fda651b3e7b
MD5 48215e2a285204d123ca4835f9789304
SHA1 9ce3ace911d7eb31e0ea7a13a8b961199553f7a0
SHA512 dec9cb55515e97ab16cbf83fa709ab293fdb8f38742edfcf4f271f7124974d0514bf3b03d55ff9493ee54a807801db861d894019c07abc48d6b7fcef10c5c4f9
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWj6q8wyuJyxknw4FYnshx8OfVe247:M/ezSC6vUzPv+HjyDx4x8EVep
TLSH
T17F756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e1a4b475203a8211b40468e8232f19b3a9c00a982c8a40c6171ee93cd61ef82e
MD5 27b1ee2ca7989900eea0432cd8f0cab9
SHA1 5c000b55c77bf21c5fb1670b1aabd1707995ae0e
SHA512 2506f39231b3ed1fa1112d4932c9a10344d3a8c7450f30bfe05e6598f137bea943bab651bd8f806beebc780cfc9ed6b447a7851ef3fe6ee3d4ccdc446a18d879
SSDEEP 24576:MVbqPb88hv/l+Biyxknw4FYnshx8OfVe247:MVO88hXl+nx4x8EVep
TLSH
T102559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 576d83caf5481e9723cfcb92ec97b2e5cf6e8168e854c3f889b708bbee76b2d3
MD5 e1817fcb5a48036f45267c7489d0259e
SHA1 56141af5c2596a5d2f6554d6e7f9f9654f8bb72e
SHA512 df612748863541e32ccc79876e0eb3a2ade8cdb8eda22c865094936cf628f30f4c2c47481f46e59e5954a6b8ccf1413841541fd056a24cc599d3b9b33c401b69
SSDEEP 12288:/aj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/ajyxknw4FYnshx8OfVe247
TLSH
T1A56523BCABDDE4E1F69E14331A7572223606BDA4DAB4C11BC778B54EE0B0C54D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 fff5c941665c57fc8d25c54f40ff9cd12ff0ab2a1235caa8b17d055196549ba4
MD5 b55b7942503692d9ec305cd173c6c163
SHA1 d4f45655c4acd4db873d7151c8c49367bde37a5a
SHA512 a2bbcde6d90c91a802b91dc29177ca3eb2b6c26a012504fec2df9a43fcafbc3fc3be9bd1822ccface315aed22274a66c855aa001c3e28f4352b2b7dbd53605c3
SSDEEP 12288:qeBNUbTVO86U6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qJIU6yxknw4FYnshx8OfVe247
TLSH
T1DF75CF7BEE28FCE2C27E5DB95B918200A76274704F6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4636eecf229b0e182d2a4fa22a59c858efdf9cc6b59619624077f24244928fe8
MD5 2b12fc5374c227954e930fd694c6a0b6
SHA1 de49be1584d10afe3069e062472ff03e27009c88
SHA512 ea37ed59bce4bb22d56b20e04722897e457a57e3aec1a4759479651c4e03e637b30831e7e16f945f261011edf034c7c55d37cf16de3c58085813d337f879c112
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:bQvGAdlCEL8c/WRNw5C8ix8EVy
TLSH
T1BF267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 7c075c2f7c350b65c4a290b4d87a20a515cf3b5f5776c0034aa296e3932fa0f5
MD5 a8522160264417bab1accbd2c864e982
SHA1 e9654d92b053743925050564e8ab89d35183f047
SHA512 f39b2ac7e9cf1654028907e73cba006533a8f37b1a8c75c9a2472abebbce392f3c8512a32765316ac6e3154326e6525c546f1e57889f429a633f89d97257d90d
SSDEEP 12288:0AwSfxL/2Dc3zDLLmt0LDQewsAjc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:J+ewsAjcyxknw4FYnshx8OfVe247
TLSH
T13B85E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3B89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ddea255ae4531bb002aaba70f4ede7407fe55ba94ca4a1463c9418acee3a111d
MD5 4a50a9cfa671e17a989a0d3b9528ac47
SHA1 abcd51b7acdcfb172a4db2902d07c2135fa261f7
SHA512 b8a9afe5101b8f85b865cee49269c3c4b1a83a09ca93437c6dd61bf42a866ed87a6ac68712dd9e274217becab8e431ebab7b746c456d575c222366eb186d14fd
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHa:2UEtQevvqc2W1cpV20I32
TLSH
T14C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2368fdfb331ea4dea7edd76876fcdf20b479ee3e5061c5a3bfeea51c2a77a781
MD5 86bff88ca97fd0cf3e1bdc0b401deafa
SHA1 3727cf64c8b00767a53fdf4468225a3e587c3997
SHA512 29625c5d1993a5381694751b0e56e566f4048cb78fff5cf86d652f0f5e2c303c20f14a73060eeb48036cdbc1bea30f0f48bac9ac96c94a3fb883422c1c0d5b0a
SSDEEP 49152:oCbRquA/m2yL5zLfFiV+XenmE3/zXx4x8EVep:Boq2VjnmYix8EVy
TLSH
T1B8D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f72806ac715d742b112415e6d90b8b1cda2eecae99ea53fcfe7aafdd358a05e9
MD5 e2e182746b7d12131638eab3c2c7b15a
SHA1 ef65f8ad1d84cedd3a5a09d1c4a8cddd14fabf69
SHA512 11e21f2b1e8158fd2e2088fa52575ebf733eecee8ff07d9ed731493097e320ed85750772a6a08115361310db6583b61009ec25485c8fc10bf3bf0fc311d8b9f3
SSDEEP 24576:xAhGL6IFoiwtA5l7S53Nyxknw4FYnshx8OfVe247:xAM5Foiq5Ix4x8EVep
TLSH
T17235AE80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 42687a061b982075a465a8811a00200fd3f4dc5e55f3ff36064e7a060be2467a
MD5 b22ed1e69cb559bd8bd85668eb35d0ca
SHA1 20db80562f3b5cff624218a7016f74a4eecd4ee3
SHA512 07bbb0d97a288d188955821a858785a4a4a8e0ecc0488702091e3556872151b3b534ad4da545935ca515527fc4c1cda9d149a59fa4ddef2e9cac3a776584f3d3
SSDEEP 12288:nmw5HEjsChNrBFgl0WDm+Cp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:mwumOWgyxknw4FYnshx8OfVe247
TLSH
T16A75F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 f126fcbd26b40af49a4e87db44a89452283e0e79ebeaf9f9bff9e50f5cd8ab26
MD5 f5336ce6c6dce2fe802756f0dc4c4ea9
SHA1 5eed9e761571760affd41c206ef0aefbcca7fcd5
SHA512 50cb42fb205f55de8500661859c1893b799ecb116284de0038552b43a1858ce409c827c540f26d23ae62d0c215a00ea59ffd69d5f25f6abec73179c333e27a29
SSDEEP 12288:lvZ1IyM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Zu/yxknw4FYnshx8OfVe247
TLSH
T1306512AC33E860F1E1AB113A89F15206E76274A2677183CF4768625EAF71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 34f4fbfceba9acf118451db4a92f4b6af33314ca78d0d9efde9a4bbcf954934f
MD5 3f6fa6644ec80816e5a8ef4875def23d
SHA1 3e7c718c350587c6db9af97a3cdea1b3950abdc4
SHA512 6b29a5677aed2b294fc955686bbaac3051765cdfe04bf309b7ebd23416f5b73abd2fbf72c39db65570a0913853ccaf448b82ba064e4d392f419e45512401e2c3
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:YQRQyi36YOcPDLvw2gAf+PN3Rix8EVy
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 80f020cfc50d86a2179a2be5eda9627f9690eeffec31e114d4b4aa588abf5d77
MD5 5248f30e80d7f565a27a1cc2bba14a36
SHA1 f8d896395f609a530ffc05b9c9694889e3e888d7
SHA512 fa21cc4b499e32de73a89b0c5212e9c80ff2c35eaa25e9da2160a35cce2ab0be6773498e737979fcbfd4d18602aea5d5894206630112d5ed836ec5fa486bb51c
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:+QRQyi36YOcPDLvw2gAf+PN3Rix8EVy
TLSH
T18E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 090d27cfca2e9986c379122076fcb5118b590cacbd5014bb65332165582db099
MD5 e903836c048ef11ea11e5733387c455c
SHA1 8cf4973604b70418041b722c5f8cfbc980ad7cf1
SHA512 37679a3b086c69166f8b9b3154c71689af3f2ff0d50d9eaef0fe2189e388c551fa33c3d0ca267923b212e1c70824411e800808821fb7ed87c4551f794c7103bd
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0Pyxknw4FYnshx8Z:o68Qg55nhkeWu7PNU3/Hx4x8EVep
TLSH
T19FB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 57a31a374e3463062831b1aa0d8f00cf1ab9476291f26a59e0d1e39f026fb799
MD5 476ac9a005f360f4552e4a210147cf45
SHA1 702c613979d9a6a5f75b01b2832cb17a65649cb1
SHA512 28a1fdd1068020ca482c5b6681ef39d501b92d69701617610d9ce07f316d7386038a5f5205aff80381e0e76b5978bf85c8e224d1b3934d05a223413d2560c2df
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99f:ey5112gYy5azzVvU69nLKnhZmix8EVy
TLSH
T17D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 42abbcd57108b1dde13183a5294c56f1b966427a30750f428d5c30dd3a42c63c
MD5 a0688a17c151fa12b7a21c9d4836ef4e
SHA1 8cdc43c5f6766bcf341c03589d6b15de8683c6fd
SHA512 de7ab54332e6493a32cb54bddc32d9990caaa9008168b4d075beaf0e92aaf8b5893889489670cf56f7936480a3abe4ade727ebcb61616c6876747d4a063f4150
SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJx4x8EVep:cu6JmIxd2dJix8EVy
TLSH
T172D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a4202e76223729afff1e5161913489d0bc6f39d000fed24b4d28782fd3e9f2ea
MD5 16f9b5ef9e913a01cfe803f83bc8c7b8
SHA1 72e63c43b13c67adf3a521e03a7934da4e88c915
SHA512 8f04e2f3bef7341a977f0598abe648eaece8c88b5172e80cbb7b10a7a7ba624fb5b8f7f908c1046c1ec35be26156fc48ff5b0a578211cc894696529568befcac
SSDEEP 49152:/1hpsNoJpF1A67U44CwH7R4x1x4x8EVep:/mifPqRYix8EVy
TLSH
T196B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d620949eae18fb77fe032849d60baf802fa0cf328d05adc5f99975c06520aece
MD5 7c3a4fe8511bde4f00d97bd0c50f096a
SHA1 04aa8cb1587e909d1f98e978e0b5008ee8ff8d73
SHA512 d06dc52029087b094a8afe3ccda18259210d702b758253576b0b345d907f28173a6f256bf56cd049252daa0300ed4e08e4f058264a8f999acd084ca6fbd7f119
SSDEEP 49152:fSuZQIY0Be2KkRVtOnks6NMHqqx4x8EVep:l5dKqi61qix8EVy
TLSH
T193C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f03647c3be5a642e8beaa3a78be49d4c4fd52ff7fef10e99bafc147bcac0b814
MD5 e2ed120b9b1eb54ecc48f073e73df2bc
SHA1 69d033bb2a8a1dcbc002154bfd62ae69b1b3367a
SHA512 541e66125e7f92e70ccb00c107d4f7ac2ab91f0a3bfc44a76d8e281bbc21b482f842b20234444f8235120e00a98e2e322e877afb262384eec43fbd9bf9fec633
SSDEEP 49152:jhtSn8EApI0figjgiDn0AP5w5x4x8EVep:CX2iWphkix8EVy
TLSH
T10A95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 8fce041414569dbaf8e7933e02e4be7880565fc08fcb80f614a6d7e6545225ae
MD5 acd69a72a6a77b52d9e9028ed0901ee3
SHA1 1a39126d201c11b95587c9217da635c46df2f654
SHA512 ca03c90a342d978bdbc3a85d31b544bc1f372880e67606afbc7b90c309dc59cd1f40bcd0647cbaf5a8a706ba78d5f7def4b0e7dbc4663ef37065afa078f0bfe1
SSDEEP 12288:g7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:g7yxknw4FYnshx8OfVe247
TLSH
T13965237CBBDEE5E2E50D11734A7133666609B5A5EBB1811BC77DB00EF0B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8cae8ff7dae5d0de8cc38335121e3f34fa09460ada1d91d00fc90179eae417fe
MD5 7fda58167f029095df02bdafca0ffba1
SHA1 89fc442c73321e3954b796f4966663e23e2e5e15
SHA512 98c0333725c1e71ecdc75d64599177690b9e5d6f9c43c1e6f3ff71806cf4aa4ca84a5f8ac075f677800f3493ab80d95a32027adb163fbabd91fc2df22a75b07f
SSDEEP 12288:Ro+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Royxknw4FYnshx8OfVe247
TLSH
T1D365237CBBDEE5E2E50D10730A7173666609B5A5EB71811BCB7DB00EF1B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5fc6d921ac8be33b56d8d828de6ef3f92f0c0577dea9e41f8ad58a21b40565b3
MD5 26f3095e594a53222820c3f0e4dc3eb9
SHA1 6e1266553cfa3e3e40a7b6bd9c313cb94593ed66
SHA512 3d84e28e118a0574beea2e68b9e083ac5a9ee4e4b4d0a7cca7507c715a804c0bc0542003fa469b4efa4d7f31ecbc51ef889868476bec7ca4a5b9961c2719fb31
SSDEEP 12288:zy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zyyxknw4FYnshx8OfVe247
TLSH
T13565237CBBDEE5E2E54D10730A7133666609B5A5EBB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 aad39f04659327fa9c191e6922bb154d5f260529937435630bdbe5bc7a58bfeb
MD5 281f9076d32a4eb3073d31a3dbc22772
SHA1 feb359c29cfc23bf8c9c2a979e148e80ef558f0e
SHA512 025411c2e9a396f49a5c231a66db11d4a3378de5f5cb22d1026feac3e8eb5bc43af67041e4f59487cae76571d075ec2cac1cda3ab2eafa132a89020c058eb11d
SSDEEP 12288:dVt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lyxknw4FYnshx8OfVe247
TLSH
T16565237C7BEE90D1E45A51738A716222B365B8E4E731825FCB24750EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 74a4e4eefc892cb96dbb23c00602105ab5bea1af83ea934664d9b697a7c859c0
MD5 1f20108781004f9d9dfe23e481a8a1eb
SHA1 81303ad6212950e14adec34086590af7f5a93cf0
SHA512 8094f25fbdf0b619340a20641b62e1432518e34a0afd508f1219576066e00f5a4390bfc84ba5836df1099481817bc2230b931f12a877a9f8f8e3dec7fbea3dad
SSDEEP 12288:G1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:G1yxknw4FYnshx8OfVe247
TLSH
T1D765237CBBDEE5E2E50D10734A7133666609B5A5EBB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 79c57f9051429938ff32b785ec76281b14f2fecc42aab8434ba3a01219660c94
MD5 eb0df8d5356370bbb30271beb06b16ca
SHA1 c5bcfce4a90d8496648f1daadad491a226b797d8
SHA512 937ee976678135cc22ddf8075a979e7c05c987f881dd614dc548789cd6f276a865b26089756104d9e485fdfdf1bda7ec47352d7775ce1d20007ed956471def1d
SSDEEP 12288:e0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:e0yxknw4FYnshx8OfVe247
TLSH
T17765237CBBDEE5E2E50D10734A7173666609B5A5EBB1811BCB7DB00EF1B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 90dfabee40fd2a91d4b35668f3405820778e7bb0ba387436376068caf7590c27
MD5 be3b05a1c9bb62697d0c458446c2f35f
SHA1 23fb2b5aa759616ff51e1db5a6cab4578a08d99e
SHA512 ef785d3735343e051ea45b20d42d9143fb389253234b3f980c1c63a226620e770d81829af0040f469a0664807df001f2752b8c059a79957a35cdb00b200cbf0b
SSDEEP 12288:xw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xwyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDEE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 fdbc2e9a6f3bf7fbcb6db57c5fe787e307d2d530f92003a8937044ced530b123
MD5 cb47458b0c9be69631d98d4887ea36f8
SHA1 9995bbb74ddd87387607e85b94c23f3e4d9d27f3
SHA512 bdeb56d96bbbd1e6fba7c97494c4c9083e6ff31a67159d5d22c326c9951cfe319c5b922af325163186df749032a5acc437d1b8ee60df5caff418290b959f9689
SSDEEP 12288:5iZwbyzzFEoS2cPvyI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8ZMqzFVSOIyxknw4FYnshx8OfVe247
TLSH
T1817501A8B39018F4EC67413FC9659916D6B27C694B70C21F43B8362B5F736A01C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0a784e5a94a68dabb2a4a55247643f9cb5762b8645b349f9d8faf8f012cafe87
MD5 c02b03108a2c677cc8fa7cc402f35d43
SHA1 e93493aa83d528577b0ceae506d4d7e0aa237eca
SHA512 271bce0bc04d0aed000989959299ecf433f10c4875db51d8c06ab9d6d2fef074f5ab4bd6b01699ecf04839466801df3b89b6826d38496456c995723bde6456aa
SSDEEP 12288:Iv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ivyxknw4FYnshx8OfVe247
TLSH
T1AA65237CBBDEE4E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 682b62bd355bbca1a974695ed48298d42877ea31826c2ed94205a6c302833cbd
MD5 d330a6b7dafef73a105f5266727c8517
SHA1 338d4cbf01d9defd026bb77d92f4cf9998e1c381
SHA512 dc0fe49aaf8702142269fca53964029c7c6567ca28306137378f9e9c8b0eebfb430a667f92032d7c4f96dd5475bcf8bb5a45856cb8cc5a1eb8dbb3af6ba344be
SSDEEP 12288:HT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HTyxknw4FYnshx8OfVe247
TLSH
T10165237CBBDEE5E2E50D10730B7173666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 8e8d8d6c51ae5b2132bb4e23b8c1b8c685366363bc19814bb8ea3a44267857bb
MD5 4478e16bb40de61682029469cc5b9116
SHA1 91ee3a75dde1ef1098efdadd1b1b25ab68046c1c
SHA512 4100fe4b095c634149a9d939db9da3b36ec32b95e82ad8678490aea1f024f118a2b614bb18153e0b20dfebd9e7af72bebbb62eece32fd1b797a97bc72fb81248
SSDEEP 12288:2yPz5L8M+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LzyMyxknw4FYnshx8OfVe247
TLSH
T15C75125B73E530F5E13A523689621602F772B8724B3086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 165735ac830aec5af1ac6c140e05d4bc8978cc42bce6214025a56c089eadfe8a
MD5 d53a1e46dea191273459f57bec4c81a4
SHA1 cd9ac21890182b1dee227eaf7615a0c822a88e09
SHA512 5c3796c343ce082171da117e78c4f1c4204951570b63df80d78de76352118a7cc7c321a8f6046bf6d0cb0945fdb8fa663ae289f5fd1a03cd67d7011366e71100
SSDEEP 12288:Fv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fvyxknw4FYnshx8OfVe247
TLSH
T18465237CBBDEE4E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b22d87044c768735bb805d6d625fedbc9195a920322d9cbfac8f63065f0fe978
MD5 1ac955f68c8bfcd18462d592704c992b
SHA1 c9873813c4cc649e102eb01fda88e179045d8cd0
SHA512 fe1f3ddfdf0c778b7d7e03fc60f27b674636254cc4146b4a14896ebacbaf963eba7e4b6996132246ec88d1e74ebc3428059b9296d7f50b54d9aca38d91e8256e
SSDEEP 12288:1v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1vyxknw4FYnshx8OfVe247
TLSH
T15165237CBBDEE4E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 0021673e48a5ca4bf1d519e1ce673fcc319ba6b3250231a7eaedb74e6fc1f6f9
MD5 84ed87e97334198e29e612a74805a3f8
SHA1 2edda23301029bdf81c994211e81508b2670845c
SHA512 00650d6772157d780eaba5866ea6f9dbe62d48ed2072710bbf5a4902f9a623c4768e57c1d182ad0d730037b6d940d2b283c80fbf6f386c1749f8daf8309f8ee3
SSDEEP 12288:ZyPz5L8M+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YzyMyxknw4FYnshx8OfVe247
TLSH
T17675125B73E530F5E13A523689621602F772B8724B3086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0a5d0cd9114da3597617edb1e76ae86598c364da1eada220a20d03d11cbc9b64
MD5 0d967ffb345cfe4b520c29635dfb06a9
SHA1 ddb667fab450abf0f331eda824ee2286b6969c41
SHA512 ef073e3a49fbe0457f7f7c2290744f63db55675b1caaf9aeac2d92e72ea90d75081f62251d28498b0419028244bf850c43c68101f94e7734cb155015ab895024
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71nNKbrh/8KBXyxknw4FYnshx8OfVe247:IP4m4IpOO67W8K8x4x8EVep
TLSH
T14365BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 20a9ce035ba8ef1b202c7f67d6dd6106b8670f7c8720dd7f7464694b89de56fc
MD5 d8703745e4f8f10bdfdfe5ef6b8a1663
SHA1 35d196cff6cf2e3ac5d61f3f9ad7297c5311ef39
SHA512 21a1150dc65b61c2464dbeadf107350db4b888de9389729e92ea04b067dc9ecb6f81dc04b4b00d0c5ec3ee2492a15ce07587a1df5eed3aa1b09972b59ff8b044
SSDEEP 12288:f0sf/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:b/yxknw4FYnshx8OfVe247
TLSH
T185750128E29852E4D06E2176CB625641B3237C6597F1D3CB93E0F53E2F719909DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 25cb983194022ce21ea549fbfde65ada2fefc98d78072593ddd55b64fa2a9d5d
MD5 9837bf6fd7fa437b1b11d64ee8290aad
SHA1 1ffc4730a228da8895ec251d6d950f57c6bf8a0e
SHA512 ffe3772d1c709e09e8f65709074288a9fa4f6b96c357959f87443476999f7bdf3abfa22a23281f55325ac21dd893f81fe6e3bbdbdbbc6cf8584cf52e1e5e2a7d
SSDEEP 12288:pf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pfyxknw4FYnshx8OfVe247
TLSH
T1EC65237CA7DDE9D2F56D25330A31A225361AB2B49F70C14BD768B11EE4B0C90A82DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7597614d33208d609c2c5abb9dddb5722bd75bd7d49bd1e6abb72c8b386ceacc
MD5 bff1d181e8e4ea0f6b98e27910d75024
SHA1 b667f54dc6ae67ea54231a7ea5f569459a207abb
SHA512 59a7f1d1f1bcb3efcdb227a1dd1c197b3a8ea6f4ecb73cc99a8113be39e96568b34013c7e7ce935be17cd0967d966c2584d4fbb36bea4698bed21fafaee6c128
SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQAx4x8EVep:Ha0hNYG4Jwfix8EVy
TLSH
T1B785AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 e78401f270794d0263526b58ff2cc7a48b1d17391e37252979e224e8ba124b0f
MD5 19a13dd194af82e2140c5c940a1b5f03
SHA1 eba27ab7c4d9a5ef7217c59e2c061120bf6e9e5f
SHA512 5cf1eadb492438ecee9240f781e89f4ae7a196872658498b6e5fffbb78e8c6272ff680712a8122c64c3ddbad6c4b2e237cc6eb3c718f9dae3b4189062ea0d771
SSDEEP 12288:VhbHjfX4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VhbHjP4yxknw4FYnshx8OfVe247
TLSH
T1F365117C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c45308f31f77b6a34a2081b186445ba84cd536010f8896256cf8af705b1b1642
MD5 52a04df6594eb71edfa4c1fb5d67cb0b
SHA1 cd54a31cb3725bf6059fa7cf50bc1c58e6d82ddd
SHA512 7ae8a6aa7cddea074ccdc70da530042ea85171a08ccd0ff958dfd65f9aaef5f32884ac1a3f7d7d4fb4fe2d5698d47f339e079af3218bd54249109057486d126b
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/gyxknw4FYnshx8OfVe247:VIgnaTk46pBR/jx4x8EVep
TLSH
T1A945BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 eaf0d09528f0f96ccd889da7a3dd51f0431e6db888744cfeb17b50cac9e6b50a
MD5 61f0baf5899a831ab98502a01d1f55d8
SHA1 e9fc0fa3b900c1e4fabb033b1815d0ce84d03916
SHA512 8191679d1b5b8da9466a8a658393d7acbe8e1ca48116c11104c1a501e80e9dd8ecfd4ed65535504c7eb011a285a7e1d026780c325afe534f5426a6173c231e7e
SSDEEP 12288:HD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HDyxknw4FYnshx8OfVe247
TLSH
T1236523BCA7DEE4D2E55D15730A7263263605B2A0AB71829BC77DB11EF1B0CE4A03D613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 23c15a032a28965873e3196e468a2333fc108e98c132e69012a1fd0cb8eb653f
MD5 8b9b61a01442abbc2b192ed429265f3b
SHA1 46ca475a5a2b856ea72f4b1759e0ff2a320ed231
SHA512 9ed8a8ba2885e0ee673c6f66fe2111571910c81c7e6a468c788702e9dbd4c97118d3c945913ad8e94c043ac4d4a71bd6a4abafa1c8b0c640c398e105d21159a5
SSDEEP 12288:QObFA4LWOsvAYFTG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NxL3UTGyxknw4FYnshx8OfVe247
TLSH
T10C850158F7E400F5E86B813DC9B29612E272B49D0774E3DF43A84A691F636E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 affc2045953d4be0e8e2782c40b65321b1574a418af979a79f9fd98cf4fe57e3
MD5 8ba9a6773af5258fe458b01a7955d3cb
SHA1 7fa2783f9c5f03c5b0675947ab93ed57de2ca1c6
SHA512 aaa4a4781be373e83549e4ec79283be1c795ce3e594ea322af271fd5d42ef5b70e329ff0dfb2a9c72624940f7cd60cf5ebb9cd923005b8fca8393389c6d9d11f
SSDEEP 12288:cpFtgOa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Oayxknw4FYnshx8OfVe247
TLSH
T15A65022C37ED10E1E179613A8AA25309D371B465473253DF43A0917E9FB3DE8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 51b56fbbf44a31c0347f66e3aff7244b1ed7f3aa1b1ec7332e5eba67e8898c08
MD5 2ca8b6348baefd88ce21fb5add69ad57
SHA1 c5a15094cbab1063e881b92d672c51ff3d956914
SHA512 a2002010e86c6eb59e5da843cd56e95673cb169d814b19ea9db37626a9b273527a4c415b61bd453c63b6d8299bc84a1bc290061860dc00a430948ee0c741f570
SSDEEP 24576:M7NM9YqZqmWMUkPjZM48Mv6bEhsvyxknw4FYnshx8OfVe247:M7cBWMpPjN8DbEh7x4x8EVep
TLSH
T19C659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e682ed46e4f3a43b7691179f1cb75a958860fa08104b07703f5191a61435226e
MD5 8349e1396b1a839184bcc1723ef9b08a
SHA1 4e6829f6a41bf787fca9b550b247aebbef194f36
SHA512 1290907eb8116d197026faa4d0284165f263b33f291511646c0cd0a33ba4df325e09492dfa5b12a3a5a797948a1cb49364f5b448dcd5ddbeafcb26c6058daa90
SSDEEP 24576:fW6BApg2YuyuNDYTabvcdvNYf8km1xyxknw4FYnshx8OfVe247:fF2YuHNETovAvNYf8km6x4x8EVep
TLSH
T1D1858D2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 adcb035de4e03707f8f316f231caad87a1a5ae89ec9fa63638b291355e91c8bf
MD5 2ad0dc5801ca9405225d30420d551bad
SHA1 1bd130453c68f4776ba3be7dcefe336287b049c4
SHA512 5fc24a3d0134363e5f9c280985cd6d90f78e5c074e75443d86e06f6abb2ca7c3516af12c9adeb9ee7887c7b6ed38e8d8db5393486c9c5ba32f8f70cc97fa26aa
SSDEEP 24576:EAFs06+Omlf8NXEbTo+yxknw4FYnshx8OfVe247:JFs060loXugx4x8EVep
TLSH
T1B665AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 9a5d8699322f6635000098c418cc9ea728a843e99e0e13c883f949d2a1f62765
MD5 7d34277e0315492839f54e9054557d88
SHA1 cd9930daa95973705524fb9a722355b04ef70628
SHA512 e3be67cd62d32cb1dc98032d8a614b0c20be2c88958757c715a22cdde51c764e3aa86e9b5719b784ecd326435647f0544400956cbbae9b9d6514f7b0cea2e721
SSDEEP 12288:pCJnJ5D3Vkr8zxP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AJnJ5D3WoVyxknw4FYnshx8OfVe247
TLSH
T11785D03CD2A810E4D4B7C274825A2756BF72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c46b36063d85b35f763204a6092929bbbc0e8952e1edf2a3f0fb6dba15a17690
MD5 d45c5ec9e3e0f8e957020e5ebb147371
SHA1 231a846e2dca6050e5c7470f3f58b898645a7c08
SHA512 cd8e690dea5f9bc3061c9beea939b9b22bf9b78ae6c4605e06a6c77ccb989e5465e6b6d351b594422f9813ebc78059e004f287c74a6eaaf8441d37a1c7341192
SSDEEP 24576:eEPghm6/7IIXdwcXrif7qQncjlP65i3Vugyxknw4FYnshx8OfVe247:5g06DIKdwc+eQnSt65aVex4x8EVep
TLSH
T168955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 c3ce279a13dc8c2a7ca6ce92ecd8c16eaf84a496cb2b6d4d865e19cb1fd91530
MD5 e79194ff70fe82a1b7901bbcfdc1cc35
SHA1 038796177bb627698c1059b1981705f8913dd4e4
SHA512 cd550bf6dd1b49aa5ab770c5b265961e3a7fc1d5cdc23cd751f5ca426d19c9dcd2411bcd7cf864bfc8a6880a1394e494e17f69233ba61c48c28bae1f3c361962
SSDEEP 12288:FEP3RMp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GMpyxknw4FYnshx8OfVe247
TLSH
T13B65126C77DDB0E1E12A503A85A18205D372F0706B6253EF87A5D23E9E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 33f11a94718036856a6fdae20dd7df32bf698bf4df4b1666f77aabacdfc598fb
MD5 4635d2f7af3668c5894fa9a7203e650d
SHA1 49faffdfbe5db3fe935535dd1919092e78e42acb
SHA512 b23b759a1e5e52951bc0b368e7cca678da7234a2cf0f011114e571e7abb62d9279cbb6304c6740edf28738ff99f0bae074e92ac2d515f7d81b3ca36fe4fb465c
SSDEEP 12288:mjkyo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mIyoyxknw4FYnshx8OfVe247
TLSH
T19575121C63D8A0D1E5B905368A7352A15B35BC709F3183DF9290F63EAE71ED4A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 016d7b237843165754d72c9a582e97e591df40f13a43e9ff141c4dc90e8bf71b
MD5 4882b8af9288a657b59f67076b71d7a8
SHA1 17f01c65092df7f4a4112790298f39e19072b3aa
SHA512 f727508d0dcb37f4102a2cfaae4cc2674945399268cdcc6790e29fd3c621bc3d2be856fb5cec587b8e45949ccceab19f5c12a8b5108d4d7d8063f0829be45fb7
SSDEEP 12288:DGK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KKyxknw4FYnshx8OfVe247
TLSH
T10765237C67EAB4E1E9191173063163626215B1B4AB7191AFC6F8F13EE6B0CD0A03ED53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 269303611db5cd829d631c6cb9fced4bd6ad00c1a3778db9fffa4aa968162da4
MD5 53fea3ec2477c8b8e234b6b39021fb8f
SHA1 a76788e922d4518c460f2f80684dd0ff16c0d750
SHA512 45d64a223d9618328ad77ce8ce54c7923581bae2d5d4ce8a035be783af5ee4bbfc0f10ea4a78a31d363bfbb1bbd32d2616bd350eee02aa141e3817c71b2800fd
SSDEEP 24576:bQ9MxZKdcz9dw3nyxknw4FYnshx8OfVe247:bVKZyx4x8EVep
TLSH
T15D558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 1ebb505da535bc4377b3d1b0c531aac96d2e25d8b1674fbe55c4923635b2af26
MD5 8d53f76bbd10099c473badce8ea58432
SHA1 8b89bfd339b4891f36cf760d973788e3ccedcb9c
SHA512 97226c924c42642f3f99cbb9feffd666d87df19e6a02b64f9f4f0711a4491cbc96e9b695fb38ef1550bf5e924dc3568efaf47b7551a363acb5fb4ccdfe9e6099
SSDEEP 12288:kyoKo2SRple9pc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kyocgApcyxknw4FYnshx8OfVe247
TLSH
T15975E01FBBAD40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1f24a65dcc7f5d5d6148aeb497ff2293612f7d36d529f7e4c8a3c56db448322a
MD5 fa8e25560d11be97b142b1ea42fef4fb
SHA1 7349f4acbb35c8674afa8567d050e5ba169640f9
SHA512 bc13491be7da14b519bcd7ab0384c5e0720715ccd3bc4a1016d7bac62f7098a64cea28474445c5553e50923b51719ecf404f4e21876f08192d4198c5b1cde9e4
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK3x4x8EVep:J0zuNI5ix8EVy
TLSH
T1CFA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e361ce0e3255b7bb3f02c2732a038124bd4e22e82beb8a335c0026ed1efdab84
MD5 6eecc3b7d7a412ccff1e58ec32ece210
SHA1 231bb5df7027d7b931987b07276b55c63734799e
SHA512 894f3d0a9013d0c1a1ace0e0f84bc82aa46e913222c7064a2c53047cca1abac6342788f796d8107f7034adcfb12be950030f91d5f743007239c0f090660efdf0
SSDEEP 24576:R1QT7EcpfxR+N5AWAz3ooiYzjMqbpyxknw4FYnshx8OfVe247:0TDxR+N5YzTBjMVx4x8EVep
TLSH
T14A55B02EA7F815E9D1BE85798A23C512FB727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 ebf10a88487f467834935bd1a1f02780c12976ac58f4a094b4a3eb0f608eb46d
MD5 fa89a19a8e4fab3850b82564f898a20e
SHA1 0608d6c7af380b224e85df659386d40bc0eed7cf
SHA512 f28a9cc46d22d37687f87c708dd3d8f68ea16f8e8c0e60707549179e267b4f93450853004615d16211ec2aa037901ce63676237b18f2ff7a3487b1564a50137d
SSDEEP 24576:uTMdOz0FFS+TmSLtyxknw4FYnshx8OfVe247:a0K+TmSLYx4x8EVep
TLSH
T12685F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 39af79018eec8e3277c529bcff702896576664ad52fe1d1f2e92707030b97ca2
MD5 19ac6dabd80742a752953127e3651974
SHA1 fbdb2c9f8ea03a0ff2481ddf5ca8c5d3c8642939
SHA512 9aac6705b7734207389879d447d5d1028113d7e0ce25a620b57c72851b148ef73a1bc35d18606f8168131a89806c41eea719b7516600ac55e5236ef0f57437ce
SSDEEP 12288:e4pG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XGyxknw4FYnshx8OfVe247
TLSH
T1DC65122C23EC70E0F46A62368A325216A630B875673192FF66E4E57E9F718D4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-275-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/724-121-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/724-127-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/736-99-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/736-94-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/736-253-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/936-243-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1284-283-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1480-116-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1480-110-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1480-274-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1740-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1740-350-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2068-390-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-391-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-388-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-389-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-371-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-370-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-369-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-368-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-367-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-366-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-365-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-364-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-363-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-362-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-361-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-360-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-359-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-358-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-357-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-356-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-373-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-372-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-387-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-386-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-385-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-384-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-383-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-382-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-381-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-380-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-378-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-379-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-377-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-376-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-375-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-374-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-396-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-395-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-394-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-393-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2068-392-0x000001F5F5990000-0x000001F5F59A0000-memory.dmp

Download

memory/2440-33-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2440-246-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2440-39-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2612-66-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2612-64-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2612-59-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2612-53-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/2684-2-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/2684-9-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/2684-347-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2684-0-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2844-25-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2844-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2844-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2844-351-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2940-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3028-284-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3104-273-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3716-71-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3716-77-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3716-250-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3812-87-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3812-81-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3812-251-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4280-282-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4380-63-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4380-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4428-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4428-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4428-248-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4532-170-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4532-190-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4532-154-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4532-353-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4532-348-0x000000000C970000-0x000000000C978000-memory.dmp

Download

memory/4532-285-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4824-277-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4876-276-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4944-255-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/5036-257-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5036-352-0x0000000140000000-0x00000001401D7000-memory.dmp

Download