Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 14:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Resource
win11-20260130-en
windows11-21h2-x64
18 signatures
150 seconds
General
- Target 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
- Size 20.6MB
- Sample260422-sbm7msdt21
- SHA256 a430f5c4781265f636c7d0425676def2ee632e8e0631ffff948133d93b061f01
- MD5 ee6a7b36bcf672bd2fd745ebf1ee984e
- SHA1 e0a387ddf0ed3b9e97c1407cd1a3ab26d9c6e7ea
- SHA512 664a9d9e5eadcc6975b3a4dd1e5653b54d6c5772f75833d9e5dbc0fabaf16885219840c92b5d23fdb6c191054c1908ace69c9916f02126b0397678e3e49c5a37
- SSDEEP 196608:gTvG9Siniuzt+rZFUNX48nrlHR950vDT3gGNrnsACVQBWG:4O9Siniuzt+rZFUNX48nrHuosnsA1B
- TLSH T1A527390567F98194F1F797349AB28787DA76BC416B34C78F1250620E1E73AA0CE7A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2648 alg.exe 4000 DiagnosticsHub.StandardCollector.Service.exe 4464 fxssvc.exe 3540 elevation_service.exe 4840 elevation_service.exe 516 maintenanceservice.exe 5064 msdtc.exe 680 OSE.EXE 3740 PerceptionSimulationService.exe 5108 perfhost.exe 2580 locator.exe 2272 SensorDataService.exe 1284 snmptrap.exe 4576 spectrum.exe 2796 ssh-agent.exe 3024 TieringEngineService.exe 3544 AgentService.exe 4140 vds.exe 3776 vssvc.exe 3460 wbengine.exe 1900 WmiApSrv.exe 2460 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\spectrum.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fee93f05c8368bef.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\java.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\javaws.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e29eda469d2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000797096a569d2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3c247a569d2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000771337a569d2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014f0f1a469d2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097abb0a569d2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082c709a569d2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085b4f6a469d2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d47bbda469d2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009be8aba569d2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8a5a5a469d2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeAuditPrivilege 4464 fxssvc.exe Token: SeIncBasePriorityPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeRestorePrivilege 3024 TieringEngineService.exe Token: SeManageVolumePrivilege 3024 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3544 AgentService.exe Token: SeBackupPrivilege 3776 vssvc.exe Token: SeRestorePrivilege 3776 vssvc.exe Token: SeAuditPrivilege 3776 vssvc.exe Token: SeBackupPrivilege 3460 wbengine.exe Token: SeRestorePrivilege 3460 wbengine.exe Token: SeSecurityPrivilege 3460 wbengine.exe Token: 33 2460 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2460 SearchIndexer.exe Token: SeDebugPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 2648 alg.exe Token: SeDebugPrivilege 2648 alg.exe Token: SeDebugPrivilege 2648 alg.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe 4396 2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3000 2460 SearchIndexer.exe 110 PID 2460 wrote to memory of 3352 2460 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4396
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4000
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1648
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3540
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4840
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:516
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5064
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:680
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3740
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5108
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2580
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2272
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1284
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4576
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2224
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4140
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1900
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3000
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:3352
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 606d419c810a978eb124b9a02444db957d7e14c9816e99630632f05a05a7cd63
- MD5 7323c5d8f7e26db2bd807d587b48d630
- SHA1 d49fa53c5a4fff150a8eb3ca57137346b5eefbe7
- SHA512 07a275f005a28a26c2f867b6536acb830cd8552e9ba3fb7cd96dd8890361bb2240fc340e5dd9526af10369c52ed2a62046df06e283e876736587119988b582a0
- SSDEEP 49152:hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn8Dmg27RnWGj:n3q6sjBjD527BWG
- TLSH T188D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 1968608acf4da0f849e7ef186c61f62b7fd505570decf1cd2fea9fbb6c1cda6d
- MD5 5d02b85c5c9cb46f088de9c761090dd5
- SHA1 b512507bfdde9bcd8d5736b465a25700d5840e34
- SHA512 6694371c5d9eefb6c1ead16928cf868354a6afb6cf3894fa44c8f947189203fbf41b7c6ec7780af2db63531d0a9b7d8c6f2d2b71ba9c59660735e38bd68a498e
- SSDEEP 24576:VXYfDtczALsqjnhMgeiCl7G0nehbGZpbD:AtcWDmg27RnWGj
- TLSH T12265F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 252890618ec8f3a9f6c078d3f335e6753bf334c50cd8a771f97b3b475e6c4843
- MD5 350755f671d3fabd532bfc3df3195b78
- SHA1 759a9525dc7c7bc874a51b8be1957c87e24c1b72
- SHA512 babb02f6d142d55ce4c3c456365436bc5f7d00f248ea5627d6ef392007740b08c88a8fa334eaf6541f8736cd6ed0ac7f4ea64e899ec168163950dfe19ac45373
- SSDEEP 24576:K0Le5ji0hmx/rMYsqjnhMgeiCl7G0nehbGZpbD:KPji0A9NDmg27RnWGj
- TLSH T14B859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 dfc6ef7a66bf9540e6ce0c7d377dfaecf2e48b34e86af5647e82bfe32d0cb5c1
- MD5 7f375bf3353627c3f5e01dc24db7d477
- SHA1 f56fc9ac456b60b72c8e91415228dd6ee2004e83
- SHA512 e642ae3a1542f797e53679634157a5d41d804112649adbb2cd69ad411deaa30f774c1a38c87150be75803c8ae5eb6a89742f402920cc01fc6171432d47fb9444
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWn6q8wyuisqjnhMgeiCl7G0nehbGZpbD:I/ezSC6vUzPveHjy5Dmg27RnWGj
- TLSH T1BD755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 bc17904a192bf8d3c22c588000936840a0c904ba9a2fd82982022dfbebcbdd89
- MD5 b16a86ce6c147c9237a946282a16aa05
- SHA1 af62ca2b8399555ef9cbc355cc49c3de54e244f9
- SHA512 e67d8cda5ec89984fa1bcae9304b2055d8a2c573c5596a9594c0309084c400f6a52faeea59fe3534c12ac089916f9bfbbadd6a922047fa8de6750d3ce55c32bb
- SSDEEP 24576:bVbqPb88hv/l+YPsqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+eDmg27RnWGj
- TLSH T1AB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 b1f4257b1c5cd97590f02f9d8c8f4f4955211c4fad39c1290425205d8c68aea2
- MD5 c5e4c11c6301ec0d30e0f1174719a1b5
- SHA1 a732de07e416162a91d428890160f27f523feb72
- SHA512 005f8479966429020fbd0ab01ad23cb9bc4701260dc28a6af339043ace06348ef1c6a1bc3f8db0c16732be8fecf0affdf4a439ba6366e5520136bb73eaefc7d9
- SSDEEP 12288:u2sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u2ssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1994523BF874C50CAEB7608B583E9F15EAC177E56982008436A637DFEE5B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 f8d1b54ea68ceaac08b55e651130f0888404338a2a2ed9f5f64cb36067303b5c
- MD5 d38eef76c28a8e707584e68acb566157
- SHA1 4d03902cf62b903e79bf7ba0836ac7cbc0f5de96
- SHA512 b4ef7b0a7f0ce7d671a0512e7513416205a1708638d6acbc9282cd326f437e0ef5eee3e614dca3ca233f37f9ce813c1db5e4fb1f4d7bcec439d3b7347f6b5d9f
- SSDEEP 12288:QeBNUbTVO86UHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:QJIUHsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16965CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 0cd3b534723cc65b49d137fe3efac7d3d3378170415705402384c43424f4e1b7
- MD5 4e50a9e517d4b7fb0ff56aa30bec7021
- SHA1 cd49f45f0470659518965329f48ba145fdbb4115
- SHA512 a183571d19d2c883ff772a8fd04ca7e297bd58581a1779493e81fa3565a8afb86581615ad0e1d9bc33a467ee631da57fcd5aa190cf86a98d51dee32aebd59c14
- SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:HQvGAdlCEL8c/DRNw5C2D527BWG
- TLSH T13A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 5267a500aba09d74aecabbbf41e9848ce341f99909a994483c11ca49a62b0b31
- MD5 2d8aadbc2fad75e0636af2104e7a001e
- SHA1 2015becb117a0a390f6b4b03503ae318afe27e07
- SHA512 141e95254ea56b0b5e00a876faab6f47dbdb20c1970ec3acc5c09b286253b0db5273a042fa9df0b2f7cec54d7f4737ddd6ef3d164c75e7041f20c1e601cf9a22
- SSDEEP 12288:3AwSfxL/2Dc3HDLLmt0LDQewsAjZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:Q+ewsAjZsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C075E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 fc67354ca580ae8d5436adc487885fc12ce35962524f80f722bf7806f38f7cac
- MD5 7127823e4e532d205884019476f2eb3e
- SHA1 d560b96942025b687ad948c727180244b0485f80
- SHA512 bb8fd0488951f488ab000f64325d91e8abcd8e6c444c16fba5ec86afbf02165f846e1975909e89b07cc0dcbdf9675d7b308a8e4b664b8b4461b9b3962b878c9a
- SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1VQBWG:eUEtQevvqc2W1cpV2tI32AB
- TLSH T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 1f439965e4d06088b6c587e7cd57b33acd39f4330d90a99bb56f29f1258d1409
- MD5 a2a838bbe56c3acb9c5ede25a1e8ed18
- SHA1 f407a3a443df4ce28879f16f1c794744a6ff139c
- SHA512 51801b589eea162731a50b4672bd47b73202f63dbbba3d1640ceafb970f8401750c5bb997b8c4049317add5de5f9554a341442a77b2c1553ea1cef3582028a60
- SSDEEP 49152:rCbRquA/m2yL5zTfFiV+XenmE3/z9Dmg27RnWGj:0oquVjnmyD527BWG
- TLSH T1DBD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 fb2b82d29648544fbbb6ae3c6adcc68f475a32c89a270799ac0c850bece6e75d
- MD5 18f3da358c317f18ef299ec1417aea44
- SHA1 22baa0856a6ddccc8600db09a6625b58175484a4
- SHA512 cb6a218d837c5c1f8cd4bcc8cf0e59032ce777185e6fa8313e275d68c74c104aee657f9907a34402b15d34113da8ae3650e005ce50f519748841aa7d4e1e853b
- SSDEEP 24576:9AhGL3IFoiwtA5l7S53+sqjnhMgeiCl7G0nehbGZpbD:9AMUFoiq5CDmg27RnWGj
- TLSH T115359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 dca96779440627cdb6d1a88a3130253a5c050988d747418b8551fb41b0401700
- MD5 d992cdbe2340e12787437ca1a440bdf3
- SHA1 bf62182e5e9dbfeabf41ee67adadbb3c54f01ea6
- SHA512 7af222b648cf7a50412d91cbe3198b5a22867d60310b2418ad52ad00e0e446b80d987567ed99194fb3deeae9032860d733db401a74e27660d0669a1aa74ca64e
- SSDEEP 12288:mmw5HEjsChNTBFgl0WDm+CCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wuaOWlsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1CC65F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.2MB
- SHA256 592caf13007cc64c665b53a75321aeca70350eb65f7ff41d4fab8685027b0a0d
- MD5 e114030e62fe81c20f341e0d2eca5511
- SHA1 155732bd0f47dd007f235e0b91ddfe60f4daf196
- SHA512 30eef44ca7dedac3ed40b8b158a9c08d7f2d98a7e400c0443106b200a2584e6d6e65c68b2ec9c10dcdeb943199064d5c35e695c777bf3db828db6cdb1bc60233
- SSDEEP 12288:ZjZ1IypXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BZuQsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1F55512AA239820FAE163417CC5E5D609E7333C52673043CF16665AAA6F73AD44E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e112a6e294681abb7008eb74a042d0171596c797ddfa557dbd3471b3b65f758f
- MD5 10db1db46e61d0a8aa620b1e2ba4c348
- SHA1 8c3f08bdc51505211f18d8690a6eb7ffa8b2142c
- SHA512 5db9afe83fe9edad80707be006b381f68e102ec3f901faf3e234389eaf0800ebe8b7646c12567f226ab7c05c4f9e2f6b536ca19196d5691c66909d4701240652
- SSDEEP 98304:tQRQyi36YOcPbLvw2gAf+PN3HD527BWG:EQyiKa/X+PN3VQBWG
- TLSH T18E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 149579ddc61305514f162a4f82f44ef74d30eb6a90b7c113a63603b66851d2b7
- MD5 0e3a246a09251a1143835487668e1931
- SHA1 aca9be860ca96da03a37df5fe55b0ef540af1845
- SHA512 455153d40e7a3e03089a8f170485b4698033fea6914bcea742a7b00c210b36ebd32d8a4aab43f6585d197d41c4906dd003c4358ee7579ac93c20b7064ecc42cb
- SSDEEP 98304:VQRQyi36YOcPbLvw2gAf+PN3HD527BWG:sQyiKa/X+PN3VQBWG
- TLSH T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 ab88c06022c64eeed708e1b7f6b0b5a11011d42bf31800fbcbc10e0767498af7
- MD5 737554374d294649cafbc583a9931f73
- SHA1 b18b1ccf0d2b783549afc90c6b918fdb5eca9045
- SHA512 9757bff13ce517189fb8d52921a6a57e8adfea4ca92a2af9ea0ce95c853d2a7955c19f0b6da8e9482b1b335ca690ac8a46b2cdcf599e4fb4ccff8879173a7cc0
- SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0AsqjnhMgeiCl7Ge:t68Qg55nhceWu7PNU3/NDmg27RnWGj
- TLSH T140B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 c6a6966b8e064fd5fa865bfa4fb4422f0af5850921f485d505caaec6263bc345
- MD5 5d25e1774adaa918c87d380b4034ebd2
- SHA1 b6fdd24a1a0892d610a7d1e61c7a206482d83c37
- SHA512 db39ce38a585ad6678bac27c3c40fde41f46f35d99e7d07c66f04e261546043afee19d826469ed249491b4ed4f1980a14747490bc0f1985b6c52a87a50dd38af
- SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZYD527BWG:pLIHEWhKVQBWG
- TLSH T11E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 04db4e20ae95997262b6cac9e4378bc8920f3c164f1be81b53f9b015decd853a
- MD5 49b265dc693bc2561548e6889cfbc0fd
- SHA1 07ee027ac6246cbdcdf065d71fe884e62f91cc22
- SHA512 29951a47cb44e8bf828c01e249b2cc0a44c4a75dffaec7dae20fff32dd824e80b59a97400dbccc8225165eb73cf7cda88fb517306849ab7c1fe43aed2a18a56e
- SSDEEP 49152:XB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvDmg27RnWGj:5u6Jmdxd2dvD527BWG
- TLSH T135D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 c3b2fdd96ac202872e1354835dcb5c57a88a701159682790fa9960181b43452c
- MD5 c9757e1eabc1051cded71d6f3231e599
- SHA1 50c01144d3a15d57f5f7b4e31fec5d74fa01f908
- SHA512 697dbbb763f64280e9c754848f7528ff8ea2829b076ddabace373e26188b62e4151ac3a3f7a25c056d27f653ae08361f40467c0f2219e8171f61b85451bddeb5
- SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4x7Dmg27RnWGj:XmifPWRyD527BWG
- TLSH T1EFB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 b23742bff9e78ea87e8e64406bf9739da2ae42841a88039058190066a7324f54
- MD5 8369c706406e05d4b79511659786fab1
- SHA1 6aae065f604163cfbb9b63c95240e407278eac18
- SHA512 c9ac609a40c992ad4d55481abf6addb442d88cbfb690f97a6e6697bfee9092fa26d12190809a8acef70e58945217780d9ab3b31b216ae62f907d8207f567e99c
- SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqMDmg27RnWGj:Z5dKii61MD527BWG
- TLSH T1D3C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 687a1f6d837704104c7d9ab27a45c8e916edf85715abb13565ff79fd5d9a5c2f
- MD5 68711f181952fb14375e09d8e8258b65
- SHA1 ab9fb6fb7913eb8408b8383652ebaaf12e209105
- SHA512 ea65e94e72af02675cf4848d4c1008076b0f1f0148403887b9b38716ff1e18775e9593f65a8f550fa8e5223c0cc1870bf7015963c59983b558f70fea120a22ec
- SSDEEP 49152:0htSn8EApI0fig3giDn0AP5w/Dmg27RnWGj:VX2imphuD527BWG
- TLSH T16095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 5b45dd6961ee9a198c3656496f7d10b398e6f885eee83c7b3fb5bee990e3a328
- MD5 8b5272803d49202fbd8129cac1d4bfc0
- SHA1 a9cf553eaa4145da8bba1b58caa13b184c391684
- SHA512 fbe66da379801b9fd1e5ebc37639228877080922b9070f04cb18c8617162cfb22bedc93a96eda6c134eb7f908bd09689704a10a701eef02a7af9974f3c0bef54
- SSDEEP 12288:YEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YEsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1074523BF965C41CAE62644B5C3E5F10DAC073E5BE92004937A9B7CBDEBB24584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 ce0c921caf2441fdec794f01344d3d40accbe6f93b253f95ff798d3aae4772fc
- MD5 41c703716860c822d68de7611c513885
- SHA1 5a49ad3811f6d579acb8110e5680e686a8cda8f1
- SHA512 da504642eb7d998daf834dae972d2835c6ff626f7ce87a9812ce241e73f2303a7938ac194fd628d1cd6ea3691f6359300eee50b319aa06eeaf6ac0c548ccaa54
- SSDEEP 12288:btXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:btsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B84523BF965C41CAE52644B5C3E5F14DAC073E5BE92004837A9B7CBAF7B18584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 922fec2477a7a874630b81de296ed293424de80eba3464f7446183bd10eabcf0
- MD5 cb7b6d1dd8cc2627e943cb8245097bc5
- SHA1 7748031ff91928e5d87764806489b605addbebc1
- SHA512 1c0c378ee8560e32db7a7b91d81d48de88efc85e020de6fd722f8405b31d94bd22b798c22c2e26ca61d7f335cc069c9161aaaeb32fc560cef9d2706dc73a9518
- SSDEEP 12288:A/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A/sqjnhMgeiCl7G0nehbGZpbD
- TLSH T16B4523BF965C41CAE52644B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB24584B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 351ec9888b68165505fc07e130c7ace7d6dbacffd8e7527f6c6788669bd30c3b
- MD5 917d8ba9488d15eff5ed85657cfcfc5e
- SHA1 40080402d1b859c9efcf6e9abdec730930749e49
- SHA512 b690b4301c254fb6f999056d37fd1abb75b698edfc2c909472713becea923221c5fed3433ae4fbc0334dca90858a7a2d18c5b3fee02880947dd973e542775769
- SSDEEP 12288:mVeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14845237B675C00CAD83285B4C2F5E11DE8237D56EA3005DB6B532CAE9FB16944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 d726f7a40486b6eae4bad77ab47c642103c3b41fa11e739814ab833dc2a6195f
- MD5 c59e472986d18f4df667f0dae500953e
- SHA1 f2f7c59386471efb8cdf97be1922f107f71a0940
- SHA512 f61fe119b6b9c1d5ff547e384cdb6dc12f9da694b59a763998f40f4edc1a882e8dec6ce265826bd6cbdeb27fe43787b052b49c2e28c2db9df2e584997010b295
- SSDEEP 12288:HmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HmsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B74523BF965C41CAE52644B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB24584B38422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 a24a03b1747728f490a3255c4f98dd05b035d2668f341fb266e27abd00da7c62
- MD5 8ad5cadf7b1a79ed046decef2bb97e8d
- SHA1 927c095b4aa2997fc303aa6ecf21c2f7f0b00366
- SHA512 f55a95e6f9d18d8e8d458520e92f0060a11c34337a9d362a145cbd9ecf8da567491d2242d66fc63757283e341486442d618e2598a525b9abe0d2a76ab7c5e148
- SSDEEP 12288:+xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+xsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E04523BF965C41CAE62644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 ccbea26dabfcc3aba639315f0283c72571878e25f5275477e867bc244a6d0100
- MD5 229af1c08579ef20e5a5969e69195d63
- SHA1 f0e6028f2a30978766498be78383f3bc9f6c3322
- SHA512 8349f5f67a30a0903375cc7575af5376b18ce9fa24fafa20283699ad67a3c63eeaf556a8b054ad9a80a808e1e9fc4af6a6f8d935a6fd8e4f90c5f1bfa9795dfc
- SSDEEP 12288:aVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aVsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E74523BF965C41CAE62644B5C3E5F11DAC073E5BE9200483BA9B7CB9F7B14684B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 7b9d20fa99f031b595bb1eaef942a3137562768980dc6e36f7a95407d1818e4c
- MD5 965ecea61b59ae190c4da3ab6a80770c
- SHA1 cb70d581859a1ce05ee598b9b75eac700d6d6e07
- SHA512 883066cefb80aef99e135d76b65b60cea1ff55cd707009f47aa0259387e976465fd77301c2e18e1252760bcf59f05ee69d7245eed2875c408f972f33d4058371
- SSDEEP 24576:rZM3zFVSONsqjnhMgeiCl7G0nehbGZpbD:rZM3zfVDmg27RnWGj
- TLSH T11F6501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 e3e113861454743c81e3e5022155c66d4e36b04d475b0f71ac1d27baf38a84e5
- MD5 3c3b9a4f10fd3b467148a83aa9129452
- SHA1 517345c3e688f6f694f0dc9831214762c0f2ae03
- SHA512 e537ba4307ba518159bb97dc0e352ea80ecc943ec83400d9c090e6abce1fc7f3f82277885a68506f4aee257852f97ad34e9b481a16c0a96666e276ec95e31d49
- SSDEEP 12288:hgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hgsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AE4523BF965C41CAE52604B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB24584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 c5280c9ae3b58d7788dfcdba2a15b839197a0ec925fcde31c2f4552c4fae7828
- MD5 1a86062ca5d6f540136b3182c384d08f
- SHA1 23ea28ce65b65ea223965aa4769dda4ae5dbb240
- SHA512 08329a1c2c3c61e22321f2c197b27e0351980e82d25085a571fd082a623af878668dbbeb2296447c4b8027f891f9b0a2d9adad497c2343b13ac685faa4d24d4f
- SSDEEP 12288:E8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1104523BF965C41CAE62644B5C3E5E15DAC073E5BE9200483BA9B7CBEF7B14584B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 ccc2c139d7fe48de3532f08fbe99adaf19f0873b6ad5a37b80eaaadc466009c1
- MD5 21c6ab82b22e3a8f23e75fa49d13ac93
- SHA1 bfa3b164db17ba15212c5a30e2b2923fec2e2899
- SHA512 c02ec6a8a3272e333d8a23fb094a55b6620fad59b332cdcdb5f6942eea89a233e0681a1a925a8285394bc93fc2dfdf79b4b1acb9ed2880eed178a1faefd1e6db
- SSDEEP 12288:TyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezypsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17A55025B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 3cb17edb1981c6c49b7e832841e74da2ae7d81b197c46ca62b44a8bcedf44dbe
- MD5 cf1a0d623a9169849babfe4e03b8b7f5
- SHA1 4cb6a238a16a0596b1392393eef8c0b1fb5c7ba6
- SHA512 3b3d85d8c63e8fc742c6bca4f1c524a4f1635d165f3567cf65454251455546fce30e8176d48dacade98594c9c20a5eb59469e1694a0be01378acce63740c228e
- SSDEEP 12288:cgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cgsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1F34523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB18584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 38940c35aa03b21d8536b85a5f31e26f9c1edd05e43d96c35555f0a6ab4d9df0
- MD5 c752da84b222cea8110719a4f2934b26
- SHA1 2023d2d5e07f3f0dc81528f412a3c2cf8dc385ab
- SHA512 b8b27904ac3a4d8215000201497b84d09bdb0286a51d5ecb93f9307473869d89bdc8efa2d94bcb24707c038addaf1095d7add822fdafe42e3aee864b1c0c5bd2
- SSDEEP 12288:RgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RgsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1784523BF965C41CAE52604B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB24584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 ed29688565d8db496e83ebce95a4828b3406a0c79d4e356edf3385717c23ee5f
- MD5 7438e5746d51554531a1c4bb7c467139
- SHA1 45b793a35ee081857b47e2264f30f7f347050279
- SHA512 fa49f9a070d8806784289ddead3d0b9cdc82fdd384deb672758aa2057d891c1956b08da4494fd01390efbd11ae9790dbe5128834a8280f95723fa8e46400ef9a
- SSDEEP 12288:SyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PzypsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D555025B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 172b49cc79d03b7187ba2f2b652ce452f34fcaccd05ffbf85d58501492cd8c36
- MD5 8c9cd2296dc6d553eb7e970397fdcbe4
- SHA1 3ceb18c3486dac88845fafccd9a5ebf2a65e2360
- SHA512 fc9e3f104a7027031accc3b9ee9cc9a6bb927a066791361744cf9ffc0769b34b63cb259ae3f4c5e89d0840a48d80aef528aa249d055b7d5f518c0391a120be65
- SSDEEP 24576:0cP4mcvIjkGOxhKP2l71SNKbrh/8KBIsqjnhMgeiCl7G0nehbGZpbD:PP4m4IpOO67N8K2Dmg27RnWGj
- TLSH T15365BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 878c678c8acb1beee0dc5ca9bd6d51b562a6bc021b8696333281b90f965fd449
- MD5 ff87ad445cdeafdd63e99d3c1e5d6879
- SHA1 c6bca9f0f82ebf9250c292ef541c6358a2f3ea1d
- SHA512 979279389d40e721da1d3335d3f18534966da1a8385e79d7944c3225450776972c0a9b51f7350d5333d27425318f7521b4ad43975b7320c64c5a785bd9872ca2
- SSDEEP 12288:EZsfQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pQsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A655015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 2ec2a267414b6d9feb1ff4f9c30292cb4a640f2fbd06c9fbf39cec06d8764f16
- MD5 7d33d9b047bb57f9ca8ebe08d45fabe4
- SHA1 36a70702a4a7291754c15d101c9911faf02e4280
- SHA512 21531698fa2d69bd815d19e33d2497b7c69d64bc149d1e2b0b89e13c0dd8921ab073b387beaf51cc5be9aa82cf8b3b0b68599a61869a09f96d13139f950b7530
- SSDEEP 12288:cwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cwsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19F45237FD34C518BE57659B082E9E12D780B3E669E204483BA4738FDE6B18948F38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 48428df0ed8ddd1e919a910cde693f50b92d7e135afea8dce6f3a796934bb43d
- MD5 459cd7a6406ed362602acfc2dd932467
- SHA1 34afca8d58fba8535ecc9ead52353c1f4834a5ad
- SHA512 3d196363ea51847e42630f0524014cfb9ccff8af377ef2e4083cc2b12e811e21e6f1f933446ce4325901888cdd52dba8db6ce89d4677488815909efe52c32e57
- SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQqDmg27RnWGj:Fa0hNYG4Jw1D527BWG
- TLSH T12985AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.2MB
- SHA256 b452c76f6e86f05a0dbaaa5379efb96e0d3d6f0b6ca7a3220b710de58afbb964
- MD5 de6372825677e50975afad502b23ce66
- SHA1 7daf266cdfe21fe33a51a8755dc3bb1e743b811c
- SHA512 2b93eabd9e931f43d6fb5c1b67c7f8e06dff7d69fb31e6a2df1858684e7ebc29ba78768e427507b8c42260c3e90c9e36db798e96246b92007b6a07e6f688ca32
- SSDEEP 12288:KhbHjfXdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KhbHjPdsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12155127E16AC20C9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 a2607c865d77e593eac1893de11e702ee25927c21eb2af4278e9e2ca29cbb272
- MD5 0d3a2482afd747fdc270900d27ec1424
- SHA1 154a8882279b05345e374eeda8570e4655d69a36
- SHA512 c59d65aaf20d44446d90d9cb48a71171dfc79107a5d4e2c7e579be9fdf6e004ddfa3cbe7002969afec94d7aa2d2d56248746cd6c5fe411d5a87e0724ce5da91a
- SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/lsqjnhMgeiCl7G0nehbGZpbD:YIgnaTk46ppR/ZDmg27RnWGj
- TLSH T17A45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 8c7dd867f0927bec9b61a6d6525e8ad5907a34d02fc900ecb6f36eb2072c49f8
- MD5 2d04da509efc3a1320d8907d95c9a99a
- SHA1 55bcf57a8084a57d24508600156c386401447b12
- SHA512 fa84e736a398b4c1cebb9dfe20c55195c31c1461c63d6731eb1e65f7a2993bf7352b2e24d1aade9a1a53be452f253c387ce97014df1c59b330af63518f2f9bed
- SSDEEP 12288:LMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LMsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12A4523BE924C51CAD93649F583E6E11DA8073E56AB2004D379977CFDE7B18E84B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 0e61eb89b4b12c7518e0ad2744372429d9a4c9addb1d25a7ca1e69ecf7e56616
- MD5 15c93868d99d629a004af4ac8dde9b71
- SHA1 7cbe9e470b6892fb8e7f58ee0347c07b9488eb5b
- SHA512 fa8d2d620a2e7b1584b6607bb22f9e351496d238a78608f724a3815cdafb6033f8b2abc3b711e1c889a5ea466b4bfb4e81a8173bfb0f29d90b4ce0eefc814d81
- SSDEEP 12288:uOblA4LWOsvAYFTLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:XRL3UTLsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1FA750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 0550f1770f61efddad8e8b9041b4be4c53c4acfec312da88664239b9dcc91fdd
- MD5 072d20a58ef923620523d444273b04d8
- SHA1 5c522920267812c1099bd937e679c35bb20bab81
- SHA512 21ff5d099f0c050f217b888f5ee5b654006b69b98b845e7a961004c3114aa19b85e5df101e7bfa1a95982b4acc72e0c5d89f2165284c1fb5ef21c1aa09b2545f
- SSDEEP 12288:cpFt+OnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FOnsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11A55022E32EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 7c827d09a540dc253cb370df987470fc65f096c774c5bba50725b1a6a3773ecb
- MD5 4f879d18dc76b0f290ef62c93da33702
- SHA1 07d868360e6028a89ade0ebaaf4c7e81f5a1c27f
- SHA512 5c0f16a2ae31223d151508be02092ec2a55350c00cae85302f1c6aec9137fa417d9ee35a5a5ca4dce5aa439bd56697f3284d8639f03b589ec0544d4bc47c5089
- SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhsgsqjnhMgeiCl7G0nehbGZpbD:g7cBWMpPjN8DbEhhDmg27RnWGj
- TLSH T104659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 56ec5cc0ee8d5d03ad3f9584df71f000474136372344768601b3d735064a723e
- MD5 cf1a38db6f7d4e6ba5b182b38c5547da
- SHA1 c70472624417d7d098506911295e21a84c257b29
- SHA512 976a0735b9c76c880240c47a5791e036d423e54095f5b2d7ef496f886da826dd32f7af9e1bc246268dbc54a7cefb68b0270d5c3230b7dbb2df7b222627390c16
- SSDEEP 24576:cW6BApg2YuyuNDYTabvcRvNYf8km1KsqjnhMgeiCl7G0nehbGZpbD:cF2YuHNETovcvNYf8km8Dmg27RnWGj
- TLSH T1A9857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 50af8d29675ec6f5063614f3eca829c033e9092102776922521a261b4696e1d1
- MD5 fff58668d928f555b024f465c4d4c828
- SHA1 964aa81032cdba0c0b66d974bb1923fafa36950c
- SHA512 6f6ca56a027f6d922e24300c20de604e5eb063404ccb7e8141a316b5cdd38adb34cc254d5290b4459ea376d3bc3b94f6c93578d4b249fe82e7d9c7e36f5ce20b
- SSDEEP 24576:eAFs06+OmlfkNXEbTojsqjnhMgeiCl7G0nehbGZpbD:XFs060lwXuKDmg27RnWGj
- TLSH T1A965AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 18cffb4a99e5197869626873bf0378fc1f4997461256fcb87ad582fd28d36278
- MD5 9e3181125a072c97d6c08672ef6d7279
- SHA1 7ec8dae6887ea948db05e904cdba63f682a58749
- SHA512 45c01b9cfe8ff97a91a0dda44472d79b8a4188588230fa1f61139dfe1cadc8846c6a0acffd64ff0a2a3faf588951e90aee3351c40e08dae75e60df362c866239
- SSDEEP 24576:oJnJ5D3WnGsqjnhMgeiCl7G0nehbGZpbD:oJnJ5DGnKDmg27RnWGj
- TLSH T12C65E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 095062e3a0b64d4609628b5963aeffc169a149ed08721717b040517a47abece8
- MD5 b2bf5727fcfb3cae2e2de895033d2900
- SHA1 8acbecc941010ba0a6d8d86314f36ef24d059ae6
- SHA512 89715727a6ae3ce263fa35300c2d85f079f6eff7365d5c36c13cec9ab132b79308e73c6341c8e03962cc0873cc386abebb9c484e5dc19750a65048eb948a2da6
- SSDEEP 24576:wEPohm6/7IIXdwcXrif7qQncjlP65i3VulsqjnhMgeiCl7G0nehbGZpbD:Po06DIKdwc+eQnSt65aVgDmg27RnWGj
- TLSH T1B8955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.2MB
- SHA256 4e8ab0cacbdd525872434390039c80a8be8d414a59c6d7a9f2674b87224adb7d
- MD5 d748a148343ae2b5042bd1d95a8b505b
- SHA1 5091a8d601657ddf2ba705fe68031ee2e5c57ee1
- SHA512 4bc832708362359582251e6fbf5fa630cef191f5ffbe155a6192f2f400d40cb46e79187f3f04276f18622890232f7d3ea525eb84c85db3ab8bcb19325ef3ff34
- SSDEEP 12288:OEP3RVCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tVCsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1565512AE679C60DAD136907D8291C209D733F4716B2127EF2692D57E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 f77e2bcfa7ba4e3e0c96507c6896277f0780482ebf61c9d6fa9a6032972cb56f
- MD5 177dba459f9caf8a37ced1c8cdd99680
- SHA1 dac218449530b8e1d650eb8bf8e5e7cc9a9b0852
- SHA512 d32a46adda1b35e7ed8e4d7e8bfbe7ae4ab9a7e7a0de707fc38f7b775e79dff994d1ae80e34104264e3d84af7fc1a406c32e2ff3b559e9ab43a99921886060d9
- SSDEEP 12288:2jkytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2IytsqjnhMgeiCl7G0nehbGZpbD
- TLSH T184551219639C50C9EA760578C6B3D1589C36BC31AF2046DF6191FA3EAF72BD48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 9b5b546955b6a8fe47a2a391291a48b9f3b1e8a3317a0922b285bed27caee9a3
- MD5 7d3ce1c6ca07defaacc0ce4b84d1dc2b
- SHA1 7f88f4b114c4c69f74e39641f4e939d630ae9182
- SHA512 9e1ce1db850e4504eca928dd4257efe2c3a31cd628bbc6e893ed1331bc66b70acd61c4fb30ab6758080ffed41286b7c426abec7220dbe06badd3e2dc3f6a95e8
- SSDEEP 12288:2q3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b3sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1CA45237E525C60CEE93245B8C3A5E51DA8133E366B2014E779E7BCBDEBB24D44738812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 1c65be0f00c794065f5e325d72eed4557b053b4120d251d1952bc9140e2a3d4c
- MD5 219bd28ec605bfcb5c74fb27540e5cc7
- SHA1 5ba4bc365fa3fdd85399e828e5c169bfc11102e0
- SHA512 ffd94f4ba67d25e18d5a2f5b0a79e47f20137c6bb5a5b3766db4a5d131298563b85709cab29621fa2e3d6515c7c370342b87e7d1e5331d8947197e177323aeeb
- SSDEEP 24576:dQ9MxZKdcz97w34sqjnhMgeiCl7G0nehbGZpbD:dVKXkDmg27RnWGj
- TLSH T157558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 e2d4c092257ba9cc266e091a79c34e3de8420fbb44317c7aa2addc1b9a12e65b
- MD5 5908202c60d16838d39ab659002ee2a5
- SHA1 bce6454e14ae31e9e488fff9af166308c24c7cac
- SHA512 af09b126bedaca6f4fbc0fc0fc93ae3a55f2363c517cd607c9ccccec90e275c669fde39b48db349c5ed6213a5e05201f2c8b58109c28c18c3d0170c2a9e827ab
- SSDEEP 12288:myoKo2NRple9pZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:myocPApZsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19665E01FB76D40E2E176813C8985C249E673B4305B2257CB6692C73D8F639E8BD38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 b59c556414bbc2b0fb215a9200e50b286bb222d47bfeac814e02fd71259c5828
- MD5 66300639a91d9a9e05b2f08079679311
- SHA1 036a9d8d22b7d4482680f80eb2be106d5b347a57
- SHA512 e6f6f4d01906082c1d1dc7eeaa2cbe3c82b13bf29c07492929c04b00b1a2e66da7464b1b38e0471d526b1d916190bb0e4f614b74668980451803b614069ba112
- SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKdDmg27RnWGj:i0zuNIpD527BWG
- TLSH T1E6A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 35038c63d6545f342835c9c00a95b55dee21569bdbcb54b26216f5df3137f73e
- MD5 2e6c476ad599f6ad53fa1253a80c188a
- SHA1 aac83d272b934a3e547ddd50cfdf8553bc6b6ee9
- SHA512 5742cc07f4ba54505046158e625bc3674af478e1c4ec79701c9f9bd2b1f30fc18af70cff9dab747eb7f9f0381b04bf501fcf18324f11299f0b4564572285a9c0
- SSDEEP 24576:G1QT7EcpfxR+N5AWAz3ooiYujMqbCsqjnhMgeiCl7G0nehbGZpbD:LTDxR+N5YzT4jMbDmg27RnWGj
- TLSH T1E655B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 6896f21ae9899ec3455a5a1748039f3ec1ed6456f035c9835d94b3ce9f0ab428
- MD5 3a1ed92b19bac7f9daaeba78cb117c9a
- SHA1 14fcc833c8f18a2c346f3ca502558588d0905910
- SHA512 95fb24c27c7c291282e9ada45fa739518834f43ac27105d8eb1e36303014d911a003371f3708e84a6e8485ccdf2f145e5459008f511ce679e4918af5882a8ed2
- SSDEEP 24576:8TMdOz0FFS+NmSLesqjnhMgeiCl7G0nehbGZpbD:U0K+NmSLyDmg27RnWGj
- TLSH T1D765E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 785bd17324eb07d018835f3f527cf13ac1a66f18903da583a7c06d5d28eb9123
- MD5 feb9f3f59d3f46d99a8ed36ac41e8c5b
- SHA1 7ad2b0a7b54bc9df29703f6abe014e6dcc511357
- SHA512 6b845d110c9dcbaa7531c4e342bfbd86bfdf5ff13fbbcbdeab9487413dd04be8d10ea109299db47060eb991f0b36369394efd1f7bb20b3ed2513022c16cf02ab
- SSDEEP 12288:D4tLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ALsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12845126E63EC20C9E4729174C2B6D11994327C36272019FF39E1D9BE9F729D48A38B13
- MD5 SHA1 SHA512 SSDEEP TLSH