Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe
- Size 1.7MB
- Sample260424-3dxtzafv2q
- SHA256 d0a2b8729fa363bdaba7fac5fe7f3dceb82b27804f5dd293257fa16c08906264
- MD5 488fc813fcd178c3b0f0e91507dfeb1c
- SHA1 87b3b18d426cd8dd08fc1535e06fbea9341129d7
- SHA512 6975becd0755d2d476fa3de48a448ff7912eb3e1dfabadd7af34ccc89d8054a6dddd43940db45a0c5b75371af36b8826d54cf6db0a66ad04be95e75014e60245
- SSDEEP 49152:aUNxvC6FGYJf6yjNQpNONZnTX5PlGPgq4EIxc7N/4xCj4MYPVyGLL:aULC6FPYpNONhVPlEgq41c71wVX
- TLSH T18285CE0733E6C0E8DF6790F2C6295223E77274111B289BDB68E0592DEF93E915B3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1948 alg.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4088 fxssvc.exe 5080 elevation_service.exe 3432 elevation_service.exe 3504 maintenanceservice.exe 1612 msdtc.exe 3608 OSE.EXE 2240 PerceptionSimulationService.exe 1592 perfhost.exe 2140 locator.exe 2700 SensorDataService.exe 224 snmptrap.exe 3528 spectrum.exe 4948 ssh-agent.exe 64 TieringEngineService.exe 2036 AgentService.exe 4708 vds.exe 2648 vssvc.exe 2400 wbengine.exe 4720 WmiApSrv.exe 828 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a051bc87c8368bef.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fd2ff9041d4dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fd2ff9041d4dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069edb59041d4dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043e8d49041d4dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083628d9041d4dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002daeba9041d4dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050032e9041d4dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4cc7b9141d4dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd7a249041d4dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4668 DiagnosticsHub.StandardCollector.Service.exe 4668 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe Token: SeAuditPrivilege 4088 fxssvc.exe Token: SeRestorePrivilege 64 TieringEngineService.exe Token: SeManageVolumePrivilege 64 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2036 AgentService.exe Token: SeBackupPrivilege 2648 vssvc.exe Token: SeRestorePrivilege 2648 vssvc.exe Token: SeAuditPrivilege 2648 vssvc.exe Token: SeBackupPrivilege 2400 wbengine.exe Token: SeRestorePrivilege 2400 wbengine.exe Token: SeSecurityPrivilege 2400 wbengine.exe Token: 33 828 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeDebugPrivilege 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe Token: SeDebugPrivilege 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe Token: SeDebugPrivilege 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe Token: SeDebugPrivilege 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe Token: SeDebugPrivilege 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe Token: SeDebugPrivilege 4668 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4496 2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 828 wrote to memory of 2500 828 SearchIndexer.exe 108 PID 828 wrote to memory of 4664 828 SearchIndexer.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_488fc813fcd178c3b0f0e91507dfeb1c_icedid.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4496
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:1948
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3280
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5080
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3432
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3504
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1612
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3608
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2240
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2140
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2700
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:224
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3528
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4948
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:64
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3344
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4708
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4720
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2500
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4664
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 cb9485b9c94785cfdbac543fd689f81575c19526a22c554a4b6d412268274d62
- MD5 5677eab262dcdcf68b84f2616473f9c1
- SHA1 00111e083154617762d9cec28edb6d30949c2206
- SHA512 e1829b2798c7b805a1a1f60ae3413a1fd3ea36bc2ae20f409a981e68be492358c7d74383b7dc1d9386514d1be8bb958a59d4ba240d5bd1f42c4970d10961bc94
- SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMj4MYPVyGLJ:53q6HjBSV1
- TLSH T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 4c2aab927a1006d6eaaba73ea9c3c2c5b82387bf5f6517de0cfcbeaf5d5a0308
- MD5 c6c8c208d962d4235fa3e3a85f5f77fe
- SHA1 5611c21188df4e3b304384618d3dc54913f1b66b
- SHA512 ae1433d938ab69fa55b376f5243a8dacd217743b77b189121300328b950eaafae99257c3fc0d0861d9e2e2448888da41e8dbc87d83223afed7cf8211643c5ea4
- SSDEEP 12288:91XLsswWkxy2lRq2czAd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn94:zXYfDtczAaSnnrFb4PM4MYgLxEVyGL+
- TLSH T18065F12977E408F9DD6B8278C8A28545E733B8518760F78B03E499662F333C85D3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 d036087a00f91dc78323abd5a83fffc39c39a5ebd77b77260679f35b9631ef5d
- MD5 be14bf4f2e706a177f7192f322e3dfe9
- SHA1 cf1298c54ca2e8bf8b5789cc369446fb6b8bf561
- SHA512 1acc0d7e5f3edddaa58acb33a8df72fea99fe87c43b0eaad35a0a4f1cd6f6df9961ea48c4f35a5f3134edee6b1ad9b2fb5a12f1f2f08cf110685d5347f708f6e
- SSDEEP 24576:h0Le5ji0hmxirMLSnnrFb4PM4MYgLxEVyGLc:hPji0Acrj4MYPVyGLc
- TLSH T101859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 c1f5ea170769a3cb1ebd1c30b931fc044e671105b381a40947cfa855a833c339
- MD5 cb1fa71322a7f6be71ec40ce8249e3bd
- SHA1 f6ff85a0a6e40259cf3024b32025cb6717a909ac
- SHA512 2d9bbeafc07ec1e0f68024ac7407f8e13ef30abc83a3372f6c5fa3fe55acf288b25c3db51abb78d6133d499220d954673ddad628c91406d35ce8c8300a865a9d
- SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyutSnnrFb4PM4MYgLxEVyGLE:4/ezSC6vUzPvxHjy3j4MYPVyGLE
- TLSH T134755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3dc222095762866b7dfad2e3ea89c3e6d67baf35d5674fbc5eca15a1cd73db68
- MD5 11b27c3247e1dac48329851d1e64bcb0
- SHA1 acc4e987725be5c5d3c8d9a333036f3c86600d82
- SHA512 c056e6e49727b275791c6b2e49d77829a48d6e64a2697f5a73a9652e777a0afe49def3bd21c26b50de9e53a1fa2beda472ca907a18744e8c75577ef64306b7f8
- SSDEEP 24576:rVbqPb88hv/l+6eSnnrFb4PM4MYgLxEVyGLO:rVO88hXl+gj4MYPVyGLO
- TLSH T126559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 90d4f48c0f6df4fc3f0a7a411db55b71abd767b33f4346ae0d2d80a566fb178e
- MD5 1834d187fb25b41eaaf0469d3761d9a7
- SHA1 b05c3c7e5fcab5e0ea216e4f9e5b7f48902d0735
- SHA512 ee0b787c5efd9b470f624e90f7f3c5118265a33fcc7ea7a5144109fc18a4daf38b036001b99351e8e776e93901f08ec95b7d196f54b1d6292f3abdeca7c83d5b
- SSDEEP 12288:qRU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:qRfSnnrFb4PM4MYgLxEVyGLd
- TLSH T1C74523A75BDC10EACFAE15B0D1B96AC8E605BC61F875B20B6750785B3A3F20DD891313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 2d3155f5317a9dc4aaad4774ef6926cde3d6a8dd810d2cc1697fd1f64a8aebc1
- MD5 cd8942d0ebeb2f6d6025adc6acc840db
- SHA1 5d88fb46b7f613de1092432e2011c63fa2a8e198
- SHA512 e43e9374e1393d7498ad96120392a841fa8029546a3bb5d80391447f581fe84d72332ac511927cf67dba65d2572e1ee9e5928414138c65bd6ae1ca4be23f1e2b
- SSDEEP 12288:seBNUbTVO86UB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:sJIUGSnnrFb4PM4MYgLxEVyGLg
- TLSH T11F65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 c0b59e3e3e8eab0775817ec200f5f1cf868d259efa6ab266f76dfbb34e5f6a26
- MD5 e65aa89a387a7daeeae69bb810e2773d
- SHA1 1f6a17ffdfd4c79d1829784d20eef138eceded9b
- SHA512 a917cce368f8858d6c1e28aa6ffffbe87b28a200135be91511f6e6cd046eaf55f86cfd0fcba19e096d412f3be8de4920759443f6a9b7f864704284832171d2d1
- SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:fQvGAdlCEL8c/yRNw5CHVZ
- TLSH T13C267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 c69bd183df82d9adb07dd2f2ff26dc059334b33004815e25dcb778f4c1e178ad
- MD5 1859ecf7bfbb8421665a7b2c9abf554b
- SHA1 8583356df64235d8004b68c8d3962ac2cc5cacf4
- SHA512 cfb600578f53355d009395d3f1dac8b8ad72d469dd71937cbb711f0f3ff3dabacfece5f59badae206823e2759c2ca2a64587029d72871073e6c96ab93141e341
- SSDEEP 12288:2AwSfxL/2Dc34DLLmt0LDQewsAjH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA7:LdewsAjISnnrFb4PM4MYgLxEVyGLg
- TLSH T10C75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 85d8a6fd69d421ddba194ae1277d648a63d683ecd91e65aab8eb95ffa9cdb90e
- MD5 c7d788ff6252bddacc667b478956fefc
- SHA1 3bb3cd5e46928542e49fce7fcad3d0381db40d64
- SHA512 9a28e74ce3739e8529819718017ace02073ac05f4e87a424db950c1b9e268bcadfe7bbdf2af023e44e1c722c27f068f4671a9df21850b0eba52d8a1a76202f5f
- SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:BUEtQevvqc2W1cpV2EI32
- TLSH T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 d5b98b67c5a473f94daf7dc387bfd414602a87d243c58c592ee674b22bb7722e
- MD5 a8fe6a088e35843cad1a04cd559c1b63
- SHA1 71d9582144514c2ebd9e27d550c886006ecfcb74
- SHA512 f5f898ae53ae92d20fcad399c4d2473a08e0f3872c416f852f480c159af97540cf46bec8e75fb17202496a1c4737e647299e804056a978b9f5868d4e2e0bf812
- SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/z7j4MYPVyGLE:HoqtVjnmDVI
- TLSH T10FD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f8d639e16dbe4821e2bdc5268e18f15b740c1dc2db8723dd2638e7faae76c207
- MD5 28052a81c60e8d761a337bb659a45ca0
- SHA1 12a20f632c75845c59eca1ae907071c46d1ae994
- SHA512 4d8e3081689fbf7885abff7e25a80359968c4cc38691f60e55c6a816122484cc361b8603031140f6cb05460f822cd0d8813ae43937ade6e4f615513df77e88de
- SSDEEP 24576:kAhGLJIFoiwtA5l7S53ZSnnrFb4PM4MYgLxEVyGLx:kAMyFoiq5ij4MYPVyGLx
- TLSH T1ED35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 bc01e5e9a56b0c2c0782ab47be19f2ccde1be2ee765c6c96e7caf4701e9ce693
- MD5 ec747098de7927c946fcd57c76d4f161
- SHA1 5344b62d245f2eb7252f40b4e676698050afccec
- SHA512 996965269d51aac500aa4346b771f2d28685ac55732711970abe5f63f4f7c9e0bb6e85f03123aa3ae7719fbb0201bad30e5cf22f0b7af04bc3d78d388d06d78f
- SSDEEP 12288:Jmw5HEjsChNVBFgl0WDm+CW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqX:EwuoOWkSnnrFb4PM4MYgLxEVyGLp
- TLSH T18E65F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 3eee967d6912b9ceaaade7eba1c4f5b3d96f0a7df4fc9c66ad7e60b1289f1088
- MD5 d6d43465e7225b9ce3623c177aa9c9e6
- SHA1 e94797b8d58b178582e94879ee8fc6a142fd362f
- SHA512 4d68bd2d2d5f67d789a5121091a5eb391b63d7f34395a3fb4b5e92eebeb6734ab61cdf63148041c82b496824f53aa11ae69df653f499421f76d830fb3a88175c
- SSDEEP 12288:QBZ1Iy334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:OZuzSnnrFb4PM4MYgLxEVyGL7
- TLSH T16E55129A37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f45b334b7a1bc00de78ffc5581f48d7c2367d8596a614ea978db3563c51ef0eb
- MD5 dc586bf1eb3f722ffc8973fba8c1fbbc
- SHA1 090dd43b3167b31e5fbb4d99b2aab13e4bf85dd6
- SHA512 dd2399a53d19bd0be34646cdcc666dbc362b7be2e928a250ee97483e1d317491f81a409b032cedaeb1122328aed8feef08c4770efa3dfe605f12c07add896488
- SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:9QRQyi36YOcPQLvw2gAf+PN3mV5
- TLSH T1B2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e4b5cded931d238a19d4a872ac78bed8e6f28350b53c4926a21cf497de36c165
- MD5 6cdadf363c77811dbbfd46edf2ecc034
- SHA1 a9c46412aa508bf57d3459b9fb994404dffb3a45
- SHA512 e5bea074258e0f65a0db3a260e611e74240e7521ed00c157072db794491f9398351e8db795f277ec7be2a060bcd050c2f8a2ebe54eb393051209160a8d9075df
- SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:UQRQyi36YOcPQLvw2gAf+PN3mVN
- TLSH T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 5572fdf85a173d96ee2e74e729f3a941f818e289c7691674a18afa5fad45d909
- MD5 49167c7b72f738c27cf7c4da46b9701f
- SHA1 42a99644a4d0e6ff520ad82dd93275c36e8c68fe
- SHA512 53b80bdf651725d44a2e40b62a6833f8fc0ae7e3c03bb4b5baa99e480735e1ac725bff340f9879bec202dca594939b0f2852e280520544101bbc492fdb6ceb9e
- SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DSnnrFb4PM4MYgI:b68Qg55nhheWu7PNU3/rj4MYPVyGLD
- TLSH T103B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 0be41c642ffe2844db3fc861c59163adbabc007eeb589c7c8b887f310a68ccd7
- MD5 2f74ed0b2f206ef49d70c3a8d50e7caf
- SHA1 2be1c23e1ae467e2f88a08e29265d312d46a61c2
- SHA512 d00fbeb42dafbaa1df2c8a3ae7b24f42836b76d9f4e8a5663cf7fa658ef2b78fd27fffd94f96549d4971e90d185764749fe35ca821de63f3e9e08e7f13618377
- SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:7y5112gYy5azzVvL69nLKnhZFVR
- TLSH T139167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 1478c7a2857c463491a011c5387ab20715577cd01c1fee0b8fc3b4867befb83f
- MD5 cbf0ee1d989e5b268a50281445ce5942
- SHA1 3b8a5b324ab1fc6ee6371582c4756fbcda460869
- SHA512 92f5db0d406951e42ec67906e37331ef17b812db768fae6e00b25a71cc50ad1d5251aac55344eb0cc10714f3d0711bce9b9943815235ad6fd3653d0951443a2f
- SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllj4MYPVyGLe:Wu6JmVxd2d+VS
- TLSH T164D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ec0e0d36f84579293d491e7a90ec3ac5618e562c6520bd493f35875808877ad2
- MD5 fbc2e18cee1ee92eb787750cee9a886c
- SHA1 5f74dcc31ffba95f2899d0d7263bad7b04db86dd
- SHA512 f5619a8d02a6e4472f21b313d98c5942dce9b74ed5337cb2966f77a32068859fd40b4845bdef228e31374c8d749d0111d3055fa4959cb2c21f8c09e35f2da224
- SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xBj4MYPVyGL+:7mifPbRDVq
- TLSH T14CB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 650e714ff8927176c8c6bf9a4943b68b4cf7166fb8c87f99040060389ef2b438
- MD5 3de70299c54c2291a87cf347fb823798
- SHA1 71c23f3f946303e0b542389267e1a6ea399a7c89
- SHA512 92edc549b93611b6ea25f26a246ddff499a0e752471cfd2b053afa2868d488ee0dd9818e934ae727a99825dd38493009c7af6f284253e50b390c099cfc01eb99
- SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHq8j4MYPVyGL8:X5dKTi61pVA
- TLSH T1F9C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 99f6d3573da9db77cacf198b9504fb95acba486ee1adda9c83489c59ec5341cd
- MD5 f2c2d710adfe5bcacd6ca5fb7a5cd8c6
- SHA1 683588017efbae81d26e8af739a3b79d76cf02f1
- SHA512 af477e55b4d75252a01f99efc3d3ed087d95f5a3ceda4da4cf7c9ef4b9911dc4fbd0b3e18cc29b73455d36c47a45d7a0774603b5b4404b0c7df3ecdf6d11dead
- SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wVj4MYPVyGLM:QX2iyphvVI
- TLSH T16495BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 982ded296ccfa6d89c9ea79047f3adf31d4dce5b62ab250dd75ae12877a431be
- MD5 4bbf66783e9749b0c141000455f3e392
- SHA1 42117be8697385cbd1544b01ec98aa106e39e407
- SHA512 64d363b2f9f9a271fc497acf4c1a613507f46f8ae412429468ae5aa5a3773cdf2a19c61134ab0f46fe86e155cfa78371e8361fd2aba6b43b6f2d795d94d8b71f
- SSDEEP 12288:/c34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:/nSnnrFb4PM4MYgLxEVyGL6
- TLSH T10B4523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B20D6892622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 ca34b30098584b968b314f725a35db1cdeba57a16bf1fa313b654bf91c659862
- MD5 6753fb254f6babe5554f2254575c40af
- SHA1 8817cc1ccbefbb5f19662be399ba138e9b14fdbf
- SHA512 422041bef2d058fb47634a46e9e49f90d81cb258e2962763055b2cb44651babd37e668bd9a824fd7128ac1e662a02bcbe2853f57e7cf4d9353cf64fab5b7672f
- SSDEEP 12288:uj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:u8SnnrFb4PM4MYgLxEVyGL6
- TLSH T1014523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4474073B3B60D6892622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 8d55b975e8ce403ac9e83703ef219363bd95dd4854ea3d32b45e50d6916b4a40
- MD5 5eaba1bddf0a1edc773f52d2833a4bb5
- SHA1 f006e96f7611ae3ba4ca269ebb4785056e86c668
- SHA512 13710b13e60e4f3487413f0dbeaa37b6bbe9efed7b70bb6f8e081a55140c583bde578e97abde17c19e7b3629e7d17d888fc9fe19f7ab8eca0eb896dc741b14dd
- SSDEEP 12288:2p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:2uSnnrFb4PM4MYgLxEVyGLd
- TLSH T18C4523A62EDD10EFCF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B20D5892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 c7d7b0c32c8c8337b059f542771b74860756fa90ae402ea310aeffa5da2b6c56
- MD5 ce84f708f128835ec89ae18ca7b16037
- SHA1 57e80601d96b7192eafde7c0e018ed5109cf97ef
- SHA512 aefba63d8cf081e8271cbeaeebb077bb8de513e1b4086c21bf03be01f73f1633f940fcbd5716a364b67a548a7bcfd884c120b6c6d367651b7fdd08f9fef9d770
- SSDEEP 12288:uVK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:ISnnrFb4PM4MYgLxEVyGL6
- TLSH T1334523662BDD10DACE6A96B0C1B556C8E225BC62FA32B35F6740381B3F373489C71721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 363f7084d246a935526b837ae07770a8c51070f8fb0ec78fec20221206e96129
- MD5 4aa6fd2200d3aba7057f2f1e4f2f9408
- SHA1 0d54ae46d7e3d2ee1625f0dde29549bb013d100f
- SHA512 fa08124b390cd3a495806df8952031ebc1d99c77eb51beffb86e44cd72ddea6d11e3eeeb51328ddc96d8ec2ba6719d3db53e026e7ded28726d383b857c4bf81e
- SSDEEP 12288:1C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:1RSnnrFb4PM4MYgLxEVyGL0
- TLSH T1FA4523A62EDC10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 6bc7dcc354061fc173ecff4f276f4af957b183e63558d692eb9b5e0f11460b07
- MD5 418a363f4b72f7376de27a91ac43759b
- SHA1 63dcd2d3193101434b879e823311d1042e247b84
- SHA512 b6e898b378ef06bbfa1260164cdc723646427f03daa00277f27350c4b9557b7ad70a603f2452aa4e673f6f2283abc6daff39bd35ce8caa7ccedd0803b353e485
- SSDEEP 12288:tv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:twSnnrFb4PM4MYgLxEVyGL0
- TLSH T16D4523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B20D5892622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 5d1aad0c949b2fb174a44ee85b950d3b718c42dd448bf0e54c25dc39ee8b432b
- MD5 b2db1a5043b93c758ec0471424d4327b
- SHA1 31faf3f6901c4255772cfba73c0b8bb8ded7ae84
- SHA512 f604d254a5d73810894406797721d5cb05dcb2bc20bad67be455f99e08ac51e00d97df464cee8e8be38257ab11b415ea6fa04ff7d80cff3bc9ff4383a002f34c
- SSDEEP 12288:q734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX2:q0SnnrFb4PM4MYgLxEVyGLs
- TLSH T19A4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 644d0ddcf4814e01a89f03ba87cbae29138b42ce1d630be84f71c74945d62b1f
- MD5 a6b787c90c57fb7064fea0111ee412a7
- SHA1 b1e9468789e391c9b2e3510f1b6a0ea7d5ea037d
- SHA512 def024c71c013263cbea2d4e083ab67a60df4ee0a5f42ec31011e5dbc0b92890e91784e2ac624a5387753859109faa7d3efd35b08b1a7d706959d58cf33d1b8c
- SSDEEP 12288:tiZwb6zzFEoS2cPvyD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2j:wZMSzFVSOcSnnrFb4PM4MYgLxEVyGLm
- TLSH T1496502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 f5df6e8bd2d937ad9dcbcd5bde96211d019120ebc104e4faa25e505200f14836
- MD5 6c50afa92cda0622e2114f13ba89b94d
- SHA1 73c86dc1275a5f285a5ab02652d5fc5c950d3d10
- SHA512 2ddb5548372e32dc3ec2a78882d8cf2a58fe2ab67677f89554f2a0f37cccee91518648a8d0fdd6d98dee8c76b07e35eb777984afd474df5e54e84cf20eec5605
- SSDEEP 12288:nQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:njSnnrFb4PM4MYgLxEVyGLv
- TLSH T17C4523A62EDC10EECF5D06F0C1A567C8E6097C63F976B20FBB4574163B3B60D5892622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 727bee83091e824a70d9dfad3691002371c3ac43fc9db1c9c8d25c2b59442de8
- MD5 f904714f67153407f3e3ed37891f26a1
- SHA1 441a3339391eb59b848563d1b25bc03cff4cacd3
- SHA512 f558d2c7afd00eda6ddec1d4ab0aa9c718386abe4a0a6426d4eddb2d502ba2411ab6628da2244759bf6cdf5921a9175e2d453e4ce5bb317b99d940c967af9ef3
- SSDEEP 12288:IE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:IPSnnrFb4PM4MYgLxEVyGLv
- TLSH T1F04523A62EDC10EECF5D16F0C1A566C8E609BC63F976B20F7B4574173B3B20D5892622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 958814bc8578c3ef7148e55e28b8277d9195cb49394a6bddcae86f2b6cfed725
- MD5 f46c4819ea55adab587432c2a0481c64
- SHA1 41b7c0e1b64d94445021f2867d5bb6a85bfb9a78
- SHA512 fa6052c7d0197ae20543fdd9a56220bf25d84393e3a3d8556e824c36d99e12ad49f9c33192ad523aa97fa420ff94d1115947f4ab5c05a121b9bcc684560a8e6e
- SSDEEP 12288:eyPz5L8334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:Dzy4SnnrFb4PM4MYgLxEVyGLm
- TLSH T12C55025737A530FDC67A8274C4A21A45F336B8329B309A5F279016773F372849D7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 2581c99d1e01e86121823d20d51f8346163a91c75662fef6a52feba464feb799
- MD5 c77f7f49675ee9e10311a21d985acfce
- SHA1 5e6685b5b2cf2ca245ab8b348a23c75541326bb2
- SHA512 07105785d05855bc02a0490c4095e6273ea6bbb4ea9d11e1afa5e99b477a6e49628db427b456cbd3790e63b525256a50bea73bd8fe23805ee24a8e32ebe138bf
- SSDEEP 12288:jQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:jjSnnrFb4PM4MYgLxEVyGLJ
- TLSH T1AE4523A62EDC10EECF5D06F0C1A967C8E6097C63F976B20F7B4574163B3B20D5892662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 a647d095c8dc9906ee41ff24420d96f9780edea07406ef75a7fd677ea4952b62
- MD5 0a78adce50e03ac63c5ec0373237b848
- SHA1 1846a4023f84028145c1e3704a2e7a29dd1eb868
- SHA512 c11e324d17404adc3e9ee413624660ee5faa0df2dde583591efa74535f4b469f99d134a97a81ae3e92815cecb711759a1380b010ffb61e91ccf36202962843cf
- SSDEEP 12288:vQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:vjSnnrFb4PM4MYgLxEVyGLE
- TLSH T1924523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5892622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 17baa5b30a3905feb7f43c935a752c34bf10f36e5fb4aad1af4b3349fa457cc9
- MD5 c21016917fd96ea7e7e7fe89637a7ee3
- SHA1 68dd46c0ae7cea2b851ae43c1f1c3ed5425d2cfd
- SHA512 b1e43eb0bb8b5846c5017a3f02cc799211632a9eb745499b358ec4f192aac1c6b6e8fab45d84decb6ff9fba8f029bb95fa8aa38287b7911fbfcca16a1d6e0c96
- SSDEEP 12288:LyPz5L8334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:mzy4SnnrFb4PM4MYgLxEVyGLD
- TLSH T14855025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 e95dc4c9c133a30d9183877bfc692136a8d49ba8f6d989c941dcb99bda87ed42
- MD5 901b053833a64e5964224ffb13872ef8
- SHA1 5fec51adacc28b79a4dc5bd2308eae672e59f891
- SHA512 09dd9222ff6ce63ec67695bd78864fddf52d051fbf7c782553843c387d1a645cc1d0866ccae466975293513a181239f113c7baf1b62952be6094bff26ec4f32c
- SSDEEP 24576:ccP4mcvIjkGOxhKP2l71nNKbrh/8KBbSnnrFb4PM4MYgLxEVyGLs:XP4m4IpOO67W8K2j4MYPVyGLs
- TLSH T12A65AE2DABDC0096D0BB917485658A49FAB1742A2F3286CF1160A33D3F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 c8a71cfe6fa8a08f1dd493f69a0c3848516fbb3cc9061249b53c8e70aee1d920
- MD5 455c9cfc485d15750139cf698698ad0c
- SHA1 7589348f6e2007e205532099e799aa458f5bd65d
- SHA512 2b603bd88beaaae8e2dda3dba57f60ee2ba37910fbe7219f47f51895fd47ae52216045c3bf775e7e7c7096f51e3ddc1fc414bc1c7df3542e066a862f67d1ee11
- SSDEEP 12288:xNsfg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:2zSnnrFb4PM4MYgLxEVyGLQ
- TLSH T1BC55F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F3A6849DEA713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\movementpro.ini
- Size 192B
- SHA256 3cf47a7833855044343533b38a97da97270fb667e833074b926750ee8d3d31c5
- MD5 b26fdd5f908fc6183cefbb1a8144216d
- SHA1 c4ab663769397cc09bfa21744e2bff8d3b40591e
- SHA512 f9b5323665c4acf2ace0ca4989f4591bb0cf75ade053718f80ad6d308694ee44734b3b7ce78bbf8bcad8d401b1516a6f181dacdea0f8d7366efc82b1a6b540be
- TLSH T18EC08C0303FC0004F0B20A18EAB941720B367D482C0CC02CA2E0921E48E0E00A8F7BFB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 31af6607942b9eb4dac585f7219c5a03741bf5522df470143f8cfc4d5eae5819
- MD5 a24c2bc43d374a61c8471dfd34f23625
- SHA1 db48a4817a0832804b1096e85adbf31f548f9968
- SHA512 157cc425341a7aaf1f4230550f5198f723cc025b9ced07529c9bfccd4aa4b2a225dface729266f568879ade1194067222af3d7ebc09f5e6de0d5b5a115c6c403
- SSDEEP 12288:oA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:oTSnnrFb4PM4MYgLxEVyGLl
- TLSH T18F4523666BDC10EFCFBD16B081A596D8B20A7831FE71F10FB740741A3A3A6499CA1717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 93b5174625c182226707883e60591eb1aec211996156ab6b695603fd42e93350
- MD5 a224e6eebb88d910dde9d74d68eea693
- SHA1 9282ad29308e3629b9f204fa86727433c806484b
- SHA512 413b4d4a17db3e635bd02d50ae58667ed12038f975e443bd90620dccb31589813b266af4a5fcd08dc96f30b02063f504e25ef14eed842c1e2a7d854b1129e805
- SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQKj4MYPVyGLM:Ka0hNYG4JwAVw
- TLSH T13185AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 a7c7032f56ce4de079ef14e509d43202cb64362304f78d098c73a3f38302db55
- MD5 d40a4735118daf5e55883b24aef7dc50
- SHA1 92c8b29260a1322ab95b7c56fce51853fd6afb7f
- SHA512 f08a47c5106f69a47c9be8d244fec040f231623978b32dac458612c5baf804fbb59adf24196bd8df9d0662c44131432d1e9c9681805367d2f6e695b341886869
- SSDEEP 12288:nhbHjfXz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:nhbHjPMSnnrFb4PM4MYgLxEVyGLK
- TLSH T10F55127E27EC20D9E675A1B881958649D331BC226721A3DF23C1917E2F3BAC85C35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 d03b6bd9fa9c96aac71641569f6285fbd24321ba03caa33c104b0b89ea290a8a
- MD5 2349cb8a0f3fb6ac0771f0066a288c7e
- SHA1 9e1b860a41eee81c93efe27e3d48389e77087b6a
- SHA512 72552b6f260eebb8e9fddfa476f25f04ae1b37d60fb72d6c2467477cc4c49dcb6dcf2805f7a9c6aa10f885cef4f985c2751b8989497398f499f21ccd74cdbb73
- SSDEEP 24576:63YgnJcRTk4yti+R5dBR/kSnnrFb4PM4MYgLxEVyGLD:6IgnaTk46pBR/Xj4MYPVyGLD
- TLSH T11C45BF2EF2B910F9C8AAD236854147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 165a30b531ce420f4a924f2e6c430b10bec0a7a7ed51e50edd3891a36c777078
- MD5 7080502f0b0dacb1acdfcc5a240d1357
- SHA1 362e1a566a966330acbf95d6ca19d60d57ff0143
- SHA512 16d813155f8df885e661e002a47e34102709f851fe6b151dcf3ef986777ee7743a8d7ff54a2f631672d64effd6b0f3f9304fc85d98826f9807ac4c2639fdf7d0
- SSDEEP 12288:u034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:u/SnnrFb4PM4MYgLxEVyGLp
- TLSH T1294523A62BDC10EECF6D16F0C1A656C8E2057922FB76728B764474173B3B68D9CB1312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 90b9de964632b347530fa94b85178aded401be8f61363a39e030bac77e9a0a1a
- MD5 ff1e243bb034b92d5fbcad98c7941b75
- SHA1 1a690e15ee73d1419a0273530309d7f95d54bf7a
- SHA512 3ca9c8e7042bb7da979bdb101012eaed9f1895103d17d17307ff498a87b4aeb29996147de158fc2db179d5e9ea1990d5009db02887c88affb334fdc196d228f8
- SSDEEP 12288:NOb9A4LWOsvAYFTd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:qpL3UTaSnnrFb4PM4MYgLxEVyGLM
- TLSH T1BF750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 855003604a159d6978dc953d4806309c76fb69d2e282b44525366d9c1189f3af
- MD5 5931622a785eaf6abd082cccc58601eb
- SHA1 51cca3152dae6d020fd817632b37669d12271447
- SHA512 df2f01d282de6de19d73a4ace8a709de38d2ac675d121508e3f53380a7945ffe859d0498619389fd372e67151d9036aea9808d706a95fe1811bf0d8e32dca39f
- SSDEEP 12288:tpFtpOh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:FOmSnnrFb4PM4MYgLxEVyGLd
- TLSH T17055026A37EC10E9D579A1788592434CD331B8625B2263DF07D0907E2F77BE86C36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6f0f4d7f5754555df43860a6f83b6cf78a0fd6dbd81299df413b9cb625bd67b2
- MD5 8452988e9bde2137b29d5b8c924f4de0
- SHA1 d81a16e20b3184e903ffa78b9d5b78bcce676366
- SHA512 520a780b7321d9e8205bcf3e4dbc7aa8b7643d258393e3ddf885d120884b84de6ea31696d05e5619eaebc097e795119d8db38b330316f05040c969c6e87388dd
- SSDEEP 24576:F7NM9YqZqmWMUkPjZM48Mv6bEhsjSnnrFb4PM4MYgLxEVyGLs:F7cBWMpPjN8DbEhfj4MYPVyGLs
- TLSH T13C659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 6db37b88d604614e3aaadde202463ac3574b725fd2bda4b7ebe896c8f814e4ed
- MD5 18933045042e15d3c60cfcf4e8981da0
- SHA1 f645bb57183af397088662ee31dc0449bc49e730
- SHA512 03b64b279b85109381e614ef6c60d2c053a8afe8299f77cbbba7a7b73d6b2463655963ed8c46f7d0a56e93e2449a7fbba7bc0876a5930e0143040d2882abe3bd
- SSDEEP 24576:GW6BApg2YuyuNDYTabvcdvNYf8km1FSnnrFb4PM4MYgLxEVyGLm:GF2YuHNETovAvNYf8kmMj4MYPVyGLm
- TLSH T104857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 fd52c3b2d81c3cb4d766fb81b5884282383c60b9f6397cedc3d25287a33ec7b4
- MD5 5436e7b2248de25470c1683fc6bc5064
- SHA1 72f06a5096ab769642408575ba72f9c1ada11b37
- SHA512 642ffa235f78b68270ab096ea93e9495cf68d8ec4d74ada600e2c0950e615f007df0f7f41b231dc4c40c371810384d1ae06b33243c84bb9caa05a314bd597259
- SSDEEP 24576:eAFs06+Omlf3NXEbToCSnnrFb4PM4MYgLxEVyGLL:XFs060lVXuqj4MYPVyGLL
- TLSH T11D65AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 c4855e03c585f343154cfe59c8f1d688594f3fbc683a94708b29d7a96264a0b3
- MD5 12afa65e0dd2ea6592a7d67bd13e9b0a
- SHA1 b06f30e0618a3f8e371d7abd0d403dad6f5d9299
- SHA512 e7d9a351774438c61a99a5b13eee695ef7fd2f06df2cee7e0ed571b9a45a4e6feb4ad0842a9fa2aa170a44fa7e5ae6422946a8f3a50b917b1b73a9b571829d50
- SSDEEP 12288:HCJnJ5D3VkrDzxw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:iJnJ5D3WXxSnnrFb4PM4MYgLxEVyGL7
- TLSH T17B75D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D5353F12ED09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a29626acc9b99603051f0b103f0faee3ea26f9c5066f07ed6127d66e102e584c
- MD5 52a28d5761725a326b9a095cdb6d0fb0
- SHA1 66827032833b8845e8e25c6e85cb25d3d40f655e
- SHA512 e8aedf7769d65fe08a8acae4b5e4bbc48369cfc2393df5960fd6baee323af02291893590da8452e0681f26e8697fa09eb7b2893f5ce2463826f15ddd42dd949e
- SSDEEP 24576:ZEPghm6/7IIXdwcXrif7qQncjlP65i3VukSnnrFb4PM4MYgLxEVyGL2:eg06DIKdwc+eQnSt65aVgj4MYPVyGL2
- TLSH T1FD956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 42c88e8e4f6c57ea4d973aeb72791399c756e72686865057f125123e97cfeeaf
- MD5 2f5c5f4980a1c462dca23504a39086e0
- SHA1 ff73b92a8080d05f599510fe87fa62819e969b1f
- SHA512 50088bdc01579c238122107a5849d80c5ec50d50efa1ba96c70501353237b22e388a1c5786ec87625422d59ba1a99f2a1dae1580dd7ca73221c0a89313c417b6
- SSDEEP 12288:tEP3RnW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:OnNSnnrFb4PM4MYgLxEVyGL9
- TLSH T19855126E2BDC20E9C62A917881A18688D332F0717B6273EF16D1D13E1F37AD95D39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 feafef0c2c4dba6f4c109a8ec4fbdfbfa2a9a7f4edc6666c9691126b922aad82
- MD5 f9766ab41dae5bd9e8b865b8e610c8a3
- SHA1 f4a8f60b5feba765c735e475b33aaf0711492849
- SHA512 89765816199aee9950ec867abd38b6fba3b266ff1a1fbb0aa73e961c3242b886fc7c094d048af83bdd98f6562dedf776f57481cfcba1ab01fc5038e6e0f4003e
- SSDEEP 12288:Pjkyj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:PIy8SnnrFb4PM4MYgLxEVyGLq
- TLSH T14855125527D860D9DAB90674C5A682D49A35BC21AF21A3DF6280F53F3F377C8AC31B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 57a7f2d269cb5e10ee6994402b428a049a46d944f4fd5d929448cd81f9241522
- MD5 e3680f8958a746ceff16db8f789125ea
- SHA1 1e1b32d34ae7312d74ef375c315ffb9a4320f83a
- SHA512 36bd0e6a154861d86c827a3a08c2a8dc04dbddd658eda82e7c6acea591d17e053591675d732b2afc3bde152120ebd337fc53a72f0e167aa1cb7965204166e95a
- SSDEEP 12288:jyR34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:OWSnnrFb4PM4MYgLxEVyGLi
- TLSH T15F4523692BDC20EECF6906B0C1755BC8E2157831FB75719F76C0B4363B3B68958B2A12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e833a4aabf8a2657f3adc2d8c134ac618d87b84cf41f5e390e8e009b693b7bd2
- MD5 6e65fef96af1b091c2e4b767415ae8fe
- SHA1 800a82c6f5461d5ea6ab7cd1538d19dba51ea28b
- SHA512 2930fd14a0b338817796b72461c58cff939a91a3a9b2fbe9f14d812f0667e23f83ba53588e0ffb69ea1da633a64128cd0bef7a6bbd6cf4c306a8a7c71020d028
- SSDEEP 24576:cQ9MxZKdcz9dw3rSnnrFb4PM4MYgLxEVyGLt:cVKZ0j4MYPVyGLt
- TLSH T181557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 41538321f59fe4e4d355fff51c7a7598b384a0c8bc11d34112e37c934fdf73bf
- MD5 30403b4b3f1fe8d602d6f128b0d7e9a5
- SHA1 5b3dee3670bb046438ea8608c393cb05e8eb7f67
- SHA512 9b11b839ee9305de9aabc850f40324fbce3be09f711a5bdb532bc280557913348c47878c8415326aa0270f9592b5119bf00c05b77b564b1cb5c7d12b5ade66f1
- SSDEEP 12288:pyoKo2JRple9pH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:pyocDApISnnrFb4PM4MYgLxEVyGLa
- TLSH T15765E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 855071febfc01643f5a1531c94751af34562e3a9bcd1c483031c545f7c9077ad
- MD5 4628862860e9f0c3bc46c862cab9952b
- SHA1 53a0d61ab5500a62c99f4bfbe9ba41c925ad8179
- SHA512 388a3bad14d0828be5fca77ae9e3d1bc6c1c0b4536b6d7021725ef31d308ce1dd17e3b984e85e16c4ce345997b798f1ef038925772d7e5b48fee66cd50390b8e
- SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbj4MYPVyGLP:z0zuNIOVj
- TLSH T11AA57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 a274a12a953e88daedfb85b7661e5f899cebcd68645357acda767ffb76f8adcb
- MD5 582a96c9e728cf5e5d1afc12a4858bce
- SHA1 ff0d0f2ab5112def54bb205184d75734b1e3c434
- SHA512 23119eef0606eee80ef6c0cf3d6fa771bfa450fa0af916e6be7106035c68721574df3eac39238dd0712cb736785729cbe8efdea2e18a8aadf3c8fcd3c05aaf68
- SSDEEP 24576:Q1QT7EcpfxR+N5AWAz3ooiYtjMqbNSnnrFb4PM4MYgLxEVyGLO:tTDxR+N5YzTfjMhj4MYPVyGLO
- TLSH T15C55B02EA7F815E9D1BE85788A23C506FA727821133193CF42A0C17E1F6B5D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 ceef2ce5ec666c9a410da782fdfca9693855ef93224f9bc6a94f892e10b2aa9d
- MD5 e831bfa071e3ca56d287562c279bfa1e
- SHA1 8f8fff921435e1c55289d109c808a11ee9146b77
- SHA512 23d3562100a3b4cc4f730b258c7978649aa913a8895e9c56271ccaf51111a18325a647024e3b124395d2b7150333ffb2d2707e0678e561c4b9d9e0ffec22638d
- SSDEEP 24576:ATMdOz0FFS+imSL5SnnrFb4PM4MYgLxEVyGLn:o0K+imSLyj4MYPVyGLn
- TLSH T16875E17E67AD14E9E57BC27CD6538906E67234620322B6DB0690C07A3F6BFD47939B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 1f6665b1ca7b9798d2b4b8aaf0d35d4faa95e001bdb9e884c8e0dfdda1656e7f
- MD5 40f2366f3590496cfc7cd080c4a2ec54
- SHA1 9ace36f66eb154f628de708a5b027bbb14f0996c
- SHA512 ecdbbc9d823e95866da6e1ba0c10588dce7ba14d65a8cb5a5980d46fc8ede861725189f303db6972c96c39a958818cab462cd64d8e95b1148038f70bf95edb7e
- SSDEEP 12288:K4Kd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:waSnnrFb4PM4MYgLxEVyGLN
- TLSH T1F955125D27EC30E9D9765670C6764288D220B832A73572FF36D0E87A2F376C89875B12
- MD5 SHA1 SHA512 SSDEEP TLSH