Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe
- Size 2.5MB
- Sample260522-w92pgads7k
- SHA256 15220b01e9aa45aeb5b1f92dd68f49cbe4ce194e12690cb4ce39c78eb5050952
- MD5 ef39f82ded660ec21584f74ddb833623
- SHA1 dc7319cb99150680bd3c25929623785590f1b6e0
- SHA512 5438df3f0ba89182b4f5c6edf2a6d54f8013e4b5b1b4ac91e48274eb8f0b3e98cafe9b2d19a9816c1496343f3079614f64c0b80f40d94928e3d789dcfe5032c3
- SSDEEP 49152:sPReHIs6FBIfUgT7L15Tq2RbajNk/wQy8xDQB8ungchJzB+kn3Hnx:s4oXFsUgbb+ywN6wD8xDM8cgo1+k
- TLSH T14DC5CE2773299FADF0C645B77250FD2045F1BB88B43B6A779CB16D0A3A03530999B839
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Reflective DLL injection artifacts 17 IoCs
resource yara_rule behavioral1/memory/1284-208-0x000002327C7D0000-0x000002327C7D3000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/files/0x000b0000000244c7-383.dat INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-406-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-401-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-395-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-392-0x0000000000820000-0x0000000000860000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-407-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-405-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-404-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-403-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-402-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-400-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-399-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-398-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-397-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-396-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/3340-394-0x00000000025E0000-0x0000000002625000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
resource yara_rule behavioral1/files/0x000a0000000244c7-30.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe - Executes dropped EXE 34 IoCs
pid Process 5044 alg.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 1396 fxssvc.exe 2380 elevation_service.exe 3096 m4r6z10h.exe 1340 elevation_service.exe 2444 maintenanceservice.exe 1864 msdtc.exe 3160 OSE.EXE 3540 PerceptionSimulationService.exe 4432 perfhost.exe 4768 locator.exe 552 SensorDataService.exe 3388 snmptrap.exe 4544 spectrum.exe 1148 ssh-agent.exe 2796 TieringEngineService.exe 4780 WinUpdateHelper.exe 1916 AgentService.exe 4252 vds.exe 2808 vssvc.exe 4852 wbengine.exe 2736 WmiApSrv.exe 4292 SearchIndexer.exe 4640 v4z40v7q.exe 3548 t6grbw44.exe 1092 rpic6vju.exe 2256 winhost.exe 5232 elevation_service.exe 5440 elevation_service.exe 5776 elevation_service.exe 5836 elevation_service.exe 5220 elevation_service.exe 1340 elevation_service.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v4z40v7q.exe" v4z40v7q.exe - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c81584443a3ba122.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3548 set thread context of 4980 3548 t6grbw44.exe 122 PID 1092 set thread context of 2124 1092 rpic6vju.exe 124 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 notepad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString notepad.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5a966301aeadc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b4945301aeadc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000962a49311aeadc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014708a301aeadc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027e561301aeadc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbbe3b301aeadc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ccc00321aeadc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35037123-db54-4050-a RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7e9813b-3da9-4b96-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f153bb9a-88f3-4472-b = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35037123-db54-4050-a = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7e9813b-3da9-4b96-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\28f8ce5e-a2c1-4f69-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\28f8ce5e-a2c1-4f69-b = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\221cc3b5f53253f7e9cefb3d52a2273244858787910e0df9b4c6ada32d8d54c7" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c08c65d-ea1f-4b59-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35037123-db54-4050-a = "8320" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ae505af-29df-4005-9 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\28f8ce5e-a2c1-4f69-b = b57d722e1aeadc01 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\014d05cb-0543-4c49-9 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3fda1ecd-c32c-4063-8 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a8d40c86-ddd5-43ee-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eed30c2b-9626-4178-b = "8320" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ae505af-29df-4005-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\014d05cb-0543-4c49-9 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\014d05cb-0543-4c49-9 = "8320" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ea611d2-d592-4054-a = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\221cc3b5f53253f7e9cefb3d52a2273244858787910e0df9b4c6ada32d8d54c7" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eed30c2b-9626-4178-b = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f153bb9a-88f3-4472-b = 9c97632d1aeadc01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f153bb9a-88f3-4472-b = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ae505af-29df-4005-9 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ae505af-29df-4005-9 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000deb7e42b1aeadc019224952c1aeadc019224952c1aeadc011fcb17000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b65ccc942000373964326630333961326438646630643861313762393765663134353837376263326364313936643065306562303533363638316339363165353238363233360000b20009000400efbeb65ccc94b65ccc942e00000000000000000000000000000000000000000000000000b55d5b00370039006400320066003000330039006100320064003800640066003000640038006100310037006200390037006500660031003400350038003700370062006300320063006400310039003600640030006500300065006200300035003300360036003800310063003900360031006500350032003800360032003300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000448415c81000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37396432663033396132643864663064386131376239376566313435383737626332636431393664306530656230353336363831633936316535323836323336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000786862637a7373690000000000000000ee3d3289c87f3a49a37ce7c088e94cf3084e183c174ff1119f3c6e95c79f7e05ee3d3289c87f3a49a37ce7c088e94cf3084e183c174ff1119f3c6e95c79f7e05ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003200300034003400380038003800390035002d0032003900390039003800370037003600320034002d003200390036003100350033003600360038002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000ee0681d7000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ea611d2-d592-4054-a RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\28f8ce5e-a2c1-4f69-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2cb492da-2d1c-426e-8 = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\8464d6de26f341f807356820da4d0d9fdb37b3647de933b21ae9a7a4744169fb" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64f703f6-aa7f-4e9a-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000004b327e2b1aeadc014b327e2b1aeadc014b327e2b1aeadc01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b65ccc942000373964326630333961326438646630643861313762393765663134353837376263326364313936643065306562303533363638316339363165353238363233360000b20009000400efbeb65ccc94b65ccc942e00000000000000000000000000000000000000000000000000b55d5b00370039006400320066003000330039006100320064003800640066003000640038006100310037006200390037006500660031003400350038003700370062006300320063006400310039003600640030006500300065006200300035003300360036003800310063003900360031006500350032003800360032003300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000448415c81000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37396432663033396132643864663064386131376239376566313435383737626332636431393664306530656230353336363831633936316535323836323336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000786862637a7373690000000000000000ee3d3289c87f3a49a37ce7c088e94cf3fe4d183c174ff1119f3c6e95c79f7e05ee3d3289c87f3a49a37ce7c088e94cf3fe4d183c174ff1119f3c6e95c79f7e05ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003200300034003400380038003800390035002d0032003900390039003800370037003600320034002d003200390036003100350033003600360038002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000ee0681d7000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3aedcb2f-1f59-423d-a = 496e912b1aeadc01 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ea611d2-d592-4054-a = e9a0942b1aeadc01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2cb492da-2d1c-426e-8 = "8320" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ea611d2-d592-4054-a RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64f703f6-aa7f-4e9a-9 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35037123-db54-4050-a RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64f703f6-aa7f-4e9a-9 = "8320" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64f703f6-aa7f-4e9a-9 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9fb805d5-6f16-4ad4-9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\014d05cb-0543-4c49-9 = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\62c6e6fe1e12ee837c5d87a8f4dd57fd37ed97db86985d503616831deddb51ad" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9fb805d5-6f16-4ad4-9 = dff9482e1aeadc01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2cb492da-2d1c-426e-8 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3aedcb2f-1f59-423d-a = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000042818c2b1aeadc0142818c2b1aeadc0142818c2b1aeadc01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b65ccc942000363263366536666531653132656538333763356438376138663464643537666433376564393764623836393835643530333631363833316465646462353161640000b20009000400efbeb65ccc94b65ccc942e00000000000000000000000000000000000000000000000000be0e4d00360032006300360065003600660065003100650031003200650065003800330037006300350064003800370061003800660034006400640035003700660064003300370065006400390037006400620038003600390038003500640035003000330036003100360038003300310064006500640064006200350031006100640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000448415c81000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36326336653666653165313265653833376335643837613866346464353766643337656439376462383639383564353033363136383331646564646235316164000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000786862637a7373690000000000000000ee3d3289c87f3a49a37ce7c088e94cf3004e183c174ff1119f3c6e95c79f7e05ee3d3289c87f3a49a37ce7c088e94cf3004e183c174ff1119f3c6e95c79f7e05ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003200300034003400380038003800390035002d0032003900390039003800370037003600320034002d003200390036003100350033003600360038002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000ee0681d7000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ea611d2-d592-4054-a = "8320" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7e9813b-3da9-4b96-8 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f153bb9a-88f3-4472-b RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35037123-db54-4050-a = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\8b6a61668eb165e9f9fd97ef4e5ac7482ed694211c1eaa65589ad10535226ec8" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f153bb9a-88f3-4472-b = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000f368d62b1aeadc01421e302d1aeadc01421e302d1aeadc01988e1e000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b65ccc942000306138303165613566353366396466646566386334343339323934316336373366326666343962653437353734646261383661653432666663303934363764360000b20009000400efbeb65ccc94b65ccc942e00000000000000000000000000000000000000000000000000c4d45100300061003800300031006500610035006600350033006600390064006600640065006600380063003400340033003900320039003400310063003600370033006600320066006600340039006200650034003700350037003400640062006100380036006100650034003200660066006300300039003400360037006400360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000448415c81000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c30613830316561356635336639646664656638633434333932393431633637336632666634396265343735373464626138366165343266666330393436376436000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000786862637a7373690000000000000000ee3d3289c87f3a49a37ce7c088e94cf3054e183c174ff1119f3c6e95c79f7e05ee3d3289c87f3a49a37ce7c088e94cf3054e183c174ff1119f3c6e95c79f7e05ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003200300034003400380038003800390035002d0032003900390039003800370037003600320034002d003200390036003100350033003600360038002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000ee0681d7000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9fb805d5-6f16-4ad4-9 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3aedcb2f-1f59-423d-a = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\62c6e6fe1e12ee837c5d87a8f4dd57fd37ed97db86985d503616831deddb51ad" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\3aedcb2f-1f59-423d-a = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a551d8e6-5c4d-4dfe-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\64f703f6-aa7f-4e9a-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7e9813b-3da9-4b96-8 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9fb805d5-6f16-4ad4-9 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000007dcaf72b1aeadc01dca8582d1aeadc01dca8582d1aeadc01859918000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b65ccc942000386236613631363638656231363565396639666439376566346535616337343832656436393432313163316561613635353839616431303533353232366563380000b20009000400efbeb65ccc94b65ccc942e0000000000000000000000000000000000000000000000000005e94500380062003600610036003100360036003800650062003100360035006500390066003900660064003900370065006600340065003500610063003700340038003200650064003600390034003200310031006300310065006100610036003500350038003900610064003100300035003300350032003200360065006300380000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000448415c81000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c38623661363136363865623136356539663966643937656634653561633734383265643639343231316331656161363535383961643130353335323236656338000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000786862637a7373690000000000000000ee3d3289c87f3a49a37ce7c088e94cf3094e183c174ff1119f3c6e95c79f7e05ee3d3289c87f3a49a37ce7c088e94cf3094e183c174ff1119f3c6e95c79f7e05ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003200300034003400380038003800390035002d0032003900390039003800370037003600320034002d003200390036003100350033003600360038002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000ee0681d7000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\014d05cb-0543-4c49-9 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000085dd292c1aeadc01da81322d1aeadc01da81322d1aeadc0108ff1d000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b65ccc942000363263366536666531653132656538333763356438376138663464643537666433376564393764623836393835643530333631363833316465646462353161640000b20009000400efbeb65ccc94b65ccc942e00000000000000000000000000000000000000000000000000be0e4d00360032006300360065003600660065003100650031003200650065003800330037006300350064003800370061003800660034006400640035003700660064003300370065006400390037006400620038003600390038003500640035003000330036003100360038003300310064006500640064006200350031006100640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000448415c81000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36326336653666653165313265653833376335643837613866346464353766643337656439376462383639383564353033363136383331646564646235316164000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000786862637a7373690000000000000000ee3d3289c87f3a49a37ce7c088e94cf30a4e183c174ff1119f3c6e95c79f7e05ee3d3289c87f3a49a37ce7c088e94cf30a4e183c174ff1119f3c6e95c79f7e05ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002d00000053002d0031002d0035002d00320031002d003200300034003400380038003800390035002d0032003900390039003800370037003600320034002d003200390036003100350033003600360038002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000ee0681d7000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2cb492da-2d1c-426e-8 = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\9fb805d5-6f16-4ad4-9 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eed30c2b-9626-4178-b RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d654aca4-e8d4-4bb1-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ae505af-29df-4005-9 = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\79d2f039a2d8df0d8a17b97ef145877bc2cd196d0e0eb0536681c961e5286236" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2cb492da-2d1c-426e-8 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7e9813b-3da9-4b96-8 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7e9813b-3da9-4b96-8 = "\\\\?\\Volume{D78106EE-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\8464d6de26f341f807356820da4d0d9fdb37b3647de933b21ae9a7a4744169fb" RuntimeBroker.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4780 WinUpdateHelper.exe 4780 WinUpdateHelper.exe 4640 v4z40v7q.exe 4640 v4z40v7q.exe 4980 notepad.exe 4980 notepad.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3340 Explorer.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3548 t6grbw44.exe 1092 rpic6vju.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4828 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe Token: SeAuditPrivilege 1396 fxssvc.exe Token: SeRestorePrivilege 2796 TieringEngineService.exe Token: SeManageVolumePrivilege 2796 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1916 AgentService.exe Token: SeBackupPrivilege 2808 vssvc.exe Token: SeRestorePrivilege 2808 vssvc.exe Token: SeAuditPrivilege 2808 vssvc.exe Token: SeBackupPrivilege 4852 wbengine.exe Token: SeRestorePrivilege 4852 wbengine.exe Token: SeSecurityPrivilege 4852 wbengine.exe Token: SeDebugPrivilege 4640 v4z40v7q.exe Token: 33 4292 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4292 SearchIndexer.exe Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeDebugPrivilege 5044 alg.exe Token: SeDebugPrivilege 5044 alg.exe Token: SeDebugPrivilege 5044 alg.exe Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3340 Explorer.EXE Token: SeCreatePagefilePrivilege 3340 Explorer.EXE Token: SeShutdownPrivilege 3816 RuntimeBroker.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4828 wrote to memory of 3096 4828 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe 89 PID 4780 wrote to memory of 1284 4780 WinUpdateHelper.exe 51 PID 4780 wrote to memory of 2784 4780 WinUpdateHelper.exe 53 PID 4780 wrote to memory of 3340 4780 WinUpdateHelper.exe 56 PID 4780 wrote to memory of 3816 4780 WinUpdateHelper.exe 60 PID 4780 wrote to memory of 4076 4780 WinUpdateHelper.exe 62 PID 4780 wrote to memory of 4772 4780 WinUpdateHelper.exe 65 PID 4780 wrote to memory of 1040 4780 WinUpdateHelper.exe 79 PID 3340 wrote to memory of 1912 3340 Explorer.EXE PID 4828 wrote to memory of 4640 4828 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe 117 PID 4292 wrote to memory of 3084 4292 SearchIndexer.exe 118 PID 4292 wrote to memory of 2004 4292 SearchIndexer.exe 119 PID 4640 wrote to memory of 3340 4640 v4z40v7q.exe 56 PID 3340 wrote to memory of 3384 3340 Explorer.EXE PID 4828 wrote to memory of 3548 4828 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe 121 PID 3548 wrote to memory of 4980 3548 t6grbw44.exe 122 PID 4828 wrote to memory of 1092 4828 2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe 123 PID 1092 wrote to memory of 2124 1092 rpic6vju.exe 124 PID 4980 wrote to memory of 5204 4980 notepad.exe 131 PID 4980 wrote to memory of 5204 4980 notepad.exe 131 PID 4980 wrote to memory of 5412 4980 notepad.exe 134 PID 4980 wrote to memory of 5412 4980 notepad.exe 134 PID 4980 wrote to memory of 5736 4980 notepad.exe 141 PID 4980 wrote to memory of 5736 4980 notepad.exe 141 PID 4980 wrote to memory of 3680 4980 notepad.exe 149 PID 4980 wrote to memory of 3680 4980 notepad.exe 149 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1284
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2784
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_ef39f82ded660ec21584f74ddb833623_cobalt-strike_icedid_satacom_vidar.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\m4r6z10h.exe"C:\Users\Admin\AppData\Local\Temp\m4r6z10h.exe"3⤵
- Executes dropped EXE
PID:3096
-
-
C:\Users\Admin\AppData\Local\Temp\v4z40v7q.exe"C:\Users\Admin\AppData\Local\Temp\v4z40v7q.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\t6grbw44.exe"C:\Users\Admin\AppData\Local\Temp\t6grbw44.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe4⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:5412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:5736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:3680
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rpic6vju.exe"C:\Users\Admin\AppData\Local\Temp\rpic6vju.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe4⤵PID:2124
-
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4076
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4772
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:1040
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4160
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2380
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1340
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2444
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1864
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3160
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3540
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4432
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4768
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:552
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3388
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4544
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4264
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
C:\Users\Admin\AppData\Local\Temp\ms-updates-tmp\WinUpdateHelper.exe"C:\Users\Admin\AppData\Local\Temp\ms-updates-tmp\WinUpdateHelper.exe" /install1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4252
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2736
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3084
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:2004
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
- Executes dropped EXE
PID:2256
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5232
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5440
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5776
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5836
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5220
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1340
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d554458ce248ade484ee70d1ff3668ab25bf6b2eb39f44aa833782b6df15e97a
- MD5 80a76beea97f792e296b17c5f8a6e674
- SHA1 fa1c76a0a80c7776316d0f29a4bedf630f002230
- SHA512 2689e1fdcef8dac62a79d02d38f7ecf061bea21c6477dcca5cb7734995d588b226b156d2202a0c8a73618bb40f91320a26d38ddc8a5557418360045bb1172571
- SSDEEP 49152:tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnOB+kn3Hnx:z3q6sjBp+k
- TLSH T192D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 61d76e8dabd05af94af193be322d93ea25bd5ddaad050f34c61fe6f491094545
- MD5 7104ba322a3cf34828b6c8edebeaef6f
- SHA1 12e6f9c75f589afc22a6be441537c1df502f944d
- SHA512 e6e093ebdaf10d932275d4b1fbf6ca18459e96ad0491485ab2ff27027a8920fdb0468cddc8cdbc9d8b827ee2161192a121872da6f2671cc0ac205ed7eaab2d6e
- SSDEEP 12288:c1XLsswWkxy2lRq2czAzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:qXYfDtczAgNyBo4kx929bL3Hnx
- TLSH T14F65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 e57bb7f344fbe918f4ecf0b1252acbd785ae0b4ef9dcabf4786a2bf16ad6ecba
- MD5 311c2d4bc61d24be5923c54a96e3a6cf
- SHA1 fbd7ad7882da7006fd9018026bdfaf6b6114476c
- SHA512 df9e20e58980252adf317cb9a9779dea990441cfdeeb064dc3bc9ced1b7531415b25480cf371d116518741ef6a97193079cb8efddf680124b7f8bb9f6c13530b
- SSDEEP 12288:Vmw5HEjsChNzBFgl0WDm+CMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Qwu6OWaNyBo4kx929bL3Hnx
- TLSH T1E965F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b69b928f103fcfe0adecfef00fc772774830b49d15f05f0718995e96057b8b0d
- MD5 d6c481b823fe70ea923ba4dbb8d3da5c
- SHA1 43901ff80b56ba9e66fdfdf145e0b0998773b889
- SHA512 398deff84cf501f56b0da6f6e4945bd2882299a4612cbacb4a6e0891eb68c94bb2c0519be122ef7d48f3bd6f4aabc3ae2cc7a9574623ef59363e9117c2d99ddc
- SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDB+kn3Hnx:Eu6Jmdxd2dl+k
- TLSH T118D5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 1.2MB
- SHA256 8efc71975cb6c411ee3211a231d28096fe4094f80a34e33836d2aef6fba06208
- MD5 a429780018c98aa435e2fb47d0b12cef
- SHA1 7fe591d5daac3213d93eb2cd63ace4fa79dc6d3c
- SHA512 8011c82e03dccbb8b04a5764de38b14e8b9e9306808f4c4e147a8d3fb86c8ab098130222d07912a2875a4a189edf7bf8500450fa78fb448d83395f672211af2a
- SSDEEP 12288:AWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:A1NyBo4kx929bL3Hnx
- TLSH T15C4523125A0C227AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 1.2MB
- SHA256 e2c2fbb2d969255dc75776508c9df5dca8771df359ebb2e7d8c779f88ec63c3f
- MD5 86c66e1a5304c7a7607f871674fd7747
- SHA1 c6035901296023061d195dc746777b3173179515
- SHA512 ee5cbe45583df962e4b8a39de860e56e014359cf6a49ca07264c20a4c74399ae0b34f1e216ddf8a6a5d8c03297e6efad864ee09f4cf9d5d93ba4355095d1d8e0
- SSDEEP 12288:rCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rJNyBo4kx929bL3Hnx
- TLSH T1FB452312990C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B21147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 1.2MB
- SHA256 22b588308385c6b7196b8e76b40cc15d24527b2d037b6856e8633217a1c3253c
- MD5 a52fcc1bfef6a6689523bb2f61edcea4
- SHA1 1164fa9b36990920c8333b7fec3a0ba5d56e52b7
- SHA512 fec2376ad1c4dbeb778c2d039cc7af4cb3dbb3c56ff86be91a0c2b5aa5a644e0d840d1bc5992fb534115f163837bb83c95ac6d8335030b2c59a3812bb5076c15
- SSDEEP 12288:oCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oJNyBo4kx929bL3Hnx
- TLSH T1EB452312990C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 1.2MB
- SHA256 e8723f93cc99f564ed54ff1fb29efa596a77530fbec194f5e7c7464543d2302b
- MD5 486428190c89ea073619726d3af6bba5
- SHA1 9969373999aaa97aa9ef1a12d7b81c60e9b28998
- SHA512 8743748fa916211ce9f92acb21d161223b076ce5bf1175f29fb4619c8db2cdbcbb0f555cc0911d3cb05826ae1d16d7fe1a92922f24afde557aa817dc889a15ae
- SSDEEP 12288:wvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wUNyBo4kx929bL3Hnx
- TLSH T19D452312990C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
- Size 1.2MB
- SHA256 5953a3bf92ffe2609a57ab90449cfb769b2c41be43e9cde8bca27dbdba1bef79
- MD5 ee0cf51bcea96514e0b2778d7c9e1aa5
- SHA1 cc5b925a764483ce82090fa78f0d22d04f0ff1bb
- SHA512 858dfdfe427b02bbc54c74260b96762f30fdb44869327d8d55109e1940ccd44b57f86746999877714aff8649b5533a3ea5c1aa06420ad6eae56b80e330e219cd
- SSDEEP 12288:H9aLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:H9xNyBo4kx929bL3Hnx
- TLSH T1204523129A1C227AF76D3FB0654A8554CC34BC8F1E9693D8EF27987759FCEA34A20107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 1.2MB
- SHA256 5fd895b8f6933469c385d5f89ba764036f9fa53fddb871de19612d5ebe9d9fb3
- MD5 80eeb9e074dff6d26f1eba994570d015
- SHA1 3ea0a5249920be7bdd0fad7e34cbb6bf5cdd58cd
- SHA512 bb0319a8fc7e9116cb266eedf5897e6bcc54aee8127d429c7446c99f9c0bc276c9e6442556b30897b5611527a32d1d18d13f92651f78cb39357421a28f034924
- SSDEEP 12288:SWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:S1NyBo4kx929bL3Hnx
- TLSH T15E4523125A0C227AF76D3FB0654A8098CC34BC8F1E9593D8EF67987759FCEA25B20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 1.2MB
- SHA256 490f902ebef319d0569447c1990fbc3a443b7b6c8d024c1c6defc489cb6ea2e0
- MD5 1322c08cd6c9461bed3b5ae2c84d3d4a
- SHA1 789aeb5115a3b670fe4760005646f52d418c5e18
- SHA512 b9bb228f0fd61c1b40710d5804bc708dfd1d269db9309ac505456ee0fde87a5803c0bc67fb460d39619fcd6e6460800753ae3f77422db0399938d89aa4f62845
- SSDEEP 12288:dMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dTNyBo4kx929bL3Hnx
- TLSH T1394523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 1.2MB
- SHA256 ae4683bcaf02f1f0212aafb96e5e9d8e5d1a3f7a9bb20d494d5394524bd66e65
- MD5 29ade18858d9e11334f3161fb0ec0f75
- SHA1 0fc956160a145c6bd9cbb725b35d1acc33a3a134
- SHA512 119f9ce8a310bfd1f99e520915d10b579bbcc96f8daf4abbe9494cccf1504fb8698a39965c71daa4bc938942cd15ab29a309cc47da2015143ba7092776f3e728
- SSDEEP 12288:svLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sUNyBo4kx929bL3Hnx
- TLSH T1554523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B21147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 1.2MB
- SHA256 36366020438b813c7f0360ac1e93f875b37d8c9ae24973fe999d337fa35ca9b2
- MD5 e5c4e245cccda43e577cef687618b724
- SHA1 b2724e2df6a5608a6abb499965771f1cebe0eb19
- SHA512 bef6b748d85913c40da93a1956c4251cf016d47129b225d6af575c2cbf2f33bdb0a58dfce91535272345b56298071743f25eaa39013a630ab61b59733041579c
- SSDEEP 12288:PbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:P4NyBo4kx929bL3Hnx
- TLSH T1384523129A0C627BF76D3FB0644A8558CC34BC8F1E9593D8EF27987759FCEA24A21107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 1.2MB
- SHA256 78ac6182d31653805904bf49b108f2fe5783405209e0dcd4e917aa63fc9c0e7f
- MD5 e222cc906b1492d5bd4451e7e2be7836
- SHA1 24e022450db4ca4e73be8c1df67fd24c26c00c0a
- SHA512 df33fd75cfb1033114f44ff1367da0ae668feb8c7768665749efa0e101e1992a97f02d2091d7881f9e5bb29586f8b155dab226fdbf2ea9263089efc1c2be3129
- SSDEEP 12288:nMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nTNyBo4kx929bL3Hnx
- TLSH T1404523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA24B21107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
- Size 1.3MB
- SHA256 62c6f02e46244dbdcefedd85591403399c09ee456379abd0d1b98fdb4a7ccf5a
- MD5 2a1e13f214c6fb17c73116f24992ed8d
- SHA1 bcb176f3edea5975eb56165520eebcfd1f4e7c85
- SHA512 ff38ac8daa90a505ec2cefa4e1109e4f3a740ae4484d32b97250acbacd5dbc5e896018dedf33e05bb4dd65d450e3468bb281d62a8dc59e2a9718b736af90127f
- SSDEEP 12288:cQYfgNaOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qfYa9NyBo4kx929bL3Hnx
- TLSH T10D55020163E811A9F177AF78A9B48114CE36BC461B21EF9E8750545F0E79EE2DE34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 1.2MB
- SHA256 fd341fb0e6bb21be06ec7427cb8458c567af32324ca9ab359881b8ed6c4be7fd
- MD5 775014c112790183c5ff484b0f13dac1
- SHA1 2570163c1f69260a6b5345414e2b05f1aeb3baca
- SHA512 bf7e36a7057712ab61c71052daba95b7c62a084c88720aa1e66d9a257daf7687c86a9f30f5fd7dbe9983965517e601244b9ce71cb5ac2e9dede154008ee0c3e0
- SSDEEP 12288:vYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vHNyBo4kx929bL3Hnx
- TLSH T1604523125A0C227AF76D3FB0658A8498CC34BC8E1E9597D8EF27987759FCE935B20107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
- Size 1.4MB
- SHA256 6b57c6035a8a724e1973e0ec77afbbccad9bd151666126ae622fb2e539a05db8
- MD5 252c73e287bbf9c1b19441b1bd639d4b
- SHA1 bf09efb0233d65b3fdd3bf026f3d111f44b4abea
- SHA512 902ea1f9ebc2b393f8ed3265593e2de154cf23767d4429b28c87248068d66be7fb2e2be4573657ff574cc08b8da5732ce00b993976b198026d6fc119f2ce6b05
- SSDEEP 12288:qQ0dWC/SyCq7IwULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zjC/F7IwLNyBo4kx929bL3Hnx
- TLSH T18B65126627581272D5FB12B8D9C3C71EC6757C1A036897CB84C882772B2BAE41B743DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe
- Size 3.9MB
- SHA256 069c3baa9428762cd6b6343d56173e2451b655f30347aceb8240c44ba29b9e6c
- MD5 dd4157be97a0bb3ea3752b002ca6db33
- SHA1 9539189a28e176aa8ee2ced0d244516d258c534d
- SHA512 8acaa2fff0f38121d5be5f8729fa01c11f98fb104ad4877b163a80fba0ab8abc27843bff9171a29907185e3399aba434ff34840291f5e19bda14397bca4def94
- SSDEEP 49152:jAUF58RGQBOa74nO28wsz3iDT4JmeDNB05FQz/+TmXLhm6kVWB+kn3Hnx:jAOwBN7P2Jg9f05FysaLhm6t+k
- TLSH T1D7163942EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
- Size 1.2MB
- SHA256 b05cce8aa401cad862833467e82a9d9fda4d445c56d7deeae7069c24926ccc57
- MD5 0d82175f84c5a43d785d1b6fa0aafa7f
- SHA1 95e3a6e73643bd09e7f832599ebfebb8fb425fc6
- SHA512 b2b9901e60ec27eec35d7066436853cc5761754372a56439a2becc2150a75ceaab128b41a6a1d60314e9b751bd134c2e6aa1e6f2a21461bbb1c7a4d8ba55bce7
- SSDEEP 12288:2rLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2oNyBo4kx929bL3Hnx
- TLSH T1C14523029A4C527AFA7D3A74654A8525CC30BC8A1F66A2D7DF23587B59BCFE24F30143
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\firefox.exe
- Size 1.2MB
- SHA256 0166716aa2022194414d98170b820a591ef3b1f46bb46f5024d782e50688afe0
- MD5 4c85ef8f2b147dfb8e45f12076a4b879
- SHA1 47052388dfe0a61fc218742c961cf147a7668316
- SHA512 4b31a9fb7c6c774f3a2b0a31085f47e9b853830e3c2c236e70ed1e71f65d19f692ee93098f66e144c17dcc5d1f88791c94b15c8dad4196878a5f321b7aaa2fac
- SSDEEP 24576:jOvG1kQqoNxaqIn4SwpemIwpelzHNyBo4kx929bL3Hnx:yvG1knoNxaqIn4ZpeapelkB+kn3Hnx
- TLSH T16545D103F38512B8E48AE5B49A46D133E5723C880B51A1DB1BE93F3A3E71AD15B7871D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
- Size 1.4MB
- SHA256 8f211926edb864fe4945bbdff2fb1647ef3875cab4b6b1d0a6f3db8ed0174372
- MD5 2c855c7582f66a8252458f97a5e725b5
- SHA1 9fd1fad5ec62d0f6eb86feaeffce4ec92efd64ee
- SHA512 3774fa8ae9bcc8803f80e219a1c5a4e8e594ae1a79966d16cc2d9509e6f427918b14c86befc7218c0b9cbc13968788b24e0b826d61ee0f2816ccc26899d320e9
- SSDEEP 12288:e1XLsswWkxy2lRq2czAzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:sXYfDtczAgNyBo4kx929bL3Hnx
- TLSH T18B65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 3d04a7ce18ee7ea2d83cc2de617dc334cafbaf587bdc799d80eff750d43ae2f8
- MD5 7b10d02bd812782cbc0b79f7068c252f
- SHA1 41337a47ba14d7e5d9d50ed1dd9d4893e9cded71
- SHA512 caae2c2cf05086ebecf33770252e66aff7e8647366d350c00f73f8b371fe17d1191c8beb64ff7b07408d4d43db9acfe25e351ddfb16f3a9c9bd1eafbbfb4cae3
- SSDEEP 24576:UcP4mcvIjkGOxhKP2l71SNKbrh/8KBBNyBo4kx929bL3Hnx:vP4m4IpOO67N8KsB+kn3Hnx
- TLSH T13E65AE2DABDC0096D0BA917885658A49FAB1742E1F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\3831859B-F958-4977-CC73-A08FD4CB6827.txt
- Size 64B
- SHA256 a6485343f6bec5cf02f25f19fd41466266f2769e049bee89d778375ec032d6b9
- MD5 0b136545938fd7e46f599935bb9afc93
- SHA1 57c5048491a62c941257c860a87edd983fda1d02
- SHA512 0d341cced72cb01384d62be4b5f525e329818a312e45b731a50d2fe3018d1a2fdcbbb6930b745e74edccc6aaec403bb98cb7619972ce737e066761d3fb1e7601
- TLSH T179A00238D9D36803F456847081F75B752E65590D0B9FC100D9544CA29691E04B766798
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\m4r6z10h.exe
- Size 46KB
- SHA256 8cf4ae00be0fe987cc14ae74b0b64c188083b8bbe3b7397239cefd594492c6cd
- MD5 f052518c4d00fd810bcddf49e5850e65
- SHA1 6d45efb2c0b86041cc1381f77dd642de8f4a8d51
- SHA512 d1bd222e6bbd11408f9bae011ea1cf2c739a38049821c6852181da2c1425f737c31d53da8b89dc023a00aff1a77d9476240cc4082ea913a90b4d9495fd2733df
- SSDEEP 768:I0kayyBaYxw5vxV6tuj5QmscJ/af9i6SUSzKAFE87/ggw1HxO15aB1:I0JH+5vP6tJcJSz9DAFE6Nwn4C1
- TLSH T1E5235C0273EA10D6DC62C636D6766737E7B27442B393234F0A20D93A5F26095EFD4E92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rpic6vju.exe
- Size 350KB
- SHA256 d9947d975a4e7275d27a95b07441d96dc27dc124a8fb49ab9c04cccc1a09e708
- MD5 9500c84926ddf0899c0af7b0021f5fb2
- SHA1 823d78f7f6540923de826f21b833f27ce26bf260
- SHA512 190652f8011a28529bf07ec16868833dcd62350e2e96e4f49fb140ed98ca90c9aac51736beefd97ccd1b86cdc9a84a6eee8c359953e073cc7c67248fa1815952
- SSDEEP 6144:NCEtmp24G1eYXypIAuZOaZkGMYd7OKWjusdyHm3yJ3HGH1dQgWOOaK:NCFpFGeGAuwaZrRsjuPG3a3HGEgW1
- TLSH T12C74F19773A630F9E1B64B79C4611A84E371F8325B229FEF17A542462F232A14D39F31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\t6grbw44.exe
- Size 868KB
- SHA256 ac41ebf04242d24d7796742ac1c043ce2c5628c26f9c0d9c7d0c92486964935e
- MD5 b0326d523cc2181a6373ff00283f0c99
- SHA1 bdb4003674ec46601be09ea8c8ee0c1081ac38de
- SHA512 6691d70da25d5c6d69b1ea1ea76d4324bbee59cf646382a3009fbe93e9ee4376fbf457111963bc56102c4d2a03229131058b86a80b060d3f545d6472daa2468f
- SSDEEP 24576:Y4T3uN8p5ox+S/i/LNCjJ7AClWHFql28qH:faN8pCTi/LNCVAClO8lcH
- TLSH T1C715134732B075F8E4B38B3449A60945A772BC3647619BEF46A0471B1F3B2E24D39B72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\v4z40v7q.exe
- Size 331KB
- SHA256 78ce4e14603d7f55d7224ee81de07dfc8de099b5929cee0dccad1103c5dad56f
- MD5 5c113283ef4e3f8a52102d2b494a6ffd
- SHA1 c72fadc322406e735ef86a1ff3f88eff7a614135
- SHA512 745739d15209b79799ef188ea3262a182b6cdd243cda6cdefd6387939d52c0f09fd73fa799f14e43ba32a8c353fd39f1b4160f3d997207c40bd7d146abee2ccd
- SSDEEP 6144:DtTTELfJ7chjuzDe8JonUVdzRNFRVD+On9AkfuSj:DmEYefUVdzRLREO9Aktj
- TLSH T100746B45B6A40CFDE96B813CC9A34A06DBB2B8560770E7CF07A046965F277D09E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
- Size 40KB
- SHA256 8851510c7680bd7528f7f37a3dc3b29e9d394a71759cde521d2ccfb17329cad6
- MD5 fed29995649005793fa5bcecb7e7234b
- SHA1 bb2d3c5a5b86d4487835dd442029da6c0c0a979d
- SHA512 3ec5ecec82822fa6f28c5e9e6369d23d28b80f4379a471d1f7a89b753e39bc0b15cc53e6350a7aa98af9520cd904c5c0a2c8698c95f01baa462735bbabd2aabe
- SSDEEP 768:QBaYxw5vxV6tuj5QmscJ/af9i6SUSzKAFE87/ggw1HxO15aB1:QH+5vP6tJcJSz9DAFE6Nwn4C1
- TLSH T170034B0673DA1096DC62C636D6762733E7B2B482B393234F0B20D93A5F26059DFD8E56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 e5b0e8803f6569aa6c4c31d938b6c148205935ef88d66e141f087234b824dc13
- MD5 c2388c5361acfa3bb369f87a2bf0b6fc
- SHA1 79cc3d79746b2dd8669b22b67f8ff8f759e6d574
- SHA512 ca975f9592dfda5da6b26984a8ebe06e99bc4d278501f0e083b6778df30c1d068b16295581417df38b4b4373a7f70f182dabf03995d0c43b8298dc27bf152e04
- SSDEEP 12288:SSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:S5NyBo4kx929bL3Hnx
- TLSH T1C1452312975C623AF67D3FB0645AC028CC39BC4D0F55D6DAEE1258BA59BCDA29E30207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 4724e6dc1e4cd78b6c521c32ca161274cb5101b3c179b58919eb4859424ae071
- MD5 e87a110ec1ca2d55761e60a6af86c0f9
- SHA1 50cd0f59f835712ad787e2cffa32886540276490
- SHA512 49b37df3b1b5a13a386fd6b579259d57dac60ae802279bee4ba4217a7787acb82427694eed53342495b3914c5b96028b877feff82e766ddda528c9d015a636ac
- SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQ4B+kn3Hnx:ha0hNYG4Jw7+k
- TLSH T13585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 72441eaa9661c07d2dae318a6f84732f164c0c27822ec79e399685824a96e1d5
- MD5 1761f9c03f63a5f2b01c5888362fdf2d
- SHA1 e058908d4e1c8a94dedd2561382a07be7b44482c
- SHA512 78a34b19740eada232152e5ae52cfae240fa8e5b063f267137868876c125fbecde8610c92eed0c3cc0540806c722ed8ba97d1ca4df1eae1bb5d5331cd77f0f2a
- SSDEEP 12288:uhbHjfX9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:uhbHjPiNyBo4kx929bL3Hnx
- TLSH T13D55123E16AC21E9F275B67C9546850AC730BC1A1B2193EF6792817E0F3BEE50D35B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 ed3d537d8c92d37b16834873d5026f87d9eb3bd1355af2f93d9ad46e519a8b28
- MD5 444ff11cb69d5836eb338f458a56e582
- SHA1 3e804f39e110296dc7ced6c374fb59e0103668c1
- SHA512 4de314c58fa78a38240fe87806ab024bb26f17285a69de113e7628e1a09d01deef427353527f52d5d34d3bd1ba60b93db7af843f99b13d53fc18f1377c18aee8
- SSDEEP 24576:O3YgnJcRTk4yti+R5dpR/aNyBo4kx929bL3Hnx:OIgnaTk46ppR/JB+kn3Hnx
- TLSH T12245B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 4f5411b105866e4817a48dd6bc112668b67949911de8e8d2bda657b7d7582d49
- MD5 40bb2a2797ba0dab779e15a225a14713
- SHA1 ee5c62c31d3bcadc442278cb0fb60aa35c3c3a79
- SHA512 ff6594502d30901fd3364b97413bc6cedee28986eaee7a5cf5424cd29bcaf876f94491bad8d5524621089fb38692123029b1185afb33aead8669450da4b50501
- SSDEEP 12288:8mLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8lNyBo4kx929bL3Hnx
- TLSH T1F5452302560C627AF67D3FB0644A8558CC34BC4A1F6597DBEE6798BB59BCEE34A30103
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 97aa7718d4bb352eea5156f1a3f73767b1409fe6297fd41bc865bc6b0fe274bd
- MD5 1f3090c14b047031934f6ce4c01d3ace
- SHA1 1401a75d0a6af0538ab37c81c9152b069524cbc8
- SHA512 28a9d55686d4d04f22f89aeda96bb782bed1448eae39ad0d911d9b006b10809aada3cea8d0939011753a6526c6e756313585bfadefecf039b51b455e7812eeb2
- SSDEEP 12288:zObFA4LWOsvAYFTzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cxL3UTgNyBo4kx929bL3Hnx
- TLSH T1B4750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84E661F637E24E3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 1ecee23bee64ba8f06de75ac6738067a3afba4a00d4d2c74a5d779892f704af4
- MD5 0a9b38abf195fd890dda8c09278c3050
- SHA1 2283b76b3679ac0115e3ef1c704797ce3a17cd32
- SHA512 649655a10cecf7e474261f172ebe45898891001f5eef1b383d65eb02c7ad657aad382178064d3144e5540610dbc46aa66e7bb901efdbf1f7294fe3df8ee46f31
- SSDEEP 12288:3pFtuOnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0OcNyBo4kx929bL3Hnx
- TLSH T1BB55021A369C20F9E579767C9986820DC731BC560B2257EF46A080BE4FB7FF85C35A42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f73ff98a8d762207574cacb250039b5f47f1e99382412b09f526a31a88d42aad
- MD5 1f1ab6a50da23323fe3315bd49b9e374
- SHA1 8894ce83b8d8545ee44ebd816b4bc0d4ce553cd7
- SHA512 ed62389108c0dae6e839255c2706b972bcc51f2565b87ab407dfb8b89bd3a7760a22e24adddb9df4f188e554b0c2729f4c49a3232469a25fbb8e515529dd1f47
- SSDEEP 24576:U7NM9YmZqmWMUkPjZM48Mv6bEhsJNyBo4kx929bL3Hnx:U7cBWMpPjN8DbEhBB+kn3Hnx
- TLSH T10E65AE2E6BAC81E5D477D13DC9E28205F6B2B4611B318ACF5162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 4713f51c9ae2bb072b5351d5f2854e51478c8b0bc6b630426797db0fc33813de
- MD5 53fabb8562b0b8718fb0f9d540f14257
- SHA1 cab436abc77b90fcd471e2f5d17ffc43e7418556
- SHA512 ce5bde3622be0cdfbac14b6de774cc711bd31e252db99a6b7d6f0b53598c5cdf64af31ab0885a5e35d8630a420e25822952ba9ac455ba7ddac65ab6cbafcd682
- SSDEEP 24576:AW6BApg2YuyuNDYTabvcRvNYf8km1rNyBo4kx929bL3Hnx:AF2YuHNETovcvNYf8kmOB+kn3Hnx
- TLSH T10C858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 53e8af53309a0fd3a41ae5f3cffd2eb328983fc030e88605fd60b91c3c43ff09
- MD5 b8cc1673b05a44d290fe428c34c73ecc
- SHA1 a3f797f4bef3205183f4f0188befc7d9cdf5c879
- SHA512 5e909a00d9ec290e60199a92afcb1f443f53cce59cf0d962458c6779ff696f043cd0fafc4957a64e746571386381a02a2bd28cde6c3fe3cf9ff2bf1187da4df6
- SSDEEP 24576:gAFs06+OmlfkNXEbToINyBo4kx929bL3Hnx:1Fs060lwXuYB+kn3Hnx
- TLSH T17765BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 24e204fdc3beca04e891e3559f6258b2ce9a2cb57035727ec0e279d9758eca4f
- MD5 25ab4b1f4a892b157ebcba9e401fb677
- SHA1 731836d96dae75ea60c719b9856e67717b736ed1
- SHA512 836c286d1f5392f68308d94060f5b59e7ba20e03abcad562e83487ffeffe2c2334f71e162bade87ad0e879aa27c5b22011cf1c1c3149e3321f91af05c88370f5
- SSDEEP 12288:9CJnJ5D3VkrDzxiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UJnJ5D3WXXNyBo4kx929bL3Hnx
- TLSH T19375D02DD2A810F8E4B7D2B4815A1755FE72382D2F226AC76874D4353F22FE09A79F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 488fce2dde90c586f50b16833b2eece7af494a831c8584e6bc310244dda4feb5
- MD5 e5c7ec17908fe136da8325fdf6629af4
- SHA1 69cff0d3b8c2ba8ed08c22aa4bd6796f3ef8b70d
- SHA512 3cf36ffadd0b2f0d3bf6f88758e36ddc2d812097220071db365a69cb940252035f0a7871411496458de35b9fb084e3b6cffca8d63c1ac3f6aa6d8aef0e6b3d30
- SSDEEP 24576:/EPohm6/7IIXdwcXrif7qQncjlP65i3VuaNyBo4kx929bL3Hnx:4o06DIKdwc+eQnSt65aVqB+kn3Hnx
- TLSH T178955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 0c8fceb2d7c18ad84df15c9541772e2146f30c3251a3f2240dd37ca08c3c16b9
- MD5 550240a38f6b82b4d8dcb214f7b1eebd
- SHA1 c7e51afc0b37e93a4e65f284b0506c3da195fd9c
- SHA512 4ae4da969173574c7afcace48fb297510d5fc43dc25ef8ccda179af441aae40d391947b8d68613532410dbb8e51f2390f8100e98eef0b4c270966bb5166159b4
- SSDEEP 12288:2EP3RlMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1lTNyBo4kx929bL3Hnx
- TLSH T1DB55122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 52e0dea769571644bc4f235933996ab9a0b6eedce5ea9b0e586b4c1917bdfec3
- MD5 66ea0fb0283b38fbc01a528d77f5277d
- SHA1 c5a138f6cf3cca8632611205507ecfa87701c40a
- SHA512 06d5413ada762183e4f648f3ab0e4fdc5df89463cb88e0c6b48960dcba3edeb7c4a5c6facea4ead8c7149fcf9b3adff8653e1525738eee83506edff0c7832ca1
- SSDEEP 12288:WjkyNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WIySNyBo4kx929bL3Hnx
- TLSH T160552205638C61A9FAB92A3899678194CD34BC101F2193DFA591E93F5F7AFD15D30B03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 17370006801841f438526b6051fdf0555a3979fb36f1285112294ed510c3bd30
- MD5 bd000feaba78e5ba6895291a0c63f3e6
- SHA1 e70e0d71278f1cf0545c679888dc3155e052a67f
- SHA512 55141bb4e2e0b114739ead0e374affbc0aac3f9ccc21535530eda3c00aa93b187682f351135378bd805588410d0a6b96f76c2b26002c214b5ecd2dd076411949
- SSDEEP 12288:Ya3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xMNyBo4kx929bL3Hnx
- TLSH T1EC452319161C327AFA3D3BB0645A8554C830BC4E1F51A6FFEDA2D8778ABDED25A30503
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 9802599b1f21278864fb15079d76bd963dea19f055ff83e8313d3d9ec82f0078
- MD5 e352872106e6c1b98642cd6bfdcc0f53
- SHA1 7fe76e5d667439a524aa912038a77357490bbc77
- SHA512 c89166d2b90806689dd76d8b8207b95bfd4c6c174dbbb3b6d6208b29df250ac98fda843440334e07598003215eff2759c6ae898fa6efd483ca81495b3a3a5510
- SSDEEP 12288:5LQZb3C97GYnZMv5zBcKY97MD36LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:RQ9MxZKdcz97w3RNyBo4kx929bL3Hnx
- TLSH T169558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 7ff1b648cd839e2a9ea17c8be30df884c953277607f596b08004168edd099da4
- MD5 a065bd57e944ffe3181f131ceceee866
- SHA1 672ff13b5bc64b2712bd20f784321b3ae501849a
- SHA512 598c43bc0ccde7d1ccdcb9628050be4fef8f227251de5693dcbcfe91a760fd4a36d5965ab4e7f67c45511e912e9b37458448351d017b1afe7ef92c912dac0db0
- SSDEEP 12288:pyoKo29Rple9pBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pyocfAp+NyBo4kx929bL3Hnx
- TLSH T18E65E01FBB6D40A2E176923C89858245E773B4301B6253CB6691C73E4F77AE9BD34B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 c09f45a00dcd43ba197d1f0ef56545f3f4c8024cd03561c9027e24472cb48352
- MD5 03db9b1d1bf1b104b9a343fd51387581
- SHA1 582cd1c5ab39de7d3dbb65e0cf13df14b283ac51
- SHA512 a77dfc03af5ceadc55799fc95e55d351b7eab8051cbe88b7b1c4ddba8c7b424283b2573a5f1c607485ac41728b4db610858fc18829433907f9cfcc64f70ee02d
- SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK1B+kn3Hnx:70zuNIP+k
- TLSH T1B9A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 f7da7cf990fa7d58424804bbab3dd26af66d40eb1c03ae0b0f05850ecc97feff
- MD5 14398f21037fd49ea10c9dd2144b2843
- SHA1 f78f883b2f41219843859c57f66f8010c38356a4
- SHA512 99717689e648ecce87f2050a42f155df4348e366b47051ca71ef8a1c873c6de947d47307fa3677f249c26185ebab0169a38ad37dbc56f4ef436f86c8fc44b876
- SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYujMqbTNyBo4kx929bL3Hnx:1TDxR+N5YzT4jMnB+kn3Hnx
- TLSH T12255B02EA7FC15E9D1BE85789A23C512FA727811033193CB42A0C17E1E7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 899474d422c3a7b1cbbd06ba3b1bd845767c9823dc2ac8592ef6d7b8c9a1e9dc
- MD5 f3e96e9eef8f755cc526968bbb980587
- SHA1 6c1e4c8626e2315531cef3c0706e687f82c75de8
- SHA512 ba857a523e181d0dd9635eadd7d67a2c457f87abf95ef5fa0e6949f61800e26b7854c96b58cf28214eb61e112cb464d6cb3ca01149768aeff06534edcc7c30a8
- SSDEEP 24576:yTMdOz0FFS+tmSL/NyBo4kx929bL3Hnx:e0K+tmSLQB+kn3Hnx
- TLSH T1D965F13E636D14F5F57FD27C96438906E97278660321A6DB0690C07A2F6BFE43A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 e382211eeafddd033d3807522beb1c248332352fae5aa6ffac61c9169193ede2
- MD5 6d0b05074cf27439b6f72775e80f53cc
- SHA1 702039a2b741071dcec4b40070119a82b43c90a4
- SHA512 a19c5e12f9e9678be7f7119201a74e8a446a5f788ebb0d39971ce55fe43b227c25f09acb168897579a780384b93de462e25cc2ff9a407fb8cd87fd846cb15afc
- SSDEEP 12288:T49zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ggNyBo4kx929bL3Hnx
- TLSH T12C55120913DC30A9F57A76749A2A4154C930BC6A1B2167FF79E1C87F4F7AAD18A34B03
- MD5 SHA1 SHA512 SSDEEP TLSH