Analysis
- max time kernel
149s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
- Size 1.4MB
- Sample260511-d2fg6ad16m
- SHA256 00cd617873b74a572f2ae11d3d9c226e1218c628a487bfa0dab7af1276c2a276
- MD5 1bdecf98a47670d6b06ae7fe1e23e525
- SHA1 546281868d04e606b2c0b0b6f672204ddf207532
- SHA512 8960c6aadb26f52de0de4527b5478b031cec4ab03b60b8b7f028a49278cd26505da5949d93701a83543adc129450fbb298cd953fd0935156e9e685d52f7c0e02
- SSDEEP 24576:QtIZPfhaay8a7MRpSmqAhnMDaiGGC5SYCsfJ4yL/tNCJPXUQrPb:QtIZPZaJtMR8/AhnCQVfJ4klKXnz
- TLSH T1B965AD2DE6A801AAE06A9279EC554702E7B37F05137186CB33A0755A1F776E08F3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2832 alg.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 3872 fxssvc.exe 2380 elevation_service.exe 2188 elevation_service.exe 3508 maintenanceservice.exe 3216 msdtc.exe 5648 OSE.EXE 660 PerceptionSimulationService.exe 4720 perfhost.exe 2480 locator.exe 1040 SensorDataService.exe 1580 snmptrap.exe 3360 spectrum.exe 4608 ssh-agent.exe 5728 TieringEngineService.exe 5208 AgentService.exe 3316 vds.exe 3844 vssvc.exe 2536 wbengine.exe 2624 WmiApSrv.exe 2360 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b716b6e68b62accd.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b7c517cf6e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3c9d87af6e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f8fbe7af6e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c60717bf6e0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 1692 DiagnosticsHub.StandardCollector.Service.exe 1692 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeAuditPrivilege 3872 fxssvc.exe Token: SeRestorePrivilege 5728 TieringEngineService.exe Token: SeManageVolumePrivilege 5728 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5208 AgentService.exe Token: SeBackupPrivilege 3844 vssvc.exe Token: SeRestorePrivilege 3844 vssvc.exe Token: SeAuditPrivilege 3844 vssvc.exe Token: SeBackupPrivilege 2536 wbengine.exe Token: SeRestorePrivilege 2536 wbengine.exe Token: SeSecurityPrivilege 2536 wbengine.exe Token: 33 2360 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2360 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2360 SearchIndexer.exe Token: SeDebugPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2892 2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 1692 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2360 wrote to memory of 4192 2360 SearchIndexer.exe 104 PID 2360 wrote to memory of 6056 2360 SearchIndexer.exe 105 PID 2360 wrote to memory of 3000 2360 SearchIndexer.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_1bdecf98a47670d6b06ae7fe1e23e525_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2832
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5152
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2380
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2188
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3508
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3216
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5648
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:660
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4720
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2480
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1040
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1580
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3360
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4608
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5380
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5208
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3316
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2624
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4192
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2672 2696 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:6056
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2688 2684 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:3000
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 94e55e8a39f21355a3e479b4d4771927af021e645ca2150c614c206680442414
- MD5 c4788d05679afcfc340e82a19a79c9ef
- SHA1 e9da3596697baf33f852a30b78f261277d3f28e4
- SHA512 c8e20381bf8dfdd347efd1d5e4647b1e63359d0d837728df4137b00b348d50185aa2ffbd1f12b267ef72bc21d2387dd93f2cb206dd7f038b6f98cdf0d77c6f8d
- SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnUfJ4klKXnE:V3q6mjBrfJ4k
- TLSH T11FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 522977313c1913a8350640958b7be52c01639e5c9c43e027fc9781a76a54e500
- MD5 d76d95b9f33324c7b8155d42a11e089e
- SHA1 13c5a74490ad261bf5a541ffb24033cbde3fb1a0
- SHA512 f1b3f45dab5ae472fc82179fe05541dafed76524822bebdb5f523ed184596c195662648eb444ee9d621c40bbaa132824f945265e511ca40ff989ce908b1ed4ca
- SSDEEP 12288:j1XLsswWkxy2lRq2czAPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:5XYfDtczAPfJ4yL/tNCJPXUQrP/
- TLSH T12105F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 e8f78c5b79519794cfaf88a406a55f5edca7019bda50bda6112e75d9fb688284
- MD5 424385d9b033c2c4a91ac6dea4d664e3
- SHA1 a8afe994c9eddcc4ec2100abec65aed176688b4c
- SHA512 88e2831bca7d00e817b131b39ac468746dbc1310d75ca9c1d48a979cacdc83c35ef18092cd4e3f363c43bc02650226210a641141aab9309d3c0e2ec37568ae18
- SSDEEP 24576:T0Le5ji0hmxhrMsfJ4yL/tNCJPXUQrP+:TPji0Az5fJ4klKXnW
- TLSH T10435AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 3d6e4a3202c59e74e18893b9300edd5f47a899f12d872d0c6677dbaf4e441c19
- MD5 60c0c4d744ee6f03a988ada858898843
- SHA1 e429d2d96c3c028dfc4495e95a74cd7d7398c06f
- SHA512 eb1c854ed865e2b4f6681408277969e75f77fb49743eccb3bd50d00451ca81944fbcbb508bb7bcbc08f1988a898338ce15d28bdfc6bd0518a26eb4ca3253e1ef
- SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWj6q8wyuifJ4yL/tNCJPXUQrPs:x/ezSC6vUzPv+HjydfJ4klKXnU
- TLSH T189756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 e18bf815b820edd9d672010667405de2007191a1ea3a5a50f67184d7f34154db
- MD5 61d49bb895df6ff40d21c169352f6ef9
- SHA1 e59ae2cf6d5ac3b84a788bca115ffe81b548050f
- SHA512 458aac86ba4e95e3d9e63db2f14286ef8c4f464e8d9cee09ffe78fc4c474c3b0651721e5f8ac07384a0be76c374ce9fcd511de09fe1eabaa05587e2ef249ff48
- SSDEEP 24576:iVbqPb88hv/l+B7fJ4yL/tNCJPXUQrPK:iVO88hXl+ZfJ4klKXnS
- TLSH T160559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 e40ce6b768deab8003201195da5e7497e033fa60d4a791bf2ec27904066066e2
- MD5 60e315bfed3f0645b0f8a342ff6d4204
- SHA1 ea428a9322f1d20d4e3d712acfb3f4faf2552f33
- SHA512 7525b4ec7c542e4c479d5da8a6e63045e845d756915030cdfb34d5555e11c715a888c30316787da1d501dfe2e45fe7cce10007fdac28536f4413b3abfcfc545a
- SSDEEP 12288:tGofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SWh:tGofJ4yL/tNCJPXUQrPn
- TLSH T1E6C423E751809486DF6A87F82A88F001C704BEC5562FA2F6DE82B8C57FFC91A559C353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 261eb2d23c88b818143357856245554d89210657125b80a1a04358399ab27b4d
- MD5 aeec5a2300fa0f057d39e9b10aa52fab
- SHA1 46eb016825a6e646888e4183a0bd6a66778db777
- SHA512 b4b0bb67c774960c9a209a9120d32bfe59cf3f80ff9c433878660b53bbda4db365475f23377bb7f564947dcda8c6c4337b40e18d95de33e80671a46a306de14f
- SSDEEP 12288:ZeBNUbTVO86UzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:ZJIUzfJ4yL/tNCJPXUQrP9
- TLSH T11B05C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 039e082f2b8e37ebf7240494b6a585473ab8a821559037cdce0d230c484900a3
- MD5 7298733693308d95622db59f544bf310
- SHA1 4f2fa8c88cead94a04881025e062b685ec3725fd
- SHA512 dd7c75114430b3af97ca86c4721a993d2ea72ea04a1a419a7652123b1f8ea6adcb3969a0b5865f7128cb70a3761413ede00a965cc062277737aa500d58806e9f
- SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THk:JQvGAdlCEL8c/WRNw5CyfJ4k
- TLSH T1B3266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 c1779322b44504de18bf19ba408f3269eeb6ccd6c760590f2a68a74cd98828bb
- MD5 fc6f9b61096c771407909f87d52c8106
- SHA1 5c6e916912d268e7cd2c9ab471116607938c8196
- SHA512 7552b446a4a04d8d8321845ae499a86dbc2fa9331d62b96455c95bcd5f9af691ab7acb086f934c719113a9a8e0f6e92ab1dbfa081e162332d4e798d24e9b363c
- SSDEEP 12288:7AwSfxL/2Dc3mDLLmt0LDQewsAjJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWZ:kfewsAjJfJ4yL/tNCJPXUQrPv
- TLSH T1B715E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 7f0de2a62fd5b41bf2e4d36933cb7a229249208a84d5ff99e12f93630ae41acb
- MD5 165ad4f8b5c8ffae8a268a6e30a2129e
- SHA1 6c8ebed06e469d1bd72951b083403d1ae1b4c1d6
- SHA512 a54d87e8dc58831f25a6bb2e8abfa359ddadf025aae178a2c1334fb82bc4e0ae1682aa84145b92f78c1fcc901303ec91a0ff8d1d415e701dfb470b9528eafb9d
- SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRfJ4:IUEtQevvqc2W1cpV20I32R
- TLSH T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 b043e971090f36d923743857f9a7572389df4bbf5c679be4828cf6146bee6f63
- MD5 58f2d665fdbcd4c7745b047111343301
- SHA1 558c47f54e274261ba11c94f7e997797afa300ad
- SHA512 57d326b668c54b788515e2261c37b73d620b87a6efece239609d28cdc8a6806cc19bee3de151c22fe16f3fbb209b94a2b73b5fbb85928cf3ae407b7f06237309
- SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zpfJ4klKXn0:PoqtVjnm2fJ4k
- TLSH T110D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 15579dd24b6cc1f902fa7c1d9852658bc09526327743b59a14f1b7a5c0653aa8
- MD5 3727e22b1c1d8b8a27c86854f0654b44
- SHA1 5d96dbdaedd8d24ae63363693724ec2c188c180a
- SHA512 1e9d2ac6531b9b8b736d0103f8777991ab14970ca6a1a7bf88a07c424c7d23597cc4b4390f1441261c65bc0f8cf62413f0334e13b217b1b031e0604e71722d63
- SSDEEP 24576:XAhGL6IFoiwtA5l7S53WfJ4yL/tNCJPXUQrPV:XAM5Foiq5GfJ4klKXnt
- TLSH T17C359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 c24cecf075e8ebe3dd8208f7270ce4c15f3d19cfc7bb64bd120c75448022ef91
- MD5 8443cd799989e28f8c64c4854d79c038
- SHA1 9919efaeb4e395b5c5e4d9bfc9d2f2c7ea8b4f37
- SHA512 a61a25a595aca20258d4793c045e00f520f13e54c3f541da00bf441c49c4af791d95ca9a1d39645f4090f4a1ff5935013353701b0bbc74a0c0518ca1ccf97ae7
- SSDEEP 12288:Tmw5HEjsChNEBFgl0WDm+CCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTS:ywuROW9fJ4yL/tNCJPXUQrPO
- TLSH T16605014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 b0ffa572144fdb49e13e78a5b4f2afce1a4905e49472aff587aa78c864054cce
- MD5 6343faa9042fb1daed332bc71e8a5601
- SHA1 fe7a48e15397ee70e21227116ffb8505681ece2e
- SHA512 c1cbc667e56a5bbb7a7da4b05010819e5b01caa2a53cd4d85f0b7f7538733e1753ee15a36ce77bb07a3d17b18343030f77f106317a0a19bbd25d45bbeaeb63bd
- SSDEEP 12288:fyZ1IyZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:aZukfJ4yL/tNCJPXUQrPr
- TLSH T182E4129B32D460F9DAA782BC89D4D101D3317C92273A83CF5A5195963FBBAC61D3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 9cf6b9795b64194832b631a0dd027d61d8a786846cba41fa3a7ac4d394c00299
- MD5 7ba9ad2d04b5eab616c9a358a8328dab
- SHA1 4a21f6fa044cf76b0e2eeceb518e9f867c92634a
- SHA512 7ab8bcbbe7d46399ee4981c05a9a37b1206c753462f5712395b725b697a43b3502f700282f5492e944b75e151d4c4fb94b05b6de4031654cd965cdddd30b05c8
- SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U:HQRQyi36YOcPDLvw2gAf+PN3nfJ4k
- TLSH T1B0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c3d135dd1f722d31f2e20cc357d19d52c2e30d09d5f4288c90739c6d32b36f4e
- MD5 a36f846937881d3af9665fc5cbb34ea3
- SHA1 584e426507ab28626031ef7d7a9e3b41bbe2d9e4
- SHA512 729efc12d5b0ad70678d1c4c24df5a8b6f78e739be02f0c4d028cd3290dacc8d3840d9ba2468352a523167b01ae5afe4dd0cfcecd608efa55eccd71a1bbc1dcd
- SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:jQRQyi36YOcPDLvw2gAf+PN3nfJ4k
- TLSH T1D5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 c3805214ab96923626b291cfafd716a0613d3ec3bda1f03f0ae3973e12599793
- MD5 6a32a227ab2924f0dbb8389c8a540e3b
- SHA1 0ea473f8d20b8b7962e7d3475270a19f96e8dd62
- SHA512 1fd3d0962218594d85ad9d001fa6eded68adba752bcd9f21552aacd90bb4b76ef5b8b56394b7cdb5f54b492fc7a8d1d1f86b151419bde1a86cfe8b5c3673d70c
- SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0UfJ4yL/tNCJPXUJ:t68Qg55nhkeWu7PNU3/5fJ4klKXn6
- TLSH T195B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 18e35b24fc83c3e79a2c3ff9e1336aa203622561eacbaebbefa1647c99f54a1d
- MD5 3b7fe1146deffc9f194e902ad27d8549
- SHA1 883c33faca8c78f1b2e28e71aaaad8257d66e54c
- SHA512 a065ec1b751af0f72da4ee34ede3aeae88c960a5f8c4eddc42e2f10e7f5363600ff2517bc1bbd9154393cab946204563a621c5c9a0d19226e359c26566da8af6
- SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99X:cy5112gYy5azzVvU69nLKnhZofJ4k
- TLSH T1AF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 448dbacc5c024b68450d2f6226da9871670bbf63d4345f620a025f092371303a
- MD5 f639b2693c349eb7dce69cc8404bc144
- SHA1 f62784b765ee26c07519cacc7d46ae08cf26e507
- SHA512 9ae444765b7f099d97fb2f6eaa7fa8894eafc07d959383d8afe6498b2b2c80fcf9c1e42bf2becc03281dc0d3f51cd8effa7e9e41cba43c334bcdf65f9a72d58b
- SSDEEP 49152:KB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/fJ4klKXnM:Yu6JmIxd2d/fJ4k
- TLSH T16DD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f14c9818fe70043b1f4be8ae06a97ea2ab59ba9ca7b2b3eb244bb5e67febbd9c
- MD5 8419f3a6b3e731d87cc7d7bfe8ad00a6
- SHA1 949c122c9ead885582aeeec3d4a397f44f30f9ce
- SHA512 67046a35c1190445dbd35a0230d29fcc754979f56b74ae6dd7ec19cad9452e530f269dd360fee00696fabc57a7ba6f8cdab05788c635cf2c638544699ba26e5b
- SSDEEP 49152:S1hpsNoJpF1A67U44CwH7R4xTfJ4klKXnv:SmifPqR2fJ4k
- TLSH T11FB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 857d2688482b27c27884e9ab1e1cc31576b4ac5984f9852c32c0052e21e446cf
- MD5 98dad089c03fd7c1a4bab176feef4e6c
- SHA1 bb1d1072cc49d3a3e2bf66ecc36cba9d6c474bee
- SHA512 57a5498e4f5acf6f7a2ac2867e4e6a484430b5dcc0b92157ea571af5af742a5218a54ef756a269b591bb48ede9a5679c867067168046da35d56873c0ee22af12
- SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHqkfJ4klKXnS:/5dKqi61kfJ4k
- TLSH T1BCC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 ce6595376de77b36b362056475a86f9343a0ba91aeaf4533efa074aa91b4120d
- MD5 3f6e919125be525fd798c1f76e108dbd
- SHA1 0c49df773c9ba06c23c1f5d8ab5bf6f6ce17c901
- SHA512 eb29dc9002e610eac31784baef9b9aa3311d7b76b4497c57f34adb262d82e5f50f4b532b43a5d09c121e30f7b7fb083b25a3d19fc1731c50f802d4eecc5554c0
- SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wPfJ4klKXnr:bX2iWph6fJ4k
- TLSH T15E95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 aad60060cbae76fd20994e800662b7b924042d7bf59222d00a697ca81dc3bde1
- MD5 ada9e3d2540af7d0827e26783e3421de
- SHA1 65e9ad6e408c6a15afe999697e8a3785fefebb29
- SHA512 baed5d15f09ec3f5a3923b8bd08169ef17d90da48556664e1395244a726c360e36ff87777c2f08a45b3123fbb6844ad12c05465b27a3bcc0a95105b663407203
- SSDEEP 12288:VAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJN:VAfJ4yL/tNCJPXUQrPQ
- TLSH T11FC423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B4427FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 30f06add6a8a61fe146ae42f5b661e729b9d4ebc6eebeb9242eb2e82e99fa616
- MD5 7a807d463d3e9de18da96b477a9c482f
- SHA1 d7ad502b1011c6178369c312f731ee98d807f045
- SHA512 e58e1993a440346d2238696934ca63a250b06e464aad9488fbb0a58c573af0c05cdd7bc636159cb1b40b0299474f5b2aa0274cc13a244a4ec74c9dbe6d4b98dd
- SSDEEP 12288:MFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJN:MFfJ4yL/tNCJPXUQrPQ
- TLSH T1FEC423AB6095948ADE1587F81788F001C7047EC6672F62F7EF42B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 f72ec4bb9bcb2c8437b14507d3ea0abe3ae089ec369a7271e51d0c817492ef31
- MD5 8921a6a7c17eb6b8b0e47b82af3a5b32
- SHA1 b4c4e069d7095f7eb8f87a98e146fed7d477f24a
- SHA512 df9570de06e8064a73daf21b2f8c84a281795b816e690148ee5cf022e24c9ed08d7b66ddc8876258386b1c02659cb638788eedaddf20ee2d7f23c60e53edcc31
- SSDEEP 12288:YrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:YrfJ4yL/tNCJPXUQrPp
- TLSH T154C423AB6095948ADE5587F81788E001C7047EC6672F62F7EF83B8413FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 1a5cec8189b0d59af663c9e250a2cb75fb3cf8ea68950da2d8c2932f75e3d2ab
- MD5 3682459859a263c55c3f8c40038546a8
- SHA1 81a841025bc140de44c3edce4b6810dfccbad035
- SHA512 40954eb2d9fdb4cf71734c214dcc0342d24393f6de92a8b28b7af7913d47649a48c602cc4fd284d42d414482590e5d40ea14606fd3041b45209f01090cdb9d15
- SSDEEP 12288:JV2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:afJ4yL/tNCJPXUQrPe
- TLSH T18AD42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 366d35fcf2886fffe82f88e3f2974a0023aeca296d2d55d8caafd3857c5c16e1
- MD5 24ab635b4ce5ff4d7e9a94c3d1b28082
- SHA1 5243cd33ee0853508de8e8eab929bd649c7b8cef
- SHA512 81771c850b653507454dcdcb6972deb33384fc47af9a61b58eeba1b4583ca49240c3599b0169ea93e391313d1f0e44f9802ea620630b3cc93bdfe8d2aa0c4918
- SSDEEP 12288:pefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:pefJ4yL/tNCJPXUQrPp
- TLSH T10DC423AB60D5948ADE5587F81788E001C7047EC6672F62F7EF82B8413FFD91A159C3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 ab7ada4a481238e6bf064df0492a16a8eb7c22534c93843c630131a8de6b7282
- MD5 aa8f7b1acbda29ea0e8498497f77a0d4
- SHA1 b2a641a323989a0876aff5b4085f508154dfbaf4
- SHA512 7e377c0d389d4dce52ef1edf675297ab641823f6d4be238c3e73d374e1b9771012318d2499ef73571342cac695829d3d11701151fe2527ebf9b3b4869dbddc57
- SSDEEP 12288:khfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:khfJ4yL/tNCJPXUQrPS
- TLSH T192C423AB60D5948ADE5587F81A88F001C3047EC6672F62F7EF42B4427FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 24ac752826d70021d47f8cc13839267320757fd5386a3df78e95b0b1b1e908a3
- MD5 8eaa404911f3c4719a53d700bba25ef8
- SHA1 100ef8a36e4a15603789b9e2c2af998d4cdd62c6
- SHA512 8bf0be84085c6cac70e0360de4baa78639442c428d72d9de2368c2962252132e14770ae2db913c7a7d125d0fafb7ca28650afbb57c543297530008761d359206
- SSDEEP 12288:ZtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:ZtfJ4yL/tNCJPXUQrPa
- TLSH T1CAC423AB6095948ADE5587F81748E000C7047EC6672FA2F7EF42B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 845822e3373e787153cee758cb2e4a6b813654dda3fcc6ec4b3e8fabb9568b0a
- MD5 335f77dbf3512750fa1c1b4c16706d1d
- SHA1 ba4df7f92c6048c60398dc17bf242fbe3e0f0240
- SHA512 787e11a72be299fe9af112d067a7f6044f8aa3ba27d5ab5b1773a5bb3ea2810e0966ad7264693e4e250f141427efdb117ea13ac30fbe9f4de675cdad717ea878
- SSDEEP 12288:2iZwbDzzFEoS2cPvylfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:5ZM3zFVSOlfJ4yL/tNCJPXUQrPM
- TLSH T1A30501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 d037d8b6fe7c2c64946da3837095afd811ce86cea1ad79853ba00f9df324e127
- MD5 6211d0c1c1e648ba850195ac5e449920
- SHA1 1ec27d70a4c3e7faf42a8429e006b166bbe4b284
- SHA512 89b1521889faeb4b2c3d3792004826d258da88d3ab9c64db0276f379ecbe90bc4378b6cfc04c08a06ddfc7552ef7d0c018d8f45a9d88627e67faa55215291985
- SSDEEP 12288:40fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:40fJ4yL/tNCJPXUQrP1
- TLSH T1CEC423AB6095948ADE5587F81748E000C7087ECA772F62F7EE43B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 6e7544c94c4cc49075e905a809cdc1d04f7978308b2224d2ee5b9607187d7adb
- MD5 c3a3d41c161c20d9d98ea597284e8bef
- SHA1 25b624904eff99c8b5e23a10e1ad72f15338a3a5
- SHA512 caf15eb5faaac38238f67bd70cb089468f28b85735276bc860dfa5cbe17d920a29fa94d7df5614c27e4be5201406e1ad42e13fd94b2d2d10f49f2be1e1330b57
- SSDEEP 12288:L4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:L4fJ4yL/tNCJPXUQrP1
- TLSH T1B6C423AB6095948ADE1587F81748E001C7087EC6672F62E7EF42B8817FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 8576fb4c6257b2f2474d4aa5c82c3b02164d175f0299d2a854ae10ab8b78b2d4
- MD5 30254479c82124e74604da192f930cc6
- SHA1 e9f9c2af89bd0a0cf14d6d1fe867d1cb4de84bd2
- SHA512 80701f20f8a79ee7fe782c5556df48ce6497b1591887730a77c2bcc5a2f7e380691e8204a92f2ae7a78f36920a4b6fcbac91109dce93fd56bc4cecce997910dc
- SSDEEP 12288:AyPz5L8ZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:xzyZfJ4yL/tNCJPXUQrPm
- TLSH T1F8F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 cb165bf684a2bfda3c5b294a955c5f5e60f604a11a51a25545a7110d4dcda858
- MD5 8de41126c4e5d2f55e0aa9b641b9ae69
- SHA1 2f3caf684f8b76819d9ce2a9e33a848c77e8f5fb
- SHA512 156b04d7ddc614a8097c32c2d1f370287de0ad667cb416c1d4e2d1d55c36a8221b1ead7f663c6261b3f96c4d0790871a17557d9b33618d3890b9e4797d4ebcd4
- SSDEEP 12288:j0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:j0fJ4yL/tNCJPXUQrPY
- TLSH T1E1C423AB6091948ADE5587F81748E001C7087EC6772F62E7EF83B8817FFD91A159C3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 3c5204deb3baf50fb492d744ee99dffa9df54ad4bfa0b80483869641bfcad417
- MD5 ee26ca986c53262b8f867320bd53adcb
- SHA1 9eda08d705d2fd7bf10d1b8676f503d1389110dd
- SHA512 b5da00e979789709b5d1b0e4a20a0d9d8f61e9f227aba2beba780ba7eab8b2707ba004b8af0303739a4ee596fb328571ee3ef70fae8eb3568a4d6026ba100bd0
- SSDEEP 12288:70fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:70fJ4yL/tNCJPXUQrPY
- TLSH T1D0C423AB6091948ADE5587F81748E001C7087EC6772F62F7EE83B8817FFD91A159C3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 20e3ab48a394e66e29b357afba6625f345169b23c77a12ad74dc86adcb4e5a45
- MD5 6133f5d68727fe03eb4b4d448dcbc21d
- SHA1 fc26030f1b1d0baa844154ce604164496ed9889d
- SHA512 117e689f17a650bfd3b90f889a32c45c78563743f5e10c9403efb0c71096b2a960c0646dd3b4da9a5ffd825c9ed7e81291bdc1763c9f52b1e107b7c787f66845
- SSDEEP 24576:3CUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAXfJ4yL/tNCJPXUQrP5:3CUAPTY+8Wg2lIL8lrIUJLWwefJ4klKR
- TLSH T1AF65AE1EA3DC0896D4BB81748A51CA06EB32782E1B22D6CF1160C37D6F67ED55E39F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 6b555c9d8dda0d23e131a3e97a3638eb0b6a9e44dc76d6306ae2d58afcd069c3
- MD5 f53793898f1595e557563356e9e62b68
- SHA1 91a7596118d2c161fd46eebe289efa74c1f3a5cd
- SHA512 e6cb72a4650636cd238d3eedafb35405ea45c6ed6ba1203b1905a6d1cfd82d90ca0f2eaed4bfb154bd6f3a8a2c2a041000abe51823c96b31fe1bad8e22b7187c
- SSDEEP 12288:ypsfkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:7kfJ4yL/tNCJPXUQrPA
- TLSH T1FBE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 071edda68e59ed6c0924d7997059b6c7358191d289d00c98c2ac2dafb4eeee42
- MD5 a5af926069448d399e537f58569f2c77
- SHA1 ca0ba4c056197c727e089ca22551bdc37d40475d
- SHA512 9d3fc3f4a8fc96a986479ff9faaf7acce4fda12c28805cdbb6d7b9dc750aaf682158ccce9f4197231a8a21bfb56ae177ccd6208018305117f1867dcb2095077a
- SSDEEP 12288:zLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:zLfJ4yL/tNCJPXUQrPa
- TLSH T1B0D423A751889446DD7A87F8164CE000D308BED56B2B92E7EE42B4853FFC99A1DBC353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 12c6cee577321b33f832c737458a6fb4ada74cb0888343c8ff89543a9baa024a
- MD5 f4c3530cb04d8d96841015dcdfb32da1
- SHA1 d2c771ff0e307e7a1f3b21d35d9d35097b571c1c
- SHA512 3c842c7b4d796d4e308a7e90b374ebf55fa5ea3a8b9b54e6e08afe2dc006cf1b9696b8c3af8c95f1dce20b5238675ecaaeb101f13130a7aadd1a8a5cc1ae276a
- SSDEEP 24576:c8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCpfJ4yL/tNCJPXUQrPM:VRZwQCyiHiQEaaPnMMfJ4klKXn0
- TLSH T16485B01E62DC46A5E0BAD2B8CDA74407E6B27816573193CF0191C27D2F27EF45E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 676KB
- SHA256 83c6fa0f9ecebb33a26a5fba3cd1a8352508fe01c3582ff7d42ff01648ba6b66
- MD5 5d9e0cd2a4eac92d6c5bb1c9f91b5d32
- SHA1 a8c747b0cca54b20ea986dc3235c7da5ff20074e
- SHA512 5c5e5c8bffcf4f98b24b0e1cd0f74f7f70f2e607e6e642f457aab86fef6f7f5c96c2da3373b00efa2b3d4e2594f1625b53f5badbab3fe253682f031f3e3cc5c9
- SSDEEP 12288:dbxA1U7KbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:dbxA1UGbfJ4yL/tNCJPXUQrPj
- TLSH T13FE4126F21DC24E5E976927C4984C001C331BC962726A3EF65C1D17A2F7BEE91C39B92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 47bd63de3b28b2edf88afe743515a87b3139d4d2155d7b59b3d59affcb807ed7
- MD5 e621417e45c919f951b1517c401f9935
- SHA1 040d6b5d055fac4599e43a2ee3912bb6352183c5
- SHA512 819bd2cf29275948c2fd5e41962989832b15d02f2bcd06fef7ac65ed81b85a4997083f7efaa89ed3cf951235575e4151e26952dd2201ef931cc910ab2f85893c
- SSDEEP 24576:wjsmP0yHaqrVqHra44KDzMsrnGfJ4yL/tNCJPXUQrPF:wjRP0yHfVqzlAsrnGfJ4klKXn9
- TLSH T1E545BF2EF2B910F9D8AAC176454143B5EB71782D1F219AC70170C634AF0AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 596KB
- SHA256 418f17d3dbce2424dadca530246e09f9171e4c3568b2d361bbdba0883a69b88d
- MD5 300ec2fe02bf41de9b0b4c34f9a936ff
- SHA1 b9c5bac45edf61f1005a51b45963292e0bafc7c0
- SHA512 d9667b08d3e819eff71ecbd698bdce6bc6b6c6a7308c7398b3382abf0c240257f6bd5306dd7d0cb41a80d88dc8c8ff8b0ee0018e492785a5a1b6288402596fa2
- SSDEEP 12288:8BfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:8BfJ4yL/tNCJPXUQrP1
- TLSH T16DD423AB60859486DE6687F81648E001D3047EC5272F62F7AD42B4827FFD99B19BC392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 9fd1d984f054d5a609d18da5ce8e16ca4b56ce5218cf01d1a5de73187ff39444
- MD5 6c77e567f22a8e7ae7a10ed285c9552c
- SHA1 2b7359e45b76284d6a3bbf15e925f9b80d402147
- SHA512 0d3aa5a93b76337ea5546e64bf416d755da71f5530a385ecd50c82a9124d905791d53593cf2254b1740ec4078829443bc41ca777ff684818a9cbdb40071b1448
- SSDEEP 12288:lObIA4LWO+vAYFTPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:iALBUTPfJ4yL/tNCJPXUQrPq
- TLSH T11225F155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 800KB
- SHA256 2a9c317c0e4fd3d24c855333048ea628523c6929ef017218d2137db14960e675
- MD5 26724cf14acf2f0e81528c016b2b875b
- SHA1 ab300cddd5c7cc8abec2b98a17d6371ffb14f3c2
- SHA512 1798f2d33cf4d875a29ea790b412ec16ffdc5ff1d609a2ae2e3537143fd3c4381580a56413f8f31fe120f80176414a7a0a249bdf0b7f6fdef0b12b52cb602981
- SSDEEP 12288:g70VmzIYNvUyBpwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:9fYNHKfJ4yL/tNCJPXUQrPN
- TLSH T12E05F12F62AC08E5D93B917D8AC2C105F3727896171692DF05A0C2BA1F67EE97C3D741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ad6ad86246872f0d1e1d4ddc0054ea189ba591232f595c0a62caadcc125474da
- MD5 89d00b6ece2fdf1767151f03762fbc26
- SHA1 dcc475f9c64fccf8107fd62778c8f0f2186fd816
- SHA512 73a80a93f9f3f5a8a956800b78444de14ce03ef0a30a29610327e061fdc96ee9e472fb7bbda7bc62d0d88b8b324588a8d9f6fd1b1ffd36b68a6cab946cd96416
- SSDEEP 24576:8nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:8nXoJJYH84VVS6AmETJas+cHBjSSKHPm
- TLSH T19065BFAEA2BC04D8D5BBD17CC5C29506F5B178621331C6CF026182BA7F27AF55E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 d843829e7660b0f74b76b685de091f40cbd2e7593d657bc1ebddb7f557f04550
- MD5 d500defe74ae9aa6f9717f2c688378cf
- SHA1 957fd8bd11e59ec29acd3ec216c63fdd0ced0891
- SHA512 8e9c4b69060a5d6db3fc019785906e784ebfbec8c1fc6c3df155f8d718788fa7affbe70f926ecebf20d541147001a3284fb182f59626713b66db6cbea28dd69f
- SSDEEP 24576:Dv7Xbxd9Tuycf8M/TYlSuxwr2PCIfJ4yL/tNCJPXUQrPU:DDLL9TuJ0M/TYW2PhfJ4klKXns
- TLSH T1A9858D5EA3EC42D8E47BD6BD85B69046FAB2B895173081CF0251856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 f400d56656919e902cb86847acbb0e592a3632e7c4b321463f9a3bfab7aa643b
- MD5 c00e8004a76ff32b0fe094521bae0587
- SHA1 040d140364002b552761551f91ab8d38800b99e2
- SHA512 815e9fdd084cd9584a9e2aa27eb077a8097ff101db5b813171c57a5197e6328f39c937477eec3b2a31ef3b24b85bf6ab13877ecacfc6ebb67856b08d59ee6157
- SSDEEP 24576:2egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wPfJ4yL/tNCJPXUQrP1:2ngOJOmPOHkPfJ4klKXn9
- TLSH T11655CF3FA7BC15D5E03EC17D8A968806F6B1786603265ACF0560827E5F1BEE42E3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 904KB
- SHA256 38b068a758c66f5fe806458b00a902b677a3faeb00150ab39ed99c11b37b03ba
- MD5 91bbbf30da89cb4190bb67b87ddb67a4
- SHA1 069a574865d284bfb43f7d93dc12b2db869683bc
- SHA512 2e075087da88a6b4bcc2d39a279ee6d5e01a9eb5a8d12603d8bedb06e987297b96eceed984ca7ec5be8fab2149e166286fae2add875b06c6cfe59e88fb1f0e65
- SSDEEP 24576:JLJnJiTk3R3waE4JrOhfJ4yL/tNCJPXUQrPD:JLJnJK8R304l2fJ4klKXnb
- TLSH T1CE15E03DD2E810E8D4B7C2B482596656FF31386C2B2669CB59B4D4313F12FE0AA79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 242d6d5399f256410304c8ab0550b7e1ba9e894def199e7558d25cc56d25ddd9
- MD5 f36232c8de149bfc59c5978d41221110
- SHA1 2a7235165b9e5ba73c3aace0e4b340659b030f7e
- SHA512 512fa1d665583bf5464b64b79d51e4dc9b08f2eae00705a1f1c55802bbd673d8d78349a038133cc2981cf99e333f5209a83778cade41427c25e9bf2af688357c
- SSDEEP 49152:29GqCzDScAZmlvTcFg8Ph6tfJ4klKXnI:IqfJ4k
- TLSH T154955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 676KB
- SHA256 f2575f4763ae9c2dc9662c8a5698262cb84d7ef880e5b4cbd3d29d9e5e3db22f
- MD5 395998a72a3e86267f9da201107f562a
- SHA1 5db5cab725f6d42751879f8b42e41aa1752a3650
- SHA512 a431b63e56ef94ce8a8e423bb73b75f26e72bacac55286d080a86417d4088b26a8fb25fe2f10ce1d2795a92175cc7de3a63e722b8bcc47af86509e7017705a57
- SSDEEP 12288:flYJeXm5nkEUuEffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:flYJeXm5jUuEffJ4yL/tNCJPXUQrP7
- TLSH T14EE4129E319C70E5D52A82BC5584C100D331F4E5271663FF96D0D1BA6FABAE62E3CB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 732KB
- SHA256 5f24dfb44008056416a47c682aef5065200362e76958825051c7b71873dee3f2
- MD5 0c7e64abc17297d7e78fb8ead9ffd141
- SHA1 54a3110d757f00b70e993e66f2daf84c77b67561
- SHA512 3fd72758adab585a63e51122c4ea90b8a474106129fe93ab54e98ad1b207a6f1966051cce3996118851040511811f0ffefb244ba4cb2f4171293163275c6e796
- SSDEEP 12288:Gwu6kymfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:GVtymfJ4yL/tNCJPXUQrPL
- TLSH T167F4125622D4A098EE7647B89A91C040CB34BC905F2693EF99C1F53F3FBABD56834712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 604KB
- SHA256 6fee4dbec994844dbc59c14effde8e01d20ba6f33bc8f209eb67b8b09a3d18c2
- MD5 9465d167ffc3b480089a86430a52dac9
- SHA1 ca7bafdea1f71e58b1ad5b8e2fe51eb9da00d451
- SHA512 0f7bcbb9b4e0836ac193c365fb23d5d50a5fba6a3952aa05211dade1425d2a6b7d377d3f6ff4f1e2377120072708feb2d1e9155aea962b55ec0fd2ef2616ae88
- SSDEEP 12288:oPPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:4PfJ4yL/tNCJPXUQrPz
- TLSH T153D423AF2194A089DD2687F81648E000C3147EE5272B62FBADC2F4B17FFD95615BC792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 d68bc802223dc913e99fe3851c7a135ae556d120d18fb797357091074fa27edf
- MD5 476d7398f72e45e3c3051b4440e83c80
- SHA1 aa0268b0da9286dc41f61e9b469dc5521fbaa2d2
- SHA512 2bc51920cb3932d9b14529a22d9088953ebc7cc357c7b1b77cb490d94e7d87ad715981f695ab5fe2fbd112deb37b34bc5d077907b8622f6e4aabb6a760b795ec
- SSDEEP 24576:rC+TyQIu93VAumZr7jmEfJ4yL/tNCJPXUQrPC:r/TfIq+YEfJ4klKXn6
- TLSH T182558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 768KB
- SHA256 8dff2034ebcae011934fe475163ce134b4e626f1c9644d33b00c0880517a27db
- MD5 578de1d4bdceb56501139d84bb724317
- SHA1 6ea14f8d524da4a95e76a0784fd9149408c87d72
- SHA512 9171953ec3a9c0d6eb1e63c47342643add59082a42025515ad67e0e9bcd0dc88d3cb9d79884e03a3c3eb02eb83b209788e716c066186b7c34e425e6a93edd922
- SSDEEP 12288:1cyrWOstaa3kcsjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:ALQikZjfJ4yL/tNCJPXUQrPW
- TLSH T1B0F4F10FB3AA00A5D5A7C27C89848102F77378B5571263EF4690C7791FAB5EA7D38B81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 83ee44753d9f11e593810d4eed94bb6573b7ffd508ee2020bd799cf31a261c51
- MD5 8482d5c5aac40c67e5da92cd3427aa4c
- SHA1 d196d3c3281d8b2cecaca8696f0b5fdf9ab74413
- SHA512 184cdb4994050472723e3be86213f0f8715b81e26340fda9600a0039c13fd530132a13c5b0ff9c171a86e8408f9428e2235860caf159ab84db5b101273730dcc
- SSDEEP 49152:cpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPmfJ4klKXnT:dpC7b4+80GTkVfJ4k
- TLSH T107A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3c4e94dda03054a430ccfc89ccf7d59fdbebd38e8d50286bb8d2d68984303eb5
- MD5 3682dda0f6d5d3f4573936369c5e9ffc
- SHA1 61086bc1f64767361e1f2e818ea60ebeb23b5c00
- SHA512 0f71b1c382c942b1a8a40c099215921a91e7abebaf8a12241c1a6423a5aa708fcdcdca178cac3b3912cae1312193fe7c0853602ea3debbeda0a2575a6739600b
- SSDEEP 24576:/SAwJPE1IDAo+4Kt+l4413lUQ+fJ4yL/tNCJPXUQrPb:/qPCIo4Kol4jQ+fJ4klKXnT
- TLSH T1B655BF2AA7F956E4E17ACBB49663C101FB727823133163CF9290813E1F169E85E79F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 956KB
- SHA256 0fd55cd3ab328ea4ef3b7146a5ee0b6e28a572a60a5b9e23e6b5772e83da2fa9
- MD5 93fefcf58f5523775f0b9b535f8aff2d
- SHA1 b2c2162b0f8b0c8cf2abb3148a81df0ec1a5f5e1
- SHA512 24f1324550a5d37007591fa0e092ae2a6d51acc2b21072b713b63f6819c7390c20d99bf32e5a93fd2ce2f764854f79d4062819cd21e6a2cc2e0e5a87b074add0
- SSDEEP 12288:ASsyLCFBoPLCRyE6NQ4tOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:4yLXPLcT94tOfJ4yL/tNCJPXUQrPg
- TLSH T1D925E13EE66C04E5E47AC27CD6928506F6723CAD033266CB199094792F6BFF4693DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 744KB
- SHA256 1fbad530dc66ec51d52a3e30b98778c91528c3123cf6b7423594d37c54b0ef3f
- MD5 7760c56ee98f21e4b939d7dca652c513
- SHA1 3f8dd592e51dd15d2ad83c74e5b74519c8539d80
- SHA512 e388122531da9bfe274dc53b07a206af28232608641f73c398ca5bbc50cbceeaea85ddde89580c4497bdec39bac2b51339bd46918b7310b5c2476f997ebdcb32
- SSDEEP 12288:S9lyvj3IkxjbBzTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:SWv8qjpTfJ4yL/tNCJPXUQrP2
- TLSH T173F4129F12D064D8E83983B89654D111C231BDF6132AA2FF75C0E8BA1FB9AC5953EF11
- MD5 SHA1 SHA512 SSDEEP TLSH