7b9b1554bee847bb21b7287929e2aa6a3511448cb8e7d91cf3b399cce73f6ab7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample261002-ws439sxtat
SHA256 7b9b1554bee847bb21b7287929e2aa6a3511448cb8e7d91cf3b399cce73f6ab7
MD5 2477005760383ef6ed8bfe18a1e8558b
SHA1 a522ae788f9c9639dde2d9fbac03307aded0b10d
SHA512 2f0d2ea0cc2c55cda7d8d84e474012fc01a5b2008b92a412dd9daa4a6c9e451e38431c6938f20f346d99abfb188e7cef30443dbc102a75fe39b57a7b8c1531d5
SSDEEP 24576:mVrsHVVCssH6M9+JbESZKWvfWiGGC5SYCWatr0zAiX90z/F0jsFB3SQkI:mVrs1279+VtZKMkBaB0zj0yjoB2
TLSH
T12365AE2DE6A801EAE06A9139EC554706E7B37F15137186CB33A0765A1F376E08F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4684	alg.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
2072	fxssvc.exe
4764	elevation_service.exe
5008	elevation_service.exe
4840	maintenanceservice.exe
1556	msdtc.exe
3896	OSE.EXE
4636	PerceptionSimulationService.exe
2328	perfhost.exe
2632	locator.exe
3252	SensorDataService.exe
4052	snmptrap.exe
740	spectrum.exe
3108	ssh-agent.exe
4292	TieringEngineService.exe
2712	AgentService.exe
3436	vds.exe
4736	vssvc.exe
4944	wbengine.exe
2940	WmiApSrv.exe
2568	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec8ab791288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b411ac939952dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea84e0939952dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ef552949952dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f27d7b949952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002db5d3949952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de49aa959952dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003826a0939952dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058d6b0939952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
3984	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAuditPrivilege	2072	fxssvc.exe
Token: SeRestorePrivilege	4292	TieringEngineService.exe
Token: SeManageVolumePrivilege	4292	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2712	AgentService.exe
Token: SeBackupPrivilege	4736	vssvc.exe
Token: SeRestorePrivilege	4736	vssvc.exe
Token: SeAuditPrivilege	4736	vssvc.exe
Token: SeBackupPrivilege	4944	wbengine.exe
Token: SeRestorePrivilege	4944	wbengine.exe
Token: SeSecurityPrivilege	4944	wbengine.exe
Token: 33	2568	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeDebugPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	872	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3984	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1908	2568	SearchIndexer.exe	123
PID 2568 wrote to memory of 4144	2568	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3676

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3252

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4052

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:740

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2940

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 af9a1ddea69331a0d096b4ad3030e6e8766fd9bec7b0c99d8e358b73f8829592
MD5 b21254ec847bb044a19d2a18836acef9
SHA1 1b9db74c988fab3cbf268d8602f2b923cceed2a5
SHA512 c2a84c96ac9f60790f0944bf33e290d1aea64ee91564c90ac591c4f7b75ba80d5f4c9d8ad83ab7843bdf131ce77113613ee2cdb208311c74fb818a4e5e26bd3f
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSaB0zj0yjoB2:W3q6HjBeB2Yyjl
TLSH
T13FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 80664be18ba30b963135e196bd52606b92802464c171a9dd72461c81b73ae8a3
MD5 d371870727c2d3990dd93a861f83d7db
SHA1 36ac66d8ac679f81cfca45b97c12f98168012ca4
SHA512 f3671f9de86516962b5b7b45e0e4d1179a353e727e43fb64d9bdb0d687a7f7381a8d31c97a3ae68930faf7ee26010da5c1b2f77045c511b17cf97d7eac3413c8
SSDEEP 24576:6XYfDtczA/atr0zAiX90z/F0jsFB3SQkM:htc4aB0zj0yjoB2
TLSH
T1CD650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bbe225fac7998a86792759597c8db63fd6745c3b0a1eeb008cdfb4c2769a9af8
MD5 bc94a113e119b4251c28f6663058ae50
SHA1 066da46e7751249af5fef0713b710457f9f912ff
SHA512 00d0bece0c4db1a3cdcb55f7be529b3197ab1b84c61b990fca46a86a27b0ce79bfb5bdb962cb3b6f2d22f0be3b9a2267983299341844d780db86b905e493f969
SSDEEP 24576:M0Le5ji0hmxirMaatr0zAiX90z/F0jsFB3SQkE:MPji0AcRaB0zj0yjoB2
TLSH
T199859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e9346069978aaccd86f4cfa5eef3b610da10276cae0740c419a2560e8a28697f
MD5 6ce2fddf0fd6c3533be7e18fe1d995a9
SHA1 d0bd35cf998656481335bdf26a48bed0f1238184
SHA512 3b6938dc6936cf906c942b10ea95d9c5d7104e2b56b1e5f56e8eb585d6d12d0ae02831e2a1c33825da618d68e8dc0a2b0599d990a7a80d0daa4fa39114e2cfce
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyuIatr0zAiX90z/F0jsFB3SQkT:h/ezSC6vUzPvxHjydaB0zj0yjoB2
TLSH
T1FF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fe8117131ab58ae5689a966eb9fa7bffee0c0bc385afdd5ede16bc0a45b70122
MD5 d0104ce2e0cb7f80bb34f32986bf5d19
SHA1 0bd5a54f0687651adfd8843e58e7632d04205706
SHA512 1eeaf2b1aca83761ec27fda7bd20d2534464e6c7167efa23f00ae262d7579745132fd6049af62fa60134f2c7bdf0089f45fe647cf723d249a65a174960193633
SSDEEP 24576:OVbqPb88hv/l+6jatr0zAiX90z/F0jsFB3SQkN:OVO88hXl+maB0zj0yjoB2
TLSH
T18155AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 42b273824ce4391997b57f84e6b02d7a19f6c84e191ca62269b13e2e20af37b9
MD5 0488d7d23c42fc30d62fed44bfdbe9c1
SHA1 a16950678b0c7eefc3a18036e203e14b91f785c8
SHA512 5f7ae94f3e6dbf340e8dab30362dcf80321c436f3c088c87971beeb34757425f1e10dcd47cd6038ef90a6ba2bc32a03c0111126952ee1ca8fbea0630b9c4b9ff
SSDEEP 12288:CR+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:CR+atr0zAiX90z/F0jsFB3SQk0
TLSH
T1C945230B240E80F2CDC32B3566989C4B1AB99EB065E2AF45E2D13F4F9D3C1C696656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 cd6682c2077470da8c527f91369e937b137c9bad1333f8af11b3072119f01878
MD5 a0982facaa575e833571e5b79988b05c
SHA1 441b50e4f35004a4efb336c458afdbdf1be5c96e
SHA512 4194ce0d2e02f09f65cbe8092911795a27374e9fe984669a5c0c6a84b1cad2ee2bb50daaa849a191a5ebd2c64631b58f100caaf91c8281ad56a2a8805cd4ae91
SSDEEP 12288:OeBNUbTVO86ULUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:OJIULatr0zAiX90z/F0jsFB3SQkv
TLSH
T17365CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 911f9f4cfd878e8e948e47ebefe7e74cf49f9472ace198cdb1bfca548e314d95
MD5 5e59a93488323f66ab518a1164f2d610
SHA1 b63c56e64f76f14ca8f8de91c174a35b238fec6e
SHA512 de50d44513295afedcc42d94c7a64928439b3b74d051dcb27c029f8451b8851ced95bfe2fb1ea0d1538892ae27e723f1d6b655769372e628e59fd4e4a1deb979
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:oQvGAdlCEL8c/yRNw5CXB2Yyjl
TLSH
T10C267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0fa7f4b610c393a418f9fa1a800f4122fbca606d418fb4fbeaf2111913294c69
MD5 c02bcca6511457df468eb4ff7f0ee76d
SHA1 9dd4dd93927d1890accc629cb9312aba57af3cae
SHA512 5377315f084b47ab99fa3023c992700c901618d332852ac6d7ec412f654176b477d4f37d5e8ec242cfa97a2c3b74fee435e3e729333e8ac6e1303ec94e5bc15e
SSDEEP 12288:yAwSfxL/2Dc34DLLmt0LDQewsAjhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH5:3dewsAjhatr0zAiX90z/F0jsFB3SQkR
TLSH
T12475E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8933fdf7da63aaebafcc905e608b95393c481c1225490a706a0cfa9ec888d0bd
MD5 5b05f190f73e2ed6c0566ea22de30825
SHA1 e2ad2b4ca019222b4460bb034a2c8de5921627b8
SHA512 15911b640a337993a3d9b546e04280f05bfebcabdce7b37889a21b211a5ae7110b3415fcf9cf553e15fe521773a4557ec189466130fa33927d44bbd14caf2e30
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgZ:NUEtQevvqc2W1cpV2EI326
TLSH
T18E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cdc7c448e2d16f5a437424ce195cc14380ce9df24905bfe91b4066bf93eba738
MD5 9ecd0f9edc70237398372b109ef8616f
SHA1 f5f4156ad4d03da322fd9b87bce477ba0ce1279e
SHA512 653701caaa927e261acea6ff3acc0a660758db9e3049462b7bfa26e31c48851013a4119e562241a97a09812e61cee62dbb004f77fe95e8e65cfdf9bcf549afbd
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zBaB0zj0yjoB2:LoqtVjnmbB2Yyjl
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cb3c75f831e9b9fb31672f361827bbdba0e2f95c344d6ec05ef5e1879f78de08
MD5 0f1f59cebfb21b8a10d16054573597a2
SHA1 f38a43bff5521f102f27468ac48d06137d596607
SHA512 223cd918d0d83d55dde2db02c9363f13d1fe7fa9048eea557f9ebfac4fac1e17071ca435ea976bba9daef58e2a0937ab5823f30c2353079e835f16740df1093c
SSDEEP 24576:6AhGLJIFoiwtA5l7S53Eatr0zAiX90z/F0jsFB3SQkr:6AMyFoiq50aB0zj0yjoB2
TLSH
T172359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f871400aa36e7e257591161627c938f780ec7db5666ca5fa6c097fc122450281
MD5 82d38ff7b8bf99240b3aebc7292d44b6
SHA1 2c0f9aee11d5d12373639cce59d2ef5db0c1ee04
SHA512 dd36d0f164261bcc1d5eda94af11dead9f7457a6b3c679b503100fbca86deb67944a1171c8a9706b02637ba2634fcb4f5d0abaa7897f5c98894b8212750280b6
SSDEEP 12288:dmw5HEjsChNVBFgl0WDm+CoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:YwuoOW9atr0zAiX90z/F0jsFB3SQk+
TLSH
T1B565F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 36efe0f365f97cdfde265142221a12b19b50f9666b7ddd9f67a629f67087942a
MD5 ca7fb33375a5ddd494a71ac65c56e1cf
SHA1 3c64447670104dcf8481e44c5254c67a07b46963
SHA512 acd80a0ca92004236a89e84fa1c66fb04e000ef449fd94ea43c7884a6f40069345cc956867b861675604a3f9a5ef7a76d2c486005174114437d2dd62bbb7c68e
SSDEEP 12288:NBZ1IyxUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:rZuiatr0zAiX90z/F0jsFB3SQkZ
TLSH
T1EB55124B32A960F6D5D3523CC9E4490AD7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 484025c34992ad133349c0f7f0024f5a62ca42ac8b53d7fe1c3ef01a17b4bffb
MD5 aebd7d9934d4b9916ec7792d4d27dd6f
SHA1 49ca90b8de5f3916a6bb6d16e0357e4c382344fb
SHA512 9621318bd5aa5dbf49bdf4730dc133f613f11cfd7efdf89bf37e8a14b3c6d97f546a2ed67461833d9272e5b3dbe0f1aade9a7c77d44985b0332261d12e3727ac
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:iQRQyi36YOcPQLvw2gAf+PN3aB2Yyjl
TLSH
T19B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7a9ffbf62437c51311d61c4a43c1f1b0d2419ca14b64e1ff2f74af7ca5ec2183
MD5 6a1e2530ac7e85c7482c004d6f45a4ab
SHA1 8b5ae32097735c31cc33dde0b090f7efd139ff0b
SHA512 aa9ad391a518389a66e36744b6db2e77bd5f1d1e643be5b72e654e51f59c81abdf89f8b396bc0184137414884e5ee30e2b12abfbe604b3f925f0039c251ef58f
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:NQRQyi36YOcPQLvw2gAf+PN3aB2Yyjl
TLSH
T1FE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 58af75f6de16add3e33ee3b2321e1bd00bc20de5ad48ee8224f4c1c147ab5d7c
MD5 a6fa1a00ebfd74762d4bf581ec0edf6a
SHA1 b3a166e30945eda01edaea083cf496b1f8fe99cb
SHA512 c9c8b12674e52acb11bc7244407f0b5f63272832c6ea4733c2cb550a824ede916839d401cd94bdf31e1274d02aabac80429527ef162ef5f1b8ed9e71aa05dee0
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Satr0zAiX90z/F0:Y68Qg55nhheWu7PNU3/RaB0zj0yjoB2
TLSH
T191B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cc04b6ca6e55d39f5455b7cd23989c0991fff5d3ad55c82bb5421d6a2291a185
MD5 7f54b2b987f5520684abe0ed1672718f
SHA1 0962acd807e4cd05873dcfb60e9e00b0d2d1fc6c
SHA512 8424320015a9c41dc3026bcda0a9ff185748037c5860af43b712585ec8975811eaa8ed3b20d207207dc7ac7c2f53d8f4f5a80faac1117f79b806b8c3f0bcf1ab
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:Sy5112gYy5azzVvL69nLKnhZpB2Yyjl
TLSH
T1AD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 59706e6814628147866d707cabbb206bf2236d90bd1a0bebe21778abc3f12a65
MD5 571087571d17f728214bce0b1a4685b8
SHA1 2a13b7878494a5ad2c8dddecf0f4e53b1524eb4a
SHA512 85997db813f09cba43ae92483ba9dc76f99ad576a7d65182b97c6dc00605b4eab0533fb06ed4382e1f22103e649d6dde61d62a27da732baae1800da166a9a688
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvaB0zj0yjoB2:Wu6JmVxd2diB2Yyjl
TLSH
T1F0D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 df564778110b556529d2dcb1047c50e055fa3cc17fd9e865b458b49b137b2731
MD5 e3804c8394221acaeafffc9db1fa772b
SHA1 72df9217eb473302ab9fb579072af8121db8c693
SHA512 efd7c0ff560f9e2abb95f36d049b01bc4d23e66a9218d82dc1a56e4ce7554149f983813660de364c729cdb111ffcbe29a39f89b8085135e798b8bc874e2b6c39
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xraB0zj0yjoB2:DmifPbRbB2Yyjl
TLSH
T1D1B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6225d8a3ed19a89ec9733b6404fe262a8825bf4c90b74eaebce2252eab973657
MD5 2c3748b96d699fdeff228b9e1bd93b1f
SHA1 7ab87ef1db2a8ad65a579012cb7ec6e880c8d3dd
SHA512 125cc253ccd8bbd0f99d0bd1c94a304a47c7590eb39a237bbdcb28bd3a4536c2b1ab86d2575a422bc4b3b8ba2db3ace408a939297194abc4b4726c0dca9dd09a
SSDEEP 49152:gSuZQIY0Be2KRRVtOnks6NMHqiaB0zj0yjoB2:65dKTi61lB2Yyjl
TLSH
T17AC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10b465f113dc9d7f0682c4e8b213eb01f3cb157f9e272ed878d000f1d654c6f0
MD5 12c2f6642921c7bf14efa8168700c9f6
SHA1 0f0bb5057036b2ee6a32093d0cb36c70b724aa27
SHA512 570cc99c0116353165942d15edf028495ca4a87403b8a813b1756a97cd2d35891aa2f408f0d57cbe774af18b66fd1af346a2f4e4d5e8868fa9ffab91b7e863d7
SSDEEP 49152:4htSn8EApI0figngiDn0AP5w/aB0zj0yjoB2:pX2iyphvB2Yyjl
TLSH
T19995BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 80c63324af60636f12c46d2cc186679ec013b2f74acefb2c13c8d8c27ccf5b2e
MD5 d73cd50a8e6e0efbfec6757a7eace181
SHA1 822d7ad5c4a168c4fe6f695c849d4502c4f3e043
SHA512 13d89724f17c9dff7006280ab23ae67041526389e56e5acdf896b379f1ebf138809738cd26837c344f424349b38bc4e378532bee829682301be3e0567aaa6185
SSDEEP 12288:YmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:Ymatr0zAiX90z/F0jsFB3SQk1
TLSH
T1C545230B341F80F3C8831B355688984B5AB95EB4B2D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f6a37f2488df53dfa0132428d8803590d477a255ddb85c297b83d20c733dbcb2
MD5 70dc9ecf88fffd8445041ea2c2426143
SHA1 8746b1c895001d20fc7d1613ad39d8d87c225c6d
SHA512 af630bdf8b1faa641320c1624f3848d1f063b304dc81f3b3c5a5e4715c24e7c9690b42828d7963634107ecf05b97589a21dd7721537695e2732eed9acb8d0107
SSDEEP 12288:t1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:t1atr0zAiX90z/F0jsFB3SQk2
TLSH
T1D845230B341F80F3C8831B355688984B5A795FB472E36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3ac1859b0a40d64eb3841f31b421647ebdef10744e149bf215b6935818a6b6d0
MD5 fd737a9cd440a73e6b2a5630e20353a9
SHA1 f13f9399844073c767c0804c290323ab806ae81e
SHA512 022ddf63882fce33305e3ef6de36a3a86a37454907ba8621150d12b3f75caf8475976c88771412da9359197b2a35c728697c31f44ac6dbc77874d78b0782b264
SSDEEP 12288:LTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:LTatr0zAiX90z/F0jsFB3SQkR
TLSH
T1A045230B341F80F3C8C31B355288984B5AB95EB476D36B85F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ad4f354b734c5dbe9e7bbb09c69205fa6f70cf4befa62cd88bd5b0017c4fae57
MD5 f808b14ac847ed61959509a824098f6d
SHA1 2e7fc2f56ee70bee660b54db46398d7a4feb9923
SHA512 b9edf18aeb001a3696b3dfb168238396fa798289ebfa184297743f01a4d1a696edc78154ff8774165d02a682f5e3f711d56782ec800fdc948471673a128343a8
SSDEEP 12288:3VkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:matr0zAiX90z/F0jsFB3SQka
TLSH
T18945230B351E40F2C89397358654884B96B5BDB0A3F3AB9FA2813E4F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a64912d7128d685cb42a0eeb5a12b46a16a3f7e8e1172f2fdcf5f7079f810fe4
MD5 1e9c903d8de492b6d0b705f14f93a171
SHA1 b0006ae9dde300d0c9a3f13b4b4367a5c9fcb1b9
SHA512 9a371f99dd3c78dff9e83298f2e32cb45dc00e6d4b5f4f89329634c7e7f3622b130c5a9825b271472f5a12ff0df230fdbc54e5d4e3a148f42761726f4f025858
SSDEEP 12288:v8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:v8atr0zAiX90z/F0jsFB3SQkf
TLSH
T15845230B341F80F3C8831B355248988B5AB95EB476D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 38ef709748f5c3fb7f4415c7565948bc78b51b551559e11ab91e57614c60c86d
MD5 c11752f730cf2e1670c1d73484a3f954
SHA1 dd0eb00a844af27891fe25fb2d8c4e5f01cbcd73
SHA512 4fcadd17fedc6a4fdfbbec799297353c11e7f2855edea022c5cf2681d57a99ad4691bf5354efc85198edac242b931091da1dfc6eb1b41178b621960bb6ebc580
SSDEEP 12288:0pUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:0patr0zAiX90z/F0jsFB3SQk6
TLSH
T12145230B381F80F3C8831B355688984B5A795FB472E36B85B2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fee2a0a3692cef0be483d7443b06581d11bf8ce228167510cbfe9f9fd3867010
MD5 a724a8e1496879c10358bd2b50eaea99
SHA1 c1242eb812cb63c203f72dc5bb578f9095ea01b8
SHA512 f3e38d6d138d4ef9c862b16a7ebabc6cd73c2e2cf323a034d0b97a58301fc6247363ea8bcb32f5e13d9a1180be795f478a5cfbbbbaed1becee60288208b62132
SSDEEP 12288:4tUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:4tatr0zAiX90z/F0jsFB3SQki
TLSH
T1C345230B341F80F3C8831B355648984B0AB95FB476E3AB85F2957F0FEE382C625656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3fc6830f348f06e10e3d6ac3e3dff4544c2470ae20162fa8fba3dfb1e1440787
MD5 b56d1b972c9d71f72fc25e18949ee38c
SHA1 09f1015cfbce770a31b35adb66807a5a3b6e2998
SHA512 c9d25d31495c2f702d44cbf5c0046f5791aa18e6e2e29caafc65ba3978a6cfd20d9b62b7cdf0100fdc259cf53787ad04e30a58efb1331ef9181e9961b5d60c27
SSDEEP 24576:PZMSzFVSOVatr0zAiX90z/F0jsFB3SQkM:PZMSzf5aB0zj0yjoB2
TLSH
T17A65019A735018F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bc3c5f1914e0121842b613fdcc7c63ace60a66fc20b7a28805405274c3ad9f6d
MD5 975d01dcd1fc14f30398ebcbd336dfd7
SHA1 43ab12a2c8c9017961d92b5eaea41487a45b9f2d
SHA512 2f131ec6ff3ad6e060f58944d3a88dc7939e6ec8af805ff5d7b6d53ae8f0221155deb4409592744a168f6aa6d1ea1947c52538a0131d7d1d73df1ecc5564d80d
SSDEEP 12288:UyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:Uyatr0zAiX90z/F0jsFB3SQkC
TLSH
T15245230B341F80F3C8831B355648984B5AB95EB472D3AB85F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 10aed1cdeb45256b381eb53ec113d48fe9ca0b504d7a8c00dbe441b93d052ccd
MD5 4f4c3df95104eab6d1c8d0cdfdb5c86b
SHA1 c9c9fea3837c140bf90d2ef10151d57c997302f2
SHA512 10e20342a573dd0d456d5dc22c7a64e0bb5476a0dccbcc7894e41e8196f9ee402eddc07e7dcbce43e6c63cd8564ff0679b0e5962cac15310495761096705c364
SSDEEP 12288:GOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:GOatr0zAiX90z/F0jsFB3SQkC
TLSH
T14A45230B341F80F3C8831B355684984B5A795FB4B2D3AB85F2953F0FEE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b6c23af2b5c44c0112fa9a097ff48ad7a27f23078fab9991a97625aa2427a5b4
MD5 a78238d6baa2a144cec4f7b4622d045e
SHA1 744354e6a94da82be1d9d183a601cf9e861d61a8
SHA512 5785dda22d6a5f114104138c4822849d7f3d59b298bb014f3fb560816a841803b175e47716088f4f2ee9f4fbd71209de16c7f60a8a901e05686c841ab5b5334a
SSDEEP 12288:wyPz5L8xUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:Bzyxatr0zAiX90z/F0jsFB3SQk8
TLSH
T1CF551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 34ff59c71e9400cf4e44bcc5bee8883315188e589432cb7a4073471f15404678
MD5 b233712d94b8bbb50d9adc259afec7b4
SHA1 bf4c02f9a7cf28a767ad3336bdec48c100f54b95
SHA512 487bd91311606a37415a26cba8288b7a03c3fad2a6d32f76886c0534b1d425378d088c0f3de4d00ad3343616109e0e62954fa3b01db0a5cad384ccc71dd325c7
SSDEEP 12288:5yUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:5yatr0zAiX90z/F0jsFB3SQk+
TLSH
T13745230B341F80F2C8831B355688984B5AB95FB472D36B85F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8210819042369d2e71101a9101643465c60529e93f0e36615a47e5feb7bf5cb2
MD5 620264cc280356b6966636a1f2f64f5c
SHA1 a6228217e73bc997214328dd40f7805229087d98
SHA512 7effba566cb498c3f288636392868629c82f4c1838d5d39588045a217f7e2219a6405ee1e2b0ecb5fe9b4572948b8110879d8d57ec864adcea294275d9f94685
SSDEEP 12288:6yUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:6yatr0zAiX90z/F0jsFB3SQkb
TLSH
T19445230B341F80F2C8831B355648984B5AB95EB472D36B85F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5dbfaae99fb556ae0bce9b42d5cf073f599e121cefd4207a7db6a23a930458be
MD5 2b8421e6502390a46e7b68ed2bfcd66c
SHA1 5566a8693098df8dcd2523081d7cfa6b1b0580e9
SHA512 29a3ca215b0aa44a008008d47dad4e0a12b2bc277cdbf91a3de3387450835ba05bea7d2b46d413bf92a1f6b4594160bf8a5b49c04254202a6abdf244ceebec2e
SSDEEP 12288:0yPz5L8xUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:tzyxatr0zAiX90z/F0jsFB3SQkh
TLSH
T19F551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a30de2bfb1f5abf8e793779745aa3bffe86552339f3c1badd0b7240c925f9bbb
MD5 d3e2f37881194ae4fb332aee70230840
SHA1 1f64c5d7224599e8ec4c1d88ccd1e78cdbbd8867
SHA512 1371444488548cda3a0e4e777043aaeb1d959bce00301a2630755d2b3d35213127d0ff90b8dfb065e90da320554c6b46d0c74d5fc14b9dc80f698dc120562ece
SSDEEP 24576:TcP4mcvIjkGOxhKP2l71nNKbrh/8KBKatr0zAiX90z/F0jsFB3SQkF:oP4m4IpOO67W8KYaB0zj0yjoB2
TLSH
T1E165BE2DABDC0096D0BB913485658A4AFAB1742A1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4839c9ba24bce0cfdd0d46004e5d854c9737b67ff21d6632adb2aad5e3d9a82c
MD5 eba5eb279ae702313b4f4afa9431de39
SHA1 2be53dfe13706d9b19dc47f148b380ae029fc1db
SHA512 252be7bf8d323189279e545deb5697a982f856d3d266f1b254dc44863e8926037805010bc6965fe0de826b458471ab22fa2d13cd5238d8ee9b0d1ba52ff576fe
SSDEEP 12288:xNsfiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8p:2iatr0zAiX90z/F0jsFB3SQk8
TLSH
T17E55F00AE25801E5C0AE6235C7544A42B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2dc1940f9f06f3092bf85595ac26c0eae2aa20a9d91739c04ba188ce2eca454f
MD5 ca05fa0672e74a90159c095e702f7ea8
SHA1 740e9d4fba4d38b8cb6ecd57f1c5010423525242
SHA512 8ef3912048bbafff89f7a240faf55593e2b6b23c3a6c682777ec7a49e19e80d460bd9e50523055dfb0f64048cd9e5297edc2bde910f6b8757532cc70c6817f89
SSDEEP 12288:2CUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:2Catr0zAiX90z/F0jsFB3SQk7
TLSH
T10745230B351E81F3C8E32B301658881A267E7B746BD29A8BF1813F4F9D385C259756DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e1c28fb7338b097bdfd79789b25928c159c82085b98aa0f0da72b48590501a34
MD5 61f0f1c1c60e43292f9f784712cddd5a
SHA1 7a00b96a59cf8bcfd61c7e58f0136e75d0a4e8d0
SHA512 2a416e96606845dfb7d855b921c1a28985bf12b28e4b2493bdcfac53ae61b7da061ae7b5ec96fda65d3e6f86c1899092f7db750383bba06b56e92535b2a22a95
SSDEEP 49152:Ta0h2GEkuAe73q3pp46zwwQ8aB0zj0yjoB2:Ta0hNYG4JwgB2Yyjl
TLSH
T19485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0ea68042f4a0fcdb0bf170acd6cda342e310a450737b524340c4dcfebc5d0942
MD5 ffe08ae5f866f303d604224b872ac255
SHA1 8d75fe45834f996bdae26372ffbc00d224953a79
SHA512 2136497feb253339e5d8d38d472903a68c17161b42f25c9c286711671ce96798080b920fb323585de87b7008b5173536ff2dd4c8abfd69529864b4de2c1012dc
SSDEEP 12288:chbHjfXlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:chbHjPlatr0zAiX90z/F0jsFB3SQkA
TLSH
T17455122F266D10E5E4B2A27D8584850BC731BC351762A7EF22C1A27F4F3AAD51D35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 868d799db4c06d151c8ab0c8b79a7d3d5c51d512f6c8403147b3d8db262cc716
MD5 ed4f2c88932e815018dc61a52331c85d
SHA1 824288a0eb0f60832ed37078239d37ce8554e9b9
SHA512 c26b810d37146f8dafe5b5e9d467ed9f746db390729d3c2a622120744d20739f81108f3d36a8e8b43cb68d123f4205c9e94b7285e1bc1c1d587caabae3167ff4
SSDEEP 24576:I3YgnJcRTk4yti+R5dBR/9atr0zAiX90z/F0jsFB3SQkv:IIgnaTk46pBR/9aB0zj0yjoB2
TLSH
T1FC45BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1bc9444eb5a4fde6a984dba9e70e5e1738c578b4ba39946fd47af7448743f146
MD5 35f4c96ea52454acf4d963bf003fab85
SHA1 8503dcdda593f4266b16926e2b9ec9697814e4dc
SHA512 6fd53a1174aa6635e51bb7ad57af7320bb878dbfc9ab30507e1e8faa23e7a87404761efed41d536495b15429429544a54843f5e755e55dcfce7e99aef228db7c
SSDEEP 12288:deUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:deatr0zAiX90z/F0jsFB3SQkN
TLSH
T13145230B340F80F2C8836B755688884B1A796B7063E36BD7B1917F0F9E386C766756C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 de265004645b1825af41197d27aad965e4a031198466c7de6b284b353f75942a
MD5 cacee3d18d17504653525e498e6343e0
SHA1 8f0b9a5586a4c9c96b1d67a6b0d9020ed0701ca5
SHA512 0e5c8f979d9827e05fd1970b48ae16daa9ab409f309661879f489b6da2bc958cdaf745a119554d7e5acecfac0f4595101dccd04ce1b872a412a8c80289c790ed
SSDEEP 12288:oOb9A4LWOsvAYFT/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:FpL3UT/atr0zAiX90z/F0jsFB3SQkw
TLSH
T136750106F69500F5D867923CC9A68917D272B86D03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f8cc81f7522a89d297de5d8a1f4956b8646339726d6a5a5f50ec9df968d4f2b6
MD5 a5e578f95d0a70cd828201873e9c3caa
SHA1 b23b6a44857e3ac86affe5a8a8056160cf605b0a
SHA512 d5f36034aadf0e2a7ba261a252964d7c5e0aeef8d7ee4e87d9f7e3c29c005b9b92e6d90c83527c7b227714bc2524b44a0ffa7e416b92266b7172ccc97923c729
SSDEEP 12288:kpFtpOrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:OOratr0zAiX90z/F0jsFB3SQkA
TLSH
T15B55121A369D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 385f86f051993edda990ae25a2ee956bd81df4b71a0dfa1ea31c15355f57e7b0
MD5 223bf65acf68c107d43ec39fb19e0e39
SHA1 1ac7d1a48ff96b199cef61ceba49c2ab4b803c50
SHA512 e7c9509034494d1e946397e7cac680664ccdac9d2006344364db3c911d5a798af85761e0a6f0652fa05d6f5d0a95c8a0e35dbdf02eea3aa4bc206700038998a5
SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsyatr0zAiX90z/F0jsFB3SQk2:V7cBWMpPjN8DbEhFaB0zj0yjoB2
TLSH
T1B865AE2E6BAC81E5D477D13DC9A28206F6F2B4611B318ACF5152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 778c7a55bfbd8132f420a6609e2c749d8f71735bddffd9e5d6b11299666e2612
MD5 fd5d385bea75877c9f6266ca78577b9c
SHA1 f8af3fba5006d1add5c1843d7de01cecd45ebd67
SHA512 159521ae0e8a35c56af9c3c582293d6ca4c90735147e735af7036f8fd065290bb19e0164e7d02468473f702b2527868942eb95a9c4d442964f6dc542ab6f1739
SSDEEP 24576:iW6BApg2YuyuNDYTabvcdvNYf8km1Aatr0zAiX90z/F0jsFB3SQkc:iF2YuHNETovAvNYf8kmSaB0zj0yjoB2
TLSH
T14B857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8ce0f45d2eb61a33370a46f22ab7a3ad4e4e653028157dc9fe92413f8f867ee1
MD5 3f8fc0c3f180637d62c4b1edf54ab5f6
SHA1 2c68f3fe1474537b55f8fa2186ed1c1aa26644ac
SHA512 a6a86785400fdd20fdf760ae17229a99d75209a6ba2de951bed31e0411052e02fca2a877ba2be5650b4e61e370079a203c81f0fc52dc407fab8053bcbc9191c2
SSDEEP 24576:BAFs06+Omlf3NXEbToHatr0zAiX90z/F0jsFB3SQkN:WFs060lVXucaB0zj0yjoB2
TLSH
T17265BF2F66AC00D5D07ED17D8A97C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8e1f7ea6db88dd6d08e946586af4dbb681afe03f7a8d0f0b21f65fcf74636a04
MD5 ab76f17023cd4ce71c683109108f2991
SHA1 9d93f35545e7c58a7977ac304edc7bc4d41a0f04
SHA512 8de372ad23990d53eba150b684d289e92e0a0d1be71070803d4b49dab889bde2b3ccc98c87be66cff2b4c1f5ec1d89a96ba5b61eb060e223c679ed3289f41b7e
SSDEEP 24576:+JnJ5D3WXcatr0zAiX90z/F0jsFB3SQkV:+JnJ5DGXcaB0zj0yjoB2
TLSH
T10575D02DD2A810F4D4B7C27482591B46FF72387D2B226AC724B4E5357F22EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5af7f5f31a4c997c9b1961c4504e7b9ab42f50f88bc36af4dc9abd258e4d6823
MD5 f3eaf2193da340af7949c6fbb832ea66
SHA1 10e5244c253eb4f573646e26454235b463f543f7
SHA512 88d14c7c4377ab2046432682c4bde0bf566de32a4b68a0ea6be4394b3a66b0be3efbea0953b7a63bbac072a37ffbdc275c9bbf50b1926172c5ba8ff30047e820
SSDEEP 49152:Yg06DIKdwc+eQnSt65aVmaB0zj0yjoB2:Z/B2Yyjl
TLSH
T1E1956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 84f591fd60a362d389eb077c93c6e2fc537b1935ead54ef684d982c92450c5af
MD5 87ff349c416ea403a5a7f8e523f9d740
SHA1 795c32614210a6f92397e16fa3b67546312fa31b
SHA512 d4895abd194cfed281960f33a71ae05bbf09139606103e0027803aca4033af3dab653a3c30a04d33538fc33780119dfdb33cbc6a55f6ce9252dc42309a39a02a
SSDEEP 12288:rEP3RnoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:wnoatr0zAiX90z/F0jsFB3SQkB
TLSH
T1AA55125E365D60F5C463A13D85908506D3B2F07027922BEF52D1E63F8F36AE62D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 3bd5531fb3acb11f48aef3f2f3ef3f0e51bd6a7d8dab401d3eefae88300cc498
MD5 d7f5aee3c1f11e72e05596a3b6894ebe
SHA1 151fe753f31a2fa9f1079134ae56015766313901
SHA512 d225ece89b46fd4cbce5b2e26e4a0604285ff7c8c0be91b075c4b25d82cff7011994e14d6863e91f614015508f00597afb53336b17589e467ab00e94e95b2e9a
SSDEEP 12288:cjky1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:cIy1atr0zAiX90z/F0jsFB3SQk9
TLSH
T12755120A335890E1D9B306389AA181855B75BC306B6297DFA1D0FF2FAF357C16D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 bb2526af20409391015e2020e19b8dc12ac2c9ee26da15b71d83ded22909070a
MD5 72da9c38b664666999f4121e3d70be9e
SHA1 db6470f000a37d78b030fb10de0145f8873f49e5
SHA512 1773d0268bab790a000acfc7fbbfb0e4266ea196eba2fee7bb87769e40ddbf76c14bb911abf888e0fc99efccc243789a0598e3641a2144222a0f295c77bc5d97
SSDEEP 12288:ey7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:H7atr0zAiX90z/F0jsFB3SQkO
TLSH
T1A545230F341B90F2CC831B755258894A16757A7027E26AEFB0D1BE2FCF382C62575AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5ad788e4246d2c3787beaa6a3fad0ac3f4a6a732cfa242b238ee52a90ed35dbd
MD5 50de2d382081793c3740a9cd821de9ec
SHA1 44bee4b0496bbc1968c089410abd42715279ffc4
SHA512 243d2446c8d5218e27fb13663550ee1a38ea8400b7b90816d8aafd0f1a227c2a18bd2b4f3c8fdaee64b39bd64cfb0e6c9101e5084189b574e27e445e912840fc
SSDEEP 24576:VQ9MxZKdcz9dw36atr0zAiX90z/F0jsFB3SQk4:VVKZ6aB0zj0yjoB2
TLSH
T1AF558D2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 828b7b15b33d8b85f80f6b1275866eb2deccb7a4b71e1e65ec607469805e30b4
MD5 ebf60f6edd21974281ab8c7ac156e3ab
SHA1 1da345abad13606fc21eccac932823f1734e9563
SHA512 21849d2a816b3aa37d2e20939feb615c862bd1b908d03ffce8c74fd95bccea5d9688352ba3fa8da93a30ba392a78304acb76ee3da6884835ba903b6b55f6cdab
SSDEEP 12288:SyoKo2JRple9phUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:SyocDAphatr0zAiX90z/F0jsFB3SQkt
TLSH
T1BC65E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3945242604500488ba411355a612b1b6fa97dd7eac12dab2f42ca68be9c2935f
MD5 624bfd698fcdfae4f1c9099d4da13c77
SHA1 b07f88cd202059cf7a735d1b0927e41f9a587ba8
SHA512 975f5d44e257dc1e952bc19b37e0bf798a7320404e13a069d5083b95f516d4ad37cb4c79a6a247c354985dc37bdbb9466f8e19a22622dc1f3e4934a263550f9f
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKhaB0zj0yjoB2:O0zuNIyB2Yyjl
TLSH
T1A4A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 262fe56db09c6d680bef1a31e6199f6b2b40a6a14c6a5f76c762084a4b053fc5
MD5 edee07c832a20c01d77590d0936211c8
SHA1 39f80e9c5c90900e404d1ed235429cc93560e236
SHA512 28e011f7f1865e1925c459c1475445f3193a9ae5925e49ee08a990f008aca04f75d9c90927c60a51c05ded667b9a8d6073b5c12938348a1485c8b2c3aad03ace
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYtjMqboatr0zAiX90z/F0jsFB3SQkX:7TDxR+N5YzTfjMLaB0zj0yjoB2
TLSH
T1C255B02E67F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 52fcf7ec64a9ba6b1da1db21ea8469bb56e1ce6e2fee3e5332c095c253fa9e85
MD5 07e0cdeb6ba47bbd2623ff5b7b1892ee
SHA1 a6a3287dd59aea126e1c14c4681213f298d6d8fd
SHA512 2fa7c1f360b3e4b1ffc7256a74279d254b18b208cf9ecda855d661bd76041e363f64d9ef6aa978926449328ff76b4b41fea6df21621d8f99e1345b2d8a973950
SSDEEP 24576:ITMdOz0FFS+imSLkatr0zAiX90z/F0jsFB3SQkB:A0K+imSLkaB0zj0yjoB2
TLSH
T1B875E13E636D14F5E47BC27D96428906E67234710362AADB06D0D17E2F6BEE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 2427067c7417b0a5ac36d1ed7f3ab6f5b88a95dbb0742ea02f5ac40161dd7056
MD5 9107678d4a3cca249717b30c97081085
SHA1 773f2111e435280de1dc405592236ff4496db0eb
SHA512 b796584c745083b4d5c76a21780eab60c7295cf88f70465096d8552379d3eb7586143b58dc13432a77410c751551d2c7fd88429b9a68ddf5901701655299dc8f
SSDEEP 12288:s4K/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:K/atr0zAiX90z/F0jsFB3SQkV
TLSH
T16E55120E32ED20E1D8A36634966445468670BC7123A26BFF31D0FE7F8F356C59939B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/740-123-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/740-201-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/740-117-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/872-7-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/872-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/872-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/872-71-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/872-3-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1556-72-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1556-353-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2072-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2072-53-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2328-106-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/2328-101-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/2328-210-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2568-208-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2568-176-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2568-212-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2568-358-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2568-362-0x000000000CEF0000-0x000000000CEF8000-memory.dmp

Download

memory/2568-160-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2632-198-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2712-141-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2940-207-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2940-357-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3108-202-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3108-128-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3108-134-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3252-352-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3252-199-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3436-204-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3896-354-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3896-76-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3896-82-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3896-84-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3984-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3984-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3984-26-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4052-200-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4144-371-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-389-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-382-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-383-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-384-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-385-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-387-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-386-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-388-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-393-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-396-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-397-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-395-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-394-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-392-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-366-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-391-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-390-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-398-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-399-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-400-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-402-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-401-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-403-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-405-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-404-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-372-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-376-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-370-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-369-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-373-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-379-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-368-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-378-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-367-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-381-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-380-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-374-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-375-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4144-377-0x0000015C86790000-0x0000015C867A0000-memory.dmp

Download

memory/4292-203-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4636-95-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4636-89-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4636-355-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4636-98-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4684-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4684-209-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4736-356-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4736-205-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4764-350-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4764-33-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4764-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4764-39-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4840-56-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4840-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4840-63-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4840-68-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4840-66-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4944-206-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5008-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5008-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5008-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5008-351-0x0000000140000000-0x00000001402D4000-memory.dmp

Download