Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
- Size 4.3MB
- Sample260529-hd63esev7t
- SHA256 65b38f0bcc1d6c0a0f1ab081f63b118cbf195b01cd12fa0005bbb848999abb2f
- MD5 f3e82a589db18a514bbfd7115e7ec9ad
- SHA1 facece8df1fa004a419fa4f77e0d16c97f81b5b5
- SHA512 acb0ed0d6ab89b813665e941558b3eb76366b823aa88262b4fbbdaba04b757e44ee0a3064644068dbcae7504cc9779129d3ab67e35727e426c384378ea420c3a
- SSDEEP 49152:+PYcsZagdb2zsqYaHkZFEXTnNi5pVW768Xozsr8zlLwJIh:raY8jNi5pcnwFRKIh
- TLSH T1AD264A0662E80198E0FAD2789E56C833E6727C45473196EF12C1BD673F76BE09E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4164 alg.exe 1892 DiagnosticsHub.StandardCollector.Service.exe 688 fxssvc.exe 2156 elevation_service.exe 1932 elevation_service.exe 1228 maintenanceservice.exe 1116 msdtc.exe 5104 OSE.EXE 1532 PerceptionSimulationService.exe 1168 perfhost.exe 2820 locator.exe 704 SensorDataService.exe 5368 snmptrap.exe 5360 spectrum.exe 5592 ssh-agent.exe 5572 TieringEngineService.exe 900 AgentService.exe 2568 vds.exe 244 vssvc.exe 1764 wbengine.exe 2800 WmiApSrv.exe 5696 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b83eb7ca1c6cb3b6.bin alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaw.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e187eecd35efdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a159bcd35efdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001a852ce35efdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeAuditPrivilege 688 fxssvc.exe Token: SeRestorePrivilege 5572 TieringEngineService.exe Token: SeManageVolumePrivilege 5572 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 900 AgentService.exe Token: SeBackupPrivilege 244 vssvc.exe Token: SeRestorePrivilege 244 vssvc.exe Token: SeAuditPrivilege 244 vssvc.exe Token: SeBackupPrivilege 1764 wbengine.exe Token: SeRestorePrivilege 1764 wbengine.exe Token: SeSecurityPrivilege 1764 wbengine.exe Token: 33 5696 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5696 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5696 SearchIndexer.exe Token: SeDebugPrivilege 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 2036 2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 4164 alg.exe Token: SeDebugPrivilege 4164 alg.exe Token: SeDebugPrivilege 4164 alg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5696 wrote to memory of 3112 5696 SearchIndexer.exe 106 PID 5696 wrote to memory of 4332 5696 SearchIndexer.exe 107 PID 5696 wrote to memory of 2972 5696 SearchIndexer.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_f3e82a589db18a514bbfd7115e7ec9ad_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:1892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4188
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:688
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2156
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1932
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1228
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1116
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5104
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1532
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2820
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:704
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5368
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5360
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5592
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5600
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5572
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2568
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2800
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3112
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2852 2840 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:4332
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2880 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:2972
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d8c858e2fb5ba3557f0cea9a4375f55f951692334b2133dffe8b197b77633921
- MD5 d1c13190cd5e42ac280e6914e7130584
- SHA1 330f45a55caff1853b5f928db0d7cc10838b7122
- SHA512 0aea23b3dc7cd3b49d0282fcaf8dc95dd208c3777c958db70c9f9f7ec7d79e21ecd15223a44eb89a6261e2f2d856887badc4cacf37d5f571fe59ca295e03b5bb
- SSDEEP 49152:Zb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnaXozsr8zlLwJIh:v3q60jBvwFRKIh
- TLSH T1E3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 73e29ab98cd8620c3fd0efcd1bf03c8d04cc165ad69502e5fc9cf6a872c36140
- MD5 62d5100e4966fe981232363abc0f68b7
- SHA1 16bda76602944b56b22bc2f47c0ff954a85af2c7
- SHA512 be9ba88a171e845872fcf5d61a18afbc12dc5d635206b95a3f3fe9d0e5687dda45b22b767dd92a7638320179c82c34f7d2015eb9e5f969ff68c8ea8beb111260
- SSDEEP 12288:21XLsswWkxy2lRq2czAbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0XYfDtczAp9Xozsr8zbhN6GwXOGIh4
- TLSH T1DB850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 2302761fda7d8172fcf803e7e9562c04633e953c0abb43c792b4171f00e729ce
- MD5 c834217bab8dc146846d855246e79f97
- SHA1 102da5985a80d0b0a453b74bfea0fa4191fffdb5
- SHA512 ea6c299fcba50ec0be08c8b66795157437b1f97ad2b4ca338c71b3b9c712ebab002d96819d2f62a7a4e61a41645e977cc3ed62cc43e5a56dabce80f1a3584ad8
- SSDEEP 24576:50Le5ji0hmx3rM49Xozsr8zbhN6GwXOGIh4:5Pji0AhRXozsr8zlLwJIh
- TLSH T138A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1c6344bb149a918d5bb22e96eff52d7b935a265189b099e405f8ee026583be0e
- MD5 18ca3ebfeea062c436959c4f7e2bb25b
- SHA1 364d3730d89d3dbdb8ddcb376ae130f35a0f6386
- SHA512 d34e675ba43b632821b1cb65e83b39c7523276d3073d6a30c6c9cda99808748fec6df57746c509261ea45bfb4b49e7c8a054d52d54439bcd642fda9ae5a42a2c
- SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWr6q8wyuG9Xozsr8zbhN6GwXOGIh4:y/ezSC6vUzPviHjytXozsr8zlLwJIh
- TLSH T1F8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 8114bba31320339c925f52bffd0cba54b0c16cdd17d2052861f8e76e512bed30
- MD5 1df1b1f2b66bbdcbd61afe9b17adc2d4
- SHA1 6246c66a702210e64f961f9ab4bd37c2fecdc701
- SHA512 6db70e8a3df6d25fc9c42f9095db324117355cd5439b12a566b60eb4fe9725d17279ba0984898044f3c4e0f06b542c9ccb16b36d82c96a73301a25ba20078121
- SSDEEP 24576:OVbqPb88hv/l+b99Xozsr8zbhN6GwXOGIh4:OVO88hXl+jXozsr8zlLwJIh
- TLSH T17E55AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 9ed38c0725020c7f726eb60dc0843579e8049b5df9e20e1309a58e02c971533c
- MD5 73765efef429022662e5b6f55f24cc01
- SHA1 cedd20ac45e08f2dd2f7e0eef0635b6633639664
- SHA512 85317cad8f413ff2e579883862049fae6b1d846072a9c901f1abebd7d1c218f59597aa71156cd1ac1bc1e10df51a6db41e791dcd954e51f12e7186ac77a446cc
- SSDEEP 12288:7RQksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7R89Xozsr8zbhN6GwXOGIh4
- TLSH T1546523B7E691A442EF671F3139916AC4DEA7FD9E49811B4112382186CC7E47AFE31332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 c65d24caf040c7b6d0e609b817a98887ae444a38bf9b140fdd9ee817f10d44e9
- MD5 f9c76faa350a43a0e5e0583c8eb37429
- SHA1 15d2a8d2712e005f71725e188aaea979c1cd3e23
- SHA512 a5b5c2ced8b44870f6c457ddd667cd85ae8d807be3bba3b6017ba411acfe054c00f8f4377f6aa1ac93453b9cdae40923f5b5f9880c21a0354eebffb6bc00594e
- SSDEEP 12288:6eBNUbTVO86U3ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6JIUV9Xozsr8zbhN6GwXOGIh4
- TLSH T1BD85DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f2726381d368e91e7388df7e8d1848e7b5ed09e6b61e9d1e540ecd95f2fcf376
- MD5 48275a4f811dc7cf7b81bdc3f9a7a179
- SHA1 a24eebd983323c6a6be74b515df847a2ba61be23
- SHA512 3999e7b3921d33510ddb526167dc54a8810e8c415ef7c820b0fd7bcb0d060a3eadef4f8ff305bd61c1cf6440f393d21e072ae1cc06ef8605adb3b991a14453b5
- SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH:xQvGAdlCEL8c/RRNw5CUwFRKIh
- TLSH T19A267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 f4cf57d68e08d96d2efa582e84d2f57a87f9383467f41c673ce90d5712a4c8cf
- MD5 cfe7fa07448d70cbcecddf6b56c0295a
- SHA1 5d5acd4cc031af4cb814cfce54a37614e758f90f
- SHA512 fbc08c4cf767a646a2fae89d99dcd7f52022a68bfd4a00765168fe4984aa9445b606c03c92c1717fd32b2e280f4ef5eca3c500c60449af7930bda64351d64484
- SSDEEP 12288:3AwSfxL/2Dc3VDLLmt0LDQewsAjdksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:Q4ewsAjL9Xozsr8zbhN6GwXOGIh4
- TLSH T13885E031FE74E032C7BB0DB21B26C716587DB9604B911AC3E3B8498E99741D22776B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 778c378ad2671c235d528a5e5abe4583e6196dd5c9cb7cc7454c07c38f97832d
- MD5 287b43e4745669a4afb3aa6751702629
- SHA1 3f851296b99c6e795ddd96414e13d58ce321a13e
- SHA512 5a2759924c2876c0efa61ae1092df106e5687e26911929c105673cbeec0d70c438b99e4c92c23a5f7229e9ae001645743d698e8e86d8f76b4ea9da971d82c7c7
- SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH2DKI:tUEtQevvqc2W1cpV2RI322D
- TLSH T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a534d64881364237ef55059fc83237a1c99286f67d3ed542c3cf84b6498555a2
- MD5 15d98ed15e3766b9d08b438f6bddea5e
- SHA1 23ea86c78e90fe44ed3fe5940ed009a061f0e34c
- SHA512 c69a117901616834dc61c7f8b2621750ba428356a13b8f88ac44758cb1953a8300b71ce70e15175ca76b90ad8b01b5da33ae8d6947f561971295ba25404746f8
- SSDEEP 49152:YCbRquA/m2yL5zifFiV+XenmE3/zhXozsr8zlLwJIh:RoqHVjnmQwFRKIh
- TLSH T151D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 394ab2a31e4909ca08d0e6e866119a1ab1b716ad7e6553da64461adc9cfa50af
- MD5 16516f2bfda00fc5e82d2678738ab62b
- SHA1 2f335fff5caff13e9b1582c752d04f0304a61b07
- SHA512 aa7ab691e71b8426a0aabb41adead756608af2d92ac4f375bd0ccffeffa5729a00c409691ca94b4e92ee84db5b6d7a1beda4a705c797a83f7ba64a04d166077a
- SSDEEP 24576:bAhGL2IFoiwtA5l7S53C9Xozsr8zbhN6GwXOGIh4:bAM1Foiq5gXozsr8zlLwJIh
- TLSH T1A8359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2160C10F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 7f46b87900bdac1e4f73a7efa224d8b50b1db24487a4f6ea917d37069e19470f
- MD5 2a5e2b6c6549d0aeab06bddfd58fb3e0
- SHA1 c49bcbc7b44f35d71a5b075561460eee45901d69
- SHA512 8f648f055e81b74c688f08b2e1435f01da637c7932da1e281dd3f6d8457009ced630337c689a76d8407a4165a7e3355a3a4d9fa383f7ee924e5f39ba0d2e182b
- SSDEEP 12288:Smw5HEjsChNkBFgl0WDm+CCksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:LwuVOW39Xozsr8zbhN6GwXOGIh4
- TLSH T1D985F14676A41CF9EAA786398587C535E7F3BC062A21CB1F1370C65B9F37221BD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 61a874a42d1f027421441863bf4c53249c98b4288b83fde3aaa12f5d689dc71a
- MD5 ab32d8af81219b41a85a7790e5f8466b
- SHA1 58c764a26d3c8d4c3b1efe27e26183be1c51f265
- SHA512 b6e14ddd9f1ec1d67604ddc1ff464ad55aceb623d91e1aa35060ae59c714dfb11fce7a5fd45f847920ebd11dd9add3c5e283d3a08cb8162647c0737bf1b030c0
- SSDEEP 12288:BZZ1IyNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/Zuw9Xozsr8zbhN6GwXOGIh4
- TLSH T19F7512AB73E030F6E6A3473998E15A44D7B3B856577203CF1238025A5E37AD66E35332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 c417ada8e4d94800511a7ddc5a9b0bbaa675df552b33979be19ffa9f48fe87d9
- MD5 321a452bdc42d6a11688800e86c0c4cc
- SHA1 813360324df389ae3820d51d265fb549384a8590
- SHA512 0f4345f18c347618d650943b3afe90c63f5844e869741f085ec2bfcd96a335ee55e9c6fdaabe437f07cd6e26d6d1f9e3b1b2cf37663b92eb93d0b2c9dae5e740
- SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uk:SQRQyi36YOcPhLvw2gAf+PN3zwFRKIh
- TLSH T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e2f9ca4e1cb6aacfc84a4366cbe296280351aa2e0411e3525dcff379ff903ba5
- MD5 bf0ccfafd4fa818bb882862db2e08e1f
- SHA1 6508174949e654552ba00088eddb6736da078800
- SHA512 d9555ee8185d6ca79d1d962cebadce7fad0a001c4ef4f70389d02f24e9b5597bed811aa4581641e446abec64847c1feb69206d4b0e5859a077d858054bba59cb
- SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uk:AQRQyi36YOcPhLvw2gAf+PN3zwFRKIh
- TLSH T1DB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 9b1a038c20c7411ee91e1974a226d6ed759769c7511f3a5f51f34fd123604713
- MD5 9723e8ef781583210e782f65be05066a
- SHA1 43a88c0091245d776dde0b4c13b9489fa14c8aee
- SHA512 d8f2a91131f639b5f92e7ce7d1d8d4cb052e964bf5abb7cc1546e144da55417adf13e4ed825a309ec02540db63dc4bc18d58354cc78035ea13e45ca354bf2259
- SSDEEP 49152:568Qg55nhceWu7PNU3/RXozsr8zlLwJIh:HthLRc/1wFRKIh
- TLSH T121B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 928690ed31e7613c50c23a0ad399632db7d2ddf331e7506587825ab13dd00741
- MD5 faaecef6ac513b904959e282b7b92f49
- SHA1 dd007ded33963d213495ebca2e41a7c6e8b97d6c
- SHA512 09bc96c056ffbd51fa12956cb0377e8094ef4da1b9c8ddcb52322f0e7ca5a5d888c33d85b4679da37ac7d73d7ebdfd2bb2e8a68a49549c2eb3365d51f2756ede
- SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99G:xy5112gYy5azzVva69nLKnhZywFRKIh
- TLSH T1A7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ab0f853a40daa52212823a67a2e398e1698d848578ac0926e327df595627f450
- MD5 6f6bee999e586997a570bca8118f9a1f
- SHA1 d495ffe09dfb600724a53fbdee188fe7ed654a23
- SHA512 229c87ad4870607c7ecb91065980951f8627a189664f22b21e0fe11f0667c9c3e410a799bda49ed5535e7204210a0adc20ad42ae1b73b35017dae34c9e35c3a6
- SSDEEP 49152:uB+taZ3usBWOBr4tEG20bqx0z+n217aau1glbXozsr8zlLwJIh:8u6JmUxd2drwFRKIh
- TLSH T1B0D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 1d00a4201395c8329b3cda501231aeaf687c2e51995d060ab9f4d474d901dd6f
- MD5 eeb2f364baeea86b3d60d287df3492dd
- SHA1 15c17727f57af53533c291c280640be99b092f11
- SHA512 e6a5f903ade3d8e41c0280837612d5a9a179020f465a7f6fbb67df2a445c1a5d79a2bceaa6cd5081dfb2a35f8e2a09ef26ab5f3471c70ae82d5d3f632cd9d405
- SSDEEP 49152:k1hpsNoJpF1A6BU44CwH7R4xHXozsr8zlLwJIh:kmifPkRQwFRKIh
- TLSH T1D9B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 35b735db58e0522fd2e000323ee70f364081bafb1615efd2ed45ff216321c29d
- MD5 695a9c2885198f4c8101560f3de5f68b
- SHA1 4f165f4d88d4bb0fe03fba53e3fcc326868fead9
- SHA512 c1429b1951e52ecfcc7381e3ced87e1fd7fca59edbc1d268c7049a390f2edf25cf850d62e9a56ec5ded6e9d86a32ab070bc4e7979f0a76b8670ac08290257474
- SSDEEP 49152:7SuZQIY0Be2KNRVtOnks6NMHqKXozsr8zlLwJIh:p5dKvi61mwFRKIh
- TLSH T121C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 20a781b05425043a397ab8159dbc82d7f2bd30c280f422d135b4618c95df6324
- MD5 781b2593e7fddf5f87104eced205a9b3
- SHA1 5ff449f11926aa66acf8a65dbaee8adf6ba4684f
- SHA512 9ee7cc9c7e0e03bad475281125c0cedf38ed2ccdbbeaaa24b08b1d116e241fb23815acfbf0fb066e7ae696ae856cf2506c2e83b88cee5d72d5fbe71aeae9eae2
- SSDEEP 49152:PhtSn8EApI0figXgiDn0AP5wLXozsr8zlLwJIh:eX2iyph8wFRKIh
- TLSH T16795BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 564e969ce25dac509fd45d5dd8c1f5eaf75fa0511d34b52febf2b5805d5dbc36
- MD5 8060c9a68ce43c41fecf9a4aa05e001c
- SHA1 f5bbd9981edcca95307dae72e0f64f15d898a002
- SHA512 566c091e1c3fd31c1609f0756522d4443a7f1e5ec03fd950dba499dcbc5fc6aa7295d942472ede2550cf16153af20d457b8bdcb8965a4d9f2f62a6e77074878a
- SSDEEP 12288:3YksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:309Xozsr8zbhN6GwXOGIh4
- TLSH T10C6523B7F992A442FB575B3129811AC4CEA7BD9FA9820791333D1042DD7A87A7E30335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 1b660b99885617ba166fbad95256479ccdb47a526f9e6402b18373fc8330e154
- MD5 55c74ff97da9c94b1b1eda3a19e49713
- SHA1 fcb3948b6551fe98a89c4d723a4068153b43b36d
- SHA512 8e5e477445a888bd2e3e32afeb9ffa55359397f2e82d7e42710ef380ebf875c6d9bd5acf24c77e342dd4f7109c1ee8a8871ed58f6190d09e51abd749f43d2e01
- SSDEEP 12288:yhksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:y/9Xozsr8zbhN6GwXOGIh4
- TLSH T1556523B7F992A442EB575B3129811AC4CEA7FD9FA9820791333D1042DD7A87A7E30335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 8fa07f75a6237dc70e6ddd6deaa5397747c81e8b6b455d934ca4a9fd8eac279f
- MD5 c275a1901be121b2c3bdecf336111021
- SHA1 952d28d0f03b011efd67e82628e9d12cedc79b83
- SHA512 7607ac27b830aeb31f60d38ce2ee42433f8da0263df59b8418d06f985813de357859a86f65e081e1365f255d60cd1b9c76e0aaece6c9af584a91a3b79699dd81
- SSDEEP 12288:x/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xN9Xozsr8zbhN6GwXOGIh4
- TLSH T1736523B7F9A2A442EB575F32298116C4CDA7BD9FA9820791333D1042DD7A87A7E30335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 e4ba3d27e70c3b5f0d5cd3f56052617fd0484171fb3590e6cb838925c0b8f50c
- MD5 838256f75f801f30157ff8d817eff64d
- SHA1 89b5556e81248a1bfe7ca5b4fa7c6d0ba93d7ff1
- SHA512 93ec680f7833d2c311514bc00d764b0382c71ec891c8fb6533077ac651004d16908e5573b1ab114c114442b349fa07993701634eded71931f871f772dcf28fda
- SSDEEP 12288:uVuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:L9Xozsr8zbhN6GwXOGIh4
- TLSH T1C16523A7F7A550C2EE679B3198915684DAF3FC9E9B5207CB233800468D76679BE30331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 186f9b6aa5ce8678ac93938b6be043a09b55256f13ae69613ca856c824225f90
- MD5 e942a29fd37bd1e6eedee2e68597a7f7
- SHA1 a69066a167eadb5905a64754217ab81e33ad06bb
- SHA512 ec4181cdc684049f90737a0e42e3ea5649741f498069c9334188c5c6c465f374e08968f3c300e63d6ef1ab5fc521818144198a766a62b8da889684957b7e5e9f
- SSDEEP 12288:dmksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:dK9Xozsr8zbhN6GwXOGIh4
- TLSH T12B6523B7F9A2A442EB575B31298116C4CDA7BD9FA9C20791333D1042DC7A93A7E34335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 99909bf7657c4564645e88c9862c58f6806099f90bafa1cee4db5ecbf526a86b
- MD5 77daa818ad768374d9158daaa13402ad
- SHA1 58e302dc5ddaeab1917ca0fe5b63d45a678fb050
- SHA512 0014076278441b6206c21fa8da12dbcaf7532a0514f1bdea2c37968d161e1f19f22d4e064928aaa9802bd65eecc957fc83dcc05e0dd60caf8304a892ae4052a8
- SSDEEP 12288:FFksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Fj9Xozsr8zbhN6GwXOGIh4
- TLSH T1616523B7F9A1A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DD7A83A7E24335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 9a2d3ef19b25ca9fc056def0b6c6b95f94f60ff4f4236bd78411cd69c9915e12
- MD5 aa581eb7333aa9f481074f46fbfdb356
- SHA1 8926e566cf8841cbc9c3c19fc7c55e1133fc3cbd
- SHA512 71f84b1e1c26aa847bd6d5deeecaaa4ea4075870d5f771c9a0ba1e5ed3363bd16ba989542e7568036ad93d3f3f2cf0a8a3503e065f29739cc426615b27c96f0e
- SSDEEP 12288:/5ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/H9Xozsr8zbhN6GwXOGIh4
- TLSH T1C66523B7F992A442EB575B3129815AC4CEA7BD9FA9C20791333D1042DD7E83A7E20335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 ca59e8daece74a573f259119b9fb4abcbab7613234fbae2e28db186031f15e71
- MD5 12f121f3c338e94ee7bdcc481ce88b62
- SHA1 17f2f08fb377ca1566df5c5fa4a66f5cbb918eb0
- SHA512 f495b71858ac931e2c89144407fa595f4ac5860ca4261ad01529ac93c08ba5e6c73391b74230533386a42b237e67641a01e2b4704d0ed6bcbff1eeccd4502ffd
- SSDEEP 12288:WiZwbWzzFEoS2cPvyBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ZZMWzFVSOf9Xozsr8zbhN6GwXOGIh4
- TLSH T1608501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 560838752f64d350edcd3aef44e27072c07443d86927e08a917d15182d8b6f99
- MD5 9eac5f95611ccb5e9a5baf854dc0a92d
- SHA1 ab5e36f4111a8ef1c57e52012824067351a2f728
- SHA512 f15f37d26b4d6a00eb7d0895b5e2963d98a69e3dd8d63390e92320499d4e58893acc2739a4a478ea8fc3052917bc7ec3961db1fa067291db27e2ed7527dce426
- SSDEEP 12288:z0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:zg9Xozsr8zbhN6GwXOGIh4
- TLSH T1926523F7F9A2A442EB571B3129811AC4CDA7BD9FA9C21791333D1046DC7A83A7E24335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 44a96c8680da5ea71038dddb71de54b3e3b18995bb2383b3cadb1b3c5b94aa4a
- MD5 01be6d3a270597b77b2174a3bf2e0b4e
- SHA1 26d9361c6c6ff0b3b542d1b7f428caa5d198012a
- SHA512 60b9904c5d39017def129b851c86c7783fb7f48d67ee28c07dcb4306efda485aba1b0f8bf0ae45dceaf3a2879093a06c733526bdf956d2120333c2d0211043ff
- SSDEEP 12288:/AksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/s9Xozsr8zbhN6GwXOGIh4
- TLSH T1E16523B7F992A442EF571B3129811AC4CEA7FD9FA9821791333D1042DD7A83A7E24335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 689159be19b65d4c15c22e6d82143ea2db5d7e8bc1f5b774a79c042439ae0bd3
- MD5 e0a49b5796d4506dcba5fc7860846f4c
- SHA1 9219f06a7bb779bb7671182e38afcb6c8fdce8c4
- SHA512 55c72146238e2b47cdd9e3c1c0615e9063d2deb34d66804276dc562f36010a59c7854c9e24fab8e73fa0afc9bf48efba670a01a7d079154cb54cd3f5bb713070
- SSDEEP 12288:SyPz5L8NksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Pzy79Xozsr8zbhN6GwXOGIh4
- TLSH T100751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 14ab7b7666f3991f18457f8d5e21d117fc2b1a3488c1e144328ee68f9dd52289
- MD5 2e16c5cc46786c1571cdbeb809b38723
- SHA1 219f355a4d5dc4db9c8317371a5d1d126ee1b04a
- SHA512 b7c3ffa82c4853617054f621bb25585710585775ba9d341102aa2af135713bc5c99048109106f8f97d33140be9123075f4720f69d916b5aed1defb9de852a219
- SSDEEP 12288:X0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Xg9Xozsr8zbhN6GwXOGIh4
- TLSH T1B96523B7F9A2A442EB571B3129811AC4CDA7FD9FA9C21781333D1046DD7A83A7E24335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 8352b5babe63d467b46455e0349f9f4b446c65b09b36c8f436d9fc1f13b2b35e
- MD5 82e7884b3e3b614d3eb634c670d54f73
- SHA1 48613fa594eb9ac241914ebac90916bfaf058c53
- SHA512 678229dd90013001a5aa64222ed846a199864eaf2511e8367f8c979f701928691176014e670263ef2f723acdd42993478df3c76108c4fee6dc0218ae2ea0a46d
- SSDEEP 12288:m0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:mg9Xozsr8zbhN6GwXOGIh4
- TLSH T1826523B7F9A2A442EB571B3129811AC4CDA7BD9FA9C21781333D1046DC7A83A7E24335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 217b0791ba5497cdf33277cda9476e5b496d931fc5a5de508f83bc4edbd7780f
- MD5 8eb2348bf87114f791e8626643935a64
- SHA1 cb90335882764e9eb6f812e167e5c5c6421f5b57
- SHA512 9564a349004d00f006c656b482646c2a85fc26ed031d624712fe16c1dcea00183c6b421e776be0d464cd1ef7ea8465daf0ad50dd9f5d1cd3afc87d6e3bef46e0
- SSDEEP 24576:ICUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAx9Xozsr8zbhN6GwXOGIh4:ICUEPTY+8Wg2lIL8lrIUJLWwIXozsr8V
- TLSH T17565BF1EA3DC0896D4BB813589518A06EB727C2E1B2296CF2170C37D6F27EE55E35F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 aa5a125a095099ba3b517e5c7c0065a497a55ff3e6385b4b1f22b0353acd357c
- MD5 dca6928a2d71e0dafc44644e7fd1f9d8
- SHA1 d401ab8079b6d1d2153f9f2aadb3290ca00ea321
- SHA512 044a61e69c28093cd156d9b3d57adcbbd26fb4a5b55b4b82324e57925adf347eddb51dd37340a1d48812035c901206a8c9bb0aa000fc8f0055700b04239200f8
- SSDEEP 12288:3QsfEksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Hw9Xozsr8zbhN6GwXOGIh4
- TLSH T17875F15AE29411D4D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A0AEE9713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 203b09755e2b2afe5fc24cbf39d8a7f87813f0291b1b9e48db9ce2ca04eb0206
- MD5 8b272fa2e724461f640d5030dbe53947
- SHA1 58c654fbb27571657f1e6c7801d13fc959eb97d5
- SHA512 c01293e997dcefa31534987fb2664c666559ad1faf9940641cd820f46f3c4a194afc5b8616a306e489cc1c1e370f2a904aece89beaff6dc8d2d06978d6b27dd0
- SSDEEP 12288:LfksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Lt9Xozsr8zbhN6GwXOGIh4
- TLSH T10B6523B7F795A402FB7B5B30189156549A5BFD9E8F8107C332281185DC7A8E6BE30336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 8062bd015ff3cd900ef8e978a5de1b56feb38a1a46d8e5c19ab83c0d9d1bab32
- MD5 66b6f04157de4c2073af9b12a76dfc67
- SHA1 ffa3c213dff44da1dc5a8365f0fd038293d532fc
- SHA512 b061406eadd425693240f8a0cc833103a191dc2892611c2d51a604ab73ac8834afb30d9d1dd192533d73a8d4a07e5febfd577713abf2309f99e62b1e76a534a8
- SSDEEP 24576:n8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCr9Xozsr8zbhN6GwXOGIh4:8RZwQCyiHiQEaiPnMCXozsr8zlLwJIh
- TLSH T14C85BF1E62DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 4a9b548885ae7c4d4467e3b9682f0c49fc5bd820998b405fe84e6fbc086792dd
- MD5 17953e7ae429fc6f537f54f4903b0fe1
- SHA1 6f3976b98400886b2d9171147f7f8e8d9691de03
- SHA512 1b67cdbc0f0bc9fb547850a4fcf845f1af1f26bd1b86738e2e0232c20dbb0a4e310ba702d598d15ee0639d5c2d6012b5bc8db98d860b004f0b809e8924fc41f9
- SSDEEP 12288:jbxA1U7KPksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:jbxA1UGd9Xozsr8zbhN6GwXOGIh4
- TLSH T1F975127FA6AC24E1F677A63948C18204C732BC1A171153DF21A4827A4F3BEF96D35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 6aa1e85faef003520f8fc43c503618033d8fa44d65468868ff189c987484b05a
- MD5 0878b2bbac3eef2ea5ddc1d2025bffd0
- SHA1 a18b8270fb8732f36ccbfea4e699e92e5adb779c
- SHA512 e7b1ab3e52bb4acf258eb74d757d3d201fc674a6b4ff8394e0a73e1df159fc647b398bf5b11d698517d9ce531f0114aebc69dcd442066f9f8c1944963ccb8a6f
- SSDEEP 24576:MjsmP0yHaqrVqHra44KDzMsrnS9Xozsr8zbhN6GwXOGIh4:MjRP0yHfVqzlAsrngXozsr8zlLwJIh
- TLSH T15E45AF2EF2B910B9D4AAD236454107B5EB71B42D1F219BC70170C235AF0AEE89F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.5MB
- SHA256 87d3d10e7f31561ae39bc7915a70f7f014ec0a660b518e19a0b25266dfb09308
- MD5 410e2d618be795c3b670799146babc41
- SHA1 d5aaa09d21b935d49e11d91c0785de2a70525620
- SHA512 4ab8007216b1388ca55e6c7cf69df13df2fe3c7707dbffc01473f962b3feec898032c981c4ea793af928d064cc8d2af90949f9a911dced15a6d78836d264a276
- SSDEEP 12288:2lksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:2D9Xozsr8zbhN6GwXOGIh4
- TLSH T1476523B7F691A442EB575F3129815A84DA97BD9E5B8207D3213C1042CD7E8BBBE31331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 9b680885380a022a3f4edf80db210eb830bb1cd3717c1c3fb7d9560ab460f37a
- MD5 f4cd83340ebe7ee96ca54f5ed359147c
- SHA1 934581391613d13a808856926b4cd6e7aca1788d
- SHA512 2fab1db34c68ba71a344c43e35cce1558ceb9aadcdc2bdd9b495cfb6b52e17fe6ddd23b42e2f5aac004a30b761edb1dd70056799d5ee740c3c2cd44629a32def
- SSDEEP 12288:KOb9A4LWO+vAYFTbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7pLBUTp9Xozsr8zbhN6GwXOGIh4
- TLSH T1E6950156F7A400F5ED67823CC9A28A16D6B2B85D0760E7DF03684A551F237F25E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 1c42646eae1c0954c2761cf63662362c09eb0ba5ff70bb9f4938353c479ea75a
- MD5 219301904f6a2f01450bc5eb2f5ac474
- SHA1 cbc40b667b9a8c225a335f32b9882a72eb68d269
- SHA512 495f0c5f572e66bb79f58e55439f7caffe7ba2cb7a371554bbc5bdd96d05e9cfafd2de2d217a0a279c744dc60e5cda55256d5796ecf8c1f10d4aad58716c77ae
- SSDEEP 12288:U70Vm4IYNvUyBpoksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:h0YNHu9Xozsr8zbhN6GwXOGIh4
- TLSH T10985F22FA2AD1CE5E57B91398AC28209F273B867175153CF01B0827A0E17EF9BD39751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ba4aca5f5abe88fc885ed30f6a356ef53e5bbe7b4511fe15de7079c1b62c9bca
- MD5 72fc39280fd9a50939c1ec815f788157
- SHA1 d9283cf0fb7fc077757a2d2b19c854fd7dd6ef53
- SHA512 8fe6c77792f38b4036bca25586816f534db575f654df067ea8ba3bcd1890693408ee5ec50d560649bcdf91408d1505eabfba875e34f5358de4887be776386767
- SSDEEP 24576:4nXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKN:4nXoJJYH84VVS6AmERJas+cHBjSSKHPC
- TLSH T16965BFAEA2BC04D8D5BBD17DC5C24506F5B278661331C6CF022182BA7F27AF56E35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 190a7eeee76852f392c383ec89df496a64268174e1ed6a2399d4b046be711d91
- MD5 5fb4fcd16b6c029176320c69c7596c1a
- SHA1 2ade07a52d8b5b480711031dd2e860230c54e076
- SHA512 3788332a8480ac385c8c12d7bf0f3559bf7c459510f365dc7461b5e42863549d465160999c5fdbb8c074ce411116782e328943e822c72ff8916ea542c78604ec
- SSDEEP 24576:kv7Xbxd9Tuycf8M/TYlSuxrr2PCc9Xozsr8zbhN6GwXOGIh4:kDLL9TuJ0M/TYj2PJXozsr8zlLwJIh
- TLSH T16C858D5EA3EC42D4E4BBDABD85A79146FAB2B855173081CF0250856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 059dced236580d23d3bda49d5029ee6b2a3312d063c609a02c55336fc2da78d2
- MD5 3ea177ee8b25e5763cbe46845837e124
- SHA1 28278c22bacfcaf06f0057c0e382c086ff6b3972
- SHA512 065648b75e63bef607fda4e1e77bf36f025021bf0219c9e3fe538415511067dc817edbb105ec1edd1b3b6c6d7d83f05c94e1c634bf76f4d8fe278eac6190fcf2
- SSDEEP 24576:0egJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10wp9Xozsr8zbhN6GwXOGIh4:0ngOJOmPOHcLXozsr8zlLwJIh
- TLSH T14E55BF3FB7BC15D5E03FC17D8A928916F6B1782603255ACB0160827E5F2BEE46E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.8MB
- SHA256 0f594f88fad89d1864083881ca5b814f3d0ce4e52bc92872023b08bd8b795a43
- MD5 0b2cad434ad3334cf8bd6af52e78d979
- SHA1 9c3dfb353ea97a78bc8930e5661ed01efff716f2
- SHA512 7679bf1e979a49227821c2065962b8912351d718c101baa8af9cf5961074a5fe390513dc0c87faf1b684be6e7b14dbf21004575d1a28244b87c13b30c866e6a2
- SSDEEP 24576:ALJnJiTk3R3waE4JrOj9Xozsr8zbhN6GwXOGIh4:ALJnJK8R304lwXozsr8zlLwJIh
- TLSH T1F985D07DD2A810E8D4B7C2B481561796FF72346D2B216ACB19B4D4313F12FE0AA79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 995e0593027a997164556e1807ef8843de62e74a8cc61a184aa6cb5f4abb86fb
- MD5 f883b36f3548c2ff262df14fa09c577d
- SHA1 7f9fc4b6ddfbd7264ef9223d8ddb0461c2599c67
- SHA512 19dc25facad226d3dba9b7d9dec3756347773baab4d8b75f2a3669d6b7fc1f5ff5b97e9c64a0fe9d8c7047f07c93878f36ba934b8b820d63746ef252ac728943
- SSDEEP 49152:a9mqCzDScAZmlvTcFg8Ph6dXozsr8zlLwJIh:sMwFRKIh
- TLSH T15B955C15F7EB5298E8B3CAF1C96294159B337C509B34B7EF0A80C96A1E32BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 295ce9ce617953a7e7522fbb9e1f6a9c0904febd6415bfb69a6f634dd5a30bf6
- MD5 31dbd1ad7fdc977ccb04a0e0f2c0c373
- SHA1 eb9eeda2fca2490389b0bf7b5abaf7a3ca80d890
- SHA512 de61abeeb0df97df83b9663bd9d54ec9f61245fe6eefa018b3e9199fb78a684d2dae030a49391c3fd5565ac1c1c436e96077af1f15f82fa3629b54e6e54eda6b
- SSDEEP 24576:qlYJeXm5jUuEZ9Xozsr8zbhN6GwXOGIh4:qlYJeXmRUuE7Xozsr8zlLwJIh
- TLSH T1A97512AFB69C30D1E22B963958914A44D3B2F4B6134217EF11B4C17ACE679F63E38B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 35bdc353ede3041dba457f28874eb7587bd0578c23b76859aeac0b2204c6ae2e
- MD5 50b4ea9812a2c4dd0fb4da2e25cba2b3
- SHA1 81579998613ecbcedd86c8c734505bba4a8533c1
- SHA512 047a90be19fcdca16ea7bcc62f72bf15009f612b81741bc18cf0c4a8609915c011f2aca7ff28bb3c7806e5e4b4ecbb03498c3d64caaefb38b38822126ec68133
- SSDEEP 12288:7ku6ky+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:75tyy9Xozsr8zbhN6GwXOGIh4
- TLSH T14F751256B3D06095EBB70B3499A24290DF76BC255F1107DF21A0E22F9E36BE5BD30722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.5MB
- SHA256 fbf64ed24f72cc9dc0fd14869dbbf136441fcafd28d69558ed7a9bb01f9581b6
- MD5 8526a6477c5033eecb45e7cefb6d8f2f
- SHA1 8b171534206490f5c785266359b25bbc192411e8
- SHA512 5871c79ca81e67122b18d63ac96eb945e2128ff4d9fc51c882191d3cd43b2c5519169e236c89fc7f986718b058149d25ae1cb6db30bddc5be384adb8d39b0ef8
- SSDEEP 12288:7PbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:jp9Xozsr8zbhN6GwXOGIh4
- TLSH T1086523BFF6A17442EF171B3114511A80CAA7BDBE5B8217E721785061CD7E8B6BE30721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 0168c90bb8ae8bd3775e5e1cc1e6a70069ce5a672e58e603627e64837742d928
- MD5 ac2952858d043040dd793269a7aa3d5a
- SHA1 3af86dbe8504f71d505ba6616e17f91e1e9d8481
- SHA512 6d8d4eb55548931cab32659ae950609bd119ef15c50dc4defa40ace9ad5042180d982ae1f775f94b654558076b57ac43d948d8b46904c29d7412e0d62e91ee61
- SSDEEP 24576:HC+TyQIu93VAumZr7jmQ9Xozsr8zbhN6GwXOGIh4:H/TfIq+YqXozsr8zlLwJIh
- TLSH T16E558D1DA7E91DCAE277C675C8A34493E633B872136186CF2044C07D499EEE9AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 157212dbb403cde245bdc2b8aba5a9702a5805e7bb545ed901360a0843307ef4
- MD5 ba3a96cadc0d24a3f973a14d75a5afa2
- SHA1 995a4eda47043f778a55bd61235018c31e134fbf
- SHA512 ee3295ba3adfb3224e788e2e60801b18cf773796da5f38bc3612068c0411197f8863cbbf32095dda09d3c8e55ae93815ae3d328a5b9c82d7f92653d46b0eeb42
- SSDEEP 12288:kcyrWOstaa3kcsHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xLQikZl9Xozsr8zbhN6GwXOGIh4
- TLSH T10785F11FB3AA1095E5A7C23C88814241FAB3B475571227DF02A0C7794FAB5FABD38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 b3e7a30c921c12e32b3f9f17a2e7c7d2053bd36da8a4d5246d5e2a7a7f289fc0
- MD5 ddabb2b9e64ed40df53d81a6c0c0fc13
- SHA1 e713a0b178f6c5b261ed5a89287c1bec56e5ba21
- SHA512 628a31a66efb9cae36dd01d7e70187cf13c09a1b228680dd78e37989306b86b6158d0d16e67072651bb8fa3e04a55897d41265a06cc1e5fefb0407a37d548e79
- SSDEEP 49152:NpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPAXozsr8zlP:OpC7b4+80GTkJwFRKIh
- TLSH T18BA57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 1ba888798948a6371771764b260f15c0c9ab6396ccfc7e8073576df821945809
- MD5 17800a5684e61561fa43a95cea7d32b6
- SHA1 bfbfc0b8cecdc6482d650e8e71245813c823d279
- SHA512 26962acddfe0997b6d83ec384ed08db4b38eeba9d851578dd5fb6fcbdc952e764fcbeaf4183818fd906c0b6870a81b6cc6b547760d4a4f9656d023f53e17cd06
- SSDEEP 24576:sSAwJPE1IDAo+4Kt+l4413AUQq9Xozsr8zbhN6GwXOGIh4:sqPCIo4Kol4KQoXozsr8zlLwJIh
- TLSH T17D55BF2AA7F956E5E17ACB749663C601FB737823133163CF5290813E0E169E89E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.8MB
- SHA256 2dc2c53e8a9a01a9557314d66bc94c086172e259b3bc9ec0d2282534c28ac725
- MD5 cb5a24ed90ce43efcf9c1af090bd6e14
- SHA1 aa5f91d55f99a44e7daddf00da1b607b2ab7a95d
- SHA512 1ff447c9bb989a9dc22d9ec0cb5609d0f3e27b85d0263de824b9746896e8d36dabfea7ef552d252c900fc022d86e5e0bb9d8292731d3d2f500bdf453adcf405b
- SSDEEP 24576:oyLXPLcP94ta9Xozsr8zbhN6GwXOGIh4:oy7PoOtYXozsr8zlLwJIh
- TLSH T1D095E13EE76C04E5E57AC23CD6A38906F6723CAD033166CB15A490791F6BEF46939B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.6MB
- SHA256 e40d3ce27a1885e509ecbf4981c0f32b51dd1268fc2c16fc4020449647517401
- MD5 51aeef5279b053b7162705699d86e496
- SHA1 aa5aba40e7ff69385caa6ec7bdf0f3885200c81d
- SHA512 41d6e83fb013c424090b82cdc960ee48204c9694c10decbf402ec6cea961badc406560b5fa69f97e9ac7a954f67d60923c9b6cd099702d00df1c1f82d5e0237b
- SSDEEP 12288:T9lyvj3IkxjbBzXksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:TWv8qjp19Xozsr8zbhN6GwXOGIh4
- TLSH T12775126FA6E02484F53B4730A5624254C1B2BC7B17551BEF31E8907B8F36AD1E93AF21
- MD5 SHA1 SHA512 SSDEEP TLSH