Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
- Size 6.0MB
- Sample260707-rtkc2ags2n
- SHA256 7ac90e868e8bce25b7a9463c07d2a48c07ca5106eac5fabeced183f1187fcf1c
- MD5 30577ddac137036ed14729ab0b0a0db7
- SHA1 4cc8ea05e262bb6e7716db5122039b71dc0dd2df
- SHA512 9d4036b92f32c29910be99a6c022feafb2b9578acb4990ffabd34734699b7384cfedecc65bf86e829132c2c020a670b374e1dc62e6ad3211cefd914b278866b9
- SSDEEP 98304:UENX/kO9FYXRMF8UEt3KVEx83W4It859FWarWsHQQbtSR:UE5IXNn6Vk83IWbHbq
- TLSH T171567C13F29641E8D05DC1798B5A9232FAB2BC990F31B6DF065077252E76EE06B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1496 alg.exe 560 DiagnosticsHub.StandardCollector.Service.exe 1048 fxssvc.exe 1520 elevation_service.exe 3408 elevation_service.exe 4904 maintenanceservice.exe 5388 msdtc.exe 3900 OSE.EXE 4952 PerceptionSimulationService.exe 1036 perfhost.exe 5104 locator.exe 5932 SensorDataService.exe 4908 snmptrap.exe 5140 spectrum.exe 540 ssh-agent.exe 5300 TieringEngineService.exe 1144 AgentService.exe 3924 vds.exe 5320 vssvc.exe 5872 wbengine.exe 5396 WmiApSrv.exe 4672 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2f72a80a5a3b5d25.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fe577041d0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c26795031d0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8b946031d0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008df88a041d0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb8ada031d0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083c132041d0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009531a5041d0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f1103041d0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036d626041d0edd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 560 DiagnosticsHub.StandardCollector.Service.exe 560 DiagnosticsHub.StandardCollector.Service.exe 560 DiagnosticsHub.StandardCollector.Service.exe 560 DiagnosticsHub.StandardCollector.Service.exe 560 DiagnosticsHub.StandardCollector.Service.exe 560 DiagnosticsHub.StandardCollector.Service.exe 560 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1276 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeAuditPrivilege 1048 fxssvc.exe Token: SeRestorePrivilege 5300 TieringEngineService.exe Token: SeManageVolumePrivilege 5300 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1144 AgentService.exe Token: SeBackupPrivilege 5320 vssvc.exe Token: SeRestorePrivilege 5320 vssvc.exe Token: SeAuditPrivilege 5320 vssvc.exe Token: SeBackupPrivilege 5872 wbengine.exe Token: SeRestorePrivilege 5872 wbengine.exe Token: SeSecurityPrivilege 5872 wbengine.exe Token: 33 4672 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeDebugPrivilege 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4604 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 560 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1276 wrote to memory of 4604 1276 2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 84 PID 4672 wrote to memory of 5348 4672 SearchIndexer.exe 112 PID 4672 wrote to memory of 4588 4672 SearchIndexer.exe 113 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-07-07_30577ddac137036ed14729ab0b0a0db7_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.41 --initial-client-data=0x2c4,0x2cc,0x2d0,0x2b8,0x2d4,0x14053f054,0x14053f060,0x14053f0702⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:1496
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2344
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1520
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3408
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4904
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5388
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3900
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4952
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:5104
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5932
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5140
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3528
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3924
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5320
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5872
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5396
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5348
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4588
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4be3934aa5a799858fa52d8c6e09cb7f12f75ed931cb56f835c571244cf09d8f
- MD5 7a1be6859906564ab93fc0991463270b
- SHA1 48d9d2a84cc8df1f1a532e5542a5ec9ffb229fe4
- SHA512 5448102f9428915332090983985b180780bf96488422d490d1725da024cfda964084a27ee7ead46a998a3267b55aa862acd79f549459ade3ce074d5590a2bf8d
- SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZuxyHQQNhjrGWSR:v3q6HjB1sHQQbtSR
- TLSH T1EED58D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 3e0fcf7964d2251a89c15d4beb399e1b8398aa02a1e990e180bbab8749a3349e
- MD5 ef4c523bfb543973c436beed3763444f
- SHA1 a375862e2ffb04083110f46e1b27bfe275de052d
- SHA512 0678d9f0b13e5cd0a9872f0fa9bfd80a6a6fbe2c27ea6de1911db8974d7bfa4addd4af7b2ce9e2ec4d3f72544e6b976f58873f13f58132cfafef33bc4f8cad17
- SSDEEP 24576:QXYfDtczAO/uTVy26yOJ2bQcshjGAdGWSeqiCC:ntcnuxyHQQNhjrGWSR
- TLSH T16505012867E109F9EDA78178CCA2C502E6727C554760E7CB03E496265F337C86E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 4f378e0955aea3a5e7f8f2666f82c1396f20cdd6d51794905bf835a35531cf2a
- MD5 ea1e10ecbec52d8f99f1253a8c78f407
- SHA1 a88547b51dc1bda59930c4c74f8a42cf2e64b1ea
- SHA512 310fb9fe4d3a522efbcb6d1ef7882041b862d47bd70e50f74de481da111cbf16d1cd6d8f4f5b85c77a1f82791227ef3131f096ef116f3c92f896685d94872e6b
- SSDEEP 24576:p0Le5ji0hmxirMp/uTVy26yOJ2bQcshjGAdGWSeqiCC:pPji0AcouxyHQQNhjrGWSR
- TLSH T17235AE56F6748331D073C0B9C5D2A68AE97130865B308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 f8b86f611554e6192cb1e72b7e1680661568e4f15036040fa3d2b6e8d047228d
- MD5 34f6a1d7b3c49f721e1e8bff41d205d3
- SHA1 333aa11a8a3d06e761dc1d65c70efe261a7fbb00
- SHA512 dae4a5c70760b512343ca842f84b4f8c1a8d7118129c6615c3b36c446eb4e119eae60d4eb7921ea193278ec5e8752feb0dff160d747afb0f858da9714393dcd7
- SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuv/uTVy26yOJ2bQcshjGAdGWSeqiCC:P/ezSC6vUzPvxHjy0uxyHQQNhjrGWSR
- TLSH T12C755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 99cbf3513948eda16b9646a6abecc785807c9434c9be43a0b96d311280252780
- MD5 8ef83cc63d42da73bb82985949f331a7
- SHA1 ee50c211ef2d4aeb613871bfbd2ed368c532c9fd
- SHA512 f4cfda1967746ae076cf598c15a9fb4187b8332eae172bcf4424696e370cc634617cd7b90b74b8531f60beb80e5d2879ee48dab659830f22d61b97c61f3b9291
- SSDEEP 24576:UVbqPb88hv/l+6a/uTVy26yOJ2bQcshjGAdGWSeqiCC:UVO88hXl+duxyHQQNhjrGWSR
- TLSH T15C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 bac22e37d672f5173901cb682e596bcee790831f9339cda4fc6588d7006c6a93
- MD5 ecb5d13beea90f531538a5a4aa797b30
- SHA1 e0e357ab49b051aaa5730e1e8aa7f19de80efbf2
- SHA512 b94c58773d239a0328d57b6bded510b4127a418bd4f1e5e74cbb0d82ba45cda30c8bce057b2075e3537687c145a41b808ecd8b22e7c9c2eba167e386b3065c68
- SSDEEP 12288:yRSI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:yR1/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T105C423E60BE252B6F3F409708D57EC92D1E83C589C44E9C261C6B356A97AD49F0CFA43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 0858ce264c525d0b5a246290390d2e6eb2d69fd19e07be4c761c5f5ef780c5ab
- MD5 41d4e10794cfa54816d996b6964e125d
- SHA1 f930fa15acc2c1556eb7549ffba0655fee2ff088
- SHA512 245fcca9c9dbc49d2bccffaef4e5f9b93a6be7cc5bc09f35a9a3a492905e70331b20ad3e321c7a6d6836e6d4aa39a52230d0e9d3307a274a2993b88fbbef5757
- SSDEEP 24576:BJIUi/uTVy26yOJ2bQcshjGAdGWSeqiCC:BJIUiuxyHQQNhjrGWSR
- TLSH T14005CF7BAE28FCE2C27A4DB85A91C640D7B278304F51A3CBE165830EDE235D15D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 b7b800b15feb47fcdb228b5feae61232572e516dcaaaa3099f311fd85c58fb0f
- MD5 6e7fe6b00f9f8759d9ab50f7f005c00c
- SHA1 04ff87a243c8fd4dca607a875506ccbfedb1f0d8
- SHA512 446891ee47bee441974ac7d915c5e85e3135f07918868095f6cb95cea176a42e873d8c54c75218950a0455dd497babe3c819f76e110bee0a0f33fb92066029ae
- SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:iQvGAdlCEL8c/yRNw5COsHQQbtSR
- TLSH T180266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 73ad02909cc73749f65957696f040c3d8bebf83c4b647847ca82986fbd8cfed6
- MD5 b6e615dcc37684b6f87411803cf83d7f
- SHA1 b4def6952dfdfc8d0d8814b62be7d73dff09bbb7
- SHA512 d79d1dc77327bfd62d76e74c937a2fe36750bafc7d93d9fbca875c83a8953b95b9c4c56734eaec6045ec525541fb07c784aa00ba5c0a9a0750ac4ae40f99a28b
- SSDEEP 24576:xdewsAjw/uTVy26yOJ2bQcshjGAdGWSeqiCC:Plj4uxyHQQNhjrGWSR
- TLSH T1C315E031FE75E036C3BB0DB21B26D716546C7D204F511AC3E3E89A9E99346C2237AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 ab4a7cfea5e1e381ba22cbbd6a0be80eafcd307dd0bd2bb818c21c23f52c6f8b
- MD5 0161f93b79053f285fdfa7303d2230ab
- SHA1 69e0963e67f521bab4530aaab21691f0a4ed20ed
- SHA512 c6ca1093159e365c026c39971c6e7bd490192504f074bf7a20f9b3d04de9ffe9d20f6c0bf110b9587720135ce0c460576cac1635858957cf5ce0d1df0fc8dedf
- SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoHbq:DUEtQevvqc2W1cpV2EI32om
- TLSH T1E0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a509d4841ded0353a489827ff5202620ef677878956445014f6db3285320bf2b
- MD5 874ab552b9e216d9f0a038efa88ed074
- SHA1 ded25634326f3518c06e848f1490e0606b9b6a54
- SHA512 bd52f9f0a8d53be22c731b75b7ca3407fa4f47519b0b2b5714d7dc29814c213e498bf154253ce8b13489b9250b6dc27b48c0acb11b093afd36bd0b07b57a858b
- SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zYuxyHQQNhjrGWSR:VoqtVjnmqsHQQbtSR
- TLSH T15ED58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 79298197a389c6f67f24602142a6f5f9cc191f047c34963c44b2bb696df1d876
- MD5 c7dbbd02941ec1a439f751bf26156bba
- SHA1 dfc2a51be33ed65652b787c56bf983c857e5671f
- SHA512 870406d8c68e0ea54abad8e59d4cbd7355da82ab1bf9f71a494a3e65c50212ec530ad268b211831da7f088818f24e8ee247deb518fa38732a7f2f8a4208a54e0
- SSDEEP 24576:XAhGLJIFoiwtA5l7S53j/uTVy26yOJ2bQcshjGAdGWSeqiCC:XAMyFoiq5DuxyHQQNhjrGWSR
- TLSH T1CA359D81E7F955D4F5B3AAB899B69171EAB6BCA95E30C20F2150D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 4f67a7140fd70d7b05698253e661f69cffacd0d3e8912e42c3772bbcd56355d5
- MD5 f7c0cd8c8d772109953fcb2255681b32
- SHA1 67e6dbafc310fa5828b06bf986999c8f1e106132
- SHA512 6be8cf3afbe226b2a052ed7b83c557ba216e622651913c709b18aa7e631f6fb221c6a68735e8cad10df515bbe0ec437dfb3f9a04cef75d2c19851c1a680476a7
- SSDEEP 24576:ZwuoOWU/uTVy26yOJ2bQcshjGAdGWSeqiCC:ZwDOvuxyHQQNhjrGWSR
- TLSH T19405F08A37E50CF9E5A641388957D532E7F2BC012A21DB1F13A0C65B6F37611BD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 33a18a3d28d137b3be274204f2dea4c1b53e28d5a39d339419e1429df7c7d2a8
- MD5 d22242e1d82f1973b9c086d35165c338
- SHA1 922344b9b254804ee882d1ff9b6d94066908f42e
- SHA512 4d17d14f5d96870c8011c2b1383881185ce2464ed62146c2e9d34447590d00f03e5384e9e543a9f63379169442abb43ad8e9d4415c23f4353d259dfde7c0983d
- SSDEEP 12288:hBZ1IyPI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:PZuR/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T15FE4129A27E021F5E2E20178CDE29942D3B13C566B3183CF229553666F37EC56D3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 56b0009c3e36f9cca6d4aef11e24f415429abe11f1074da282b67031acc0beb4
- MD5 611b3bd3e1166b0d27564c1a54a52c00
- SHA1 ffd4cd8a706cf6e204f850bf243ee45bda1278d3
- SHA512 4650ae9376868de2cf5079a77d5a4eeb85622b1e00ed6a1235a0a4092322376e9a5e3ae2511202a2831e98655ef44cdb410819e9dac06b896bfb89017980a597
- SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3psHQQbtSR:5QyiKayX+PNOHbq
- TLSH T12A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 90cfacfa70a59866359f3a924f01e1ab7cd0c5b1ca6f282fae74dfe7725a9181
- MD5 90dce0aede6dfd6ab25b422f125569a6
- SHA1 0085ed045d9a109603473aaf18bd0b5cde18e172
- SHA512 48e66c85b056ca7ea188d3fa2a8614ef9fd218c1e34c955ce08737b0cd96a5485aec08a752c25d67c973a9fe5293b8b33f1c398b5a2716cc8951b909eb205c36
- SSDEEP 98304:3QRQyi36YOcPQLvw2gAf+PN3psHQQbtSR:mQyiKayX+PNOHbq
- TLSH T1B0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 c4b0f33f2cdebcc4e744046abfe58719cd998d3263a1521bf129d4f32384a62e
- MD5 3ed574299f11078818e14b652d2b7822
- SHA1 25ea14bd6bf7391c50bcefeca91e9e013d55e4b6
- SHA512 1d1fefabd3f4c83586370447cad6724d4557086d370b3410f22c11e6cfd8a3ca2c2a905e556a83b85eb5c813ae0103760b438c19ba5d9f3d8050dad66ec7e573
- SSDEEP 49152:k68Qg55nhheWu7PNU3/ouxyHQQNhjrGWSR:OthWRc/LsHQQbtSR
- TLSH T179B55933B2F200A9C44DE1769F4A972196D27C758FE0E3DB815572061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 0f6f80ce5942df4ea341ed56523a5beb8f48c45701c277969c0c3bfc09c1b6fb
- MD5 46551c7530f927ba85b297ec1b1d58f4
- SHA1 099648bc30d9e7dbf4d37e3ec2e6a4ad85331f5d
- SHA512 532f6724728485408d0d316e0aa721abe22eedcf7c994ab5edec6a242b7c6815419fc75253b743c8ef23bc2504437183231e1e71f3373dc2eb628a55bc2eedb6
- SSDEEP 98304:Cy5112gYy5azzVvL69nLKnhZ8sHQQbtSR:LLIHmWh7Hbq
- TLSH T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 bb1402e377965980b8243476609af5e64aab9f35bc914c6c49fb1192c09215d4
- MD5 6982af1079af512ae3702d1aade5cea8
- SHA1 c9796437b1ceec689b9d5acfff721e555a547ee1
- SHA512 03ad26aa8512100b65a7a133855830eabd6041b6ea4ddde28279dfd2524db286f655bc74c88ccf83558ecf1e1fbd8915bed7a6733dddbe523ce4f8d38e058983
- SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2uxyHQQNhjrGWSR:+u6JmVxd2dhsHQQbtSR
- TLSH T100D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 5e638a6242829dd45e84ee72dd59cd73f9e003ec4c3d790e247697f7671b2aad
- MD5 606b73cf0f112dfec23c1ff138ba121e
- SHA1 18a8b666dbb5325012289ae8c86695c019b771fe
- SHA512 9ef307a27051d606a0ae8c5dc2e42667e738f1968c60c39ec8522f1018410a0b8af64dc0bb1a3a41f2524c0b8455abb2aefa424e586a969225a71219a9fe75e2
- SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xCuxyHQQNhjrGWSR:xmifPbRqsHQQbtSR
- TLSH T168B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 af7f3afb9cfaeb9ee0639bfd9375cf58e4f83606c2de731bafccd0eafc74fca3
- MD5 5c30ed4c3147d7a33b40b78503ed2d45
- SHA1 4e73e74526580c53db2b36084b7c473dcc0df919
- SHA512 a8176338f6696edf900675aa5079a1a2de8e0d6527b33f42b27103634a52129c75bdbfa66628d7e16f65dff279e69b2ad82f7a8b8a05bc0a91fc6589b60bed5e
- SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqpuxyHQQNhjrGWSR:S5dKTi61wsHQQbtSR
- TLSH T11BC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 213d7441b2ac5dad7d6fb085ca94f6345fce6d112e5192a2e48a7a25c3315e34
- MD5 08ba179f52217a8492ed341102236cb3
- SHA1 d45653e2316a76d7ac409b593911363c58b13898
- SHA512 9b9ccb1e0a4473d1872cfc1b16519105cdbf597dfd1dff0c336af652fcdc2a2b13de4e77b2bad5333ff96c53376aa8145f770e8b171eaf16050fa2bb95516544
- SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wGuxyHQQNhjrGWSR:PX2iyphWsHQQbtSR
- TLSH T1C795BE13F2D901E8D06ED174C7468632EA62BC150B34AADF0A90B7561F7BBE46B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 d4e7ac15abd2e08e6b3986a9c4729562a976dcf8ba106cc85d9350e6be38ba53
- MD5 7d0238a4de441e54ade6f469d8ab6487
- SHA1 5cb8983a47a395965e311fb91070be2b1a80dc6f
- SHA512 3f520625fd56a86288e19cbbaa0e40e7164df33b719fa19ef99c9141d43d9e74c00ce1642476e064b19ddeb5853d706558beab67d2c084e4453aa87fecf42527
- SSDEEP 12288:5KI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:59/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1E6C423E61AE353F6F2F405B08D57A9D2D1D83C9DAD40A5C372CA7311AABAD4930CF942
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 d058f0ec272ce799736afdc7df80bf38d24178e1c428a5a0e276e61330fdc3cf
- MD5 e638aba371ca8286604a4fa32af9c674
- SHA1 83e2c0e4399badc5b106d26814cb09ccfed1c5e9
- SHA512 67ec58a49576430c8e78e3f98e7aaa70101cb96e855909c143939726771b0d35de7d1c7d55fa75744029790c0196c52557e4f69ab87c5f7e3466dbe43c405d41
- SSDEEP 12288:M7I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Ms/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1DDC423E61AE342F6F2F405B08D57E8D2D1D83C5EAD40A5C372CA7211EABAD4970CF952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 fe9e07d1300619a1ec522318008930b0e8d763689cc8c62c650f165914f8b743
- MD5 f20756612180ea361e8461319e4447d3
- SHA1 a99b246eab5a538052634e7663a3e84f49ffe8df
- SHA512 901495fbd943ef55ea892058f524a1621250ffc3bf07e2c4fabf46b12bd097f77ec1a143ca14bbef9356413cab7de9c710d1dd8df86e968119633e8bcc5adda5
- SSDEEP 12288:UVI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Uq/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T11CC423E61AE342F6F2F405B08D57E9D2D1E83C5DAD40A5C372CA7211EA7AD4930CF992
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 3a7e224ec94966964a920e176ac03dde1ff6221224b3b3e466e283e7c7b342d0
- MD5 15d51ebc9b1d13093e563289da0150b9
- SHA1 f30c73d927835c083fc713cc6e7e0217c305eb6a
- SHA512 7ae01845d4c64127a49672a4e2cea132692ef629f44f75266e768d30dd851308c009b4e8d4eefa11fd1fbaed4ca7af15168f982cb963fd45cabe06e08b0a7e23
- SSDEEP 12288:lVsI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCCF:j/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1A4D423961BE202F6F1F445B0CD53E892E2F43C99EE10A6CB728522065E76F84749FF52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 65367e359e53754be5335fdce59cdd05be7747252f3c7ea1aa3358bd0861c9b4
- MD5 b4104af338dc3decdaddb9c42dc9e2d6
- SHA1 be42e82ef833a17e8a70339a018e479ded604431
- SHA512 eb4ad2f29bb24ee2ab13aacca0ad29fefae0a65dd923327baf719404e7be5fbcc157cfacfe9620e17e4ae2466692d979c4d439da5491fc871c9a9bf0c17cf8cb
- SSDEEP 12288:C0I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:C7/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T12EC423E61AE342B6F2F405B08D57A9D2D1D83C5EAD40A5C372CE7311EA7AD4930CF992
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 67c238daaa0a01bde85b0190b8b23157599240b92bf748fecba9f2cb9a9046e4
- MD5 8a0ce7cb8fa7374475faa15e53377051
- SHA1 fa660714559b3f89b91b66c6f9c0bb652c737e5c
- SHA512 9fac299d9924a8a7c9952b35493c897f27f8250ebcf70f751af09a4ffdcf5d0310ac8238b95f40dfa035f8d0ca128063427d6e32a419fdb3b7266eaf99e921ef
- SSDEEP 12288:Z3I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:ZY/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T163C423E61AE342B6F2F405B08D57E8D2D1D83C5EAD40A5C372CA7311EABAD4970CF952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 c3a215b178d6daa424feb00d9bb71d33d5a60f5d936f90621c2941256b3e5c69
- MD5 d1f97e700d0cef0074029d80c83a091f
- SHA1 aa6822498c7f613289b49776ab2a7a48622684d3
- SHA512 bec5dc853eaa836c0797654e9419332e8e86186f5e7969c655597c1fd73e51abadd686ce469814b919d1cc136f699993e512aebe6ca5923ac3e8719f25f6e0f0
- SSDEEP 12288:7DI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:7k/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T119C423E61AE342B6F2F405B08D57E8D2D1D83C5DAD44A5C372CAB211AABAD4930CF952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 b76cea4672ffc89dce761983bc704e1406f330dc1bcfed090ec7c29596657d1d
- MD5 608d0e592d063f12bb9fd6fd956b9854
- SHA1 1966ba5f6fb9f0aef673595f5328ae096ad01a19
- SHA512 bebe206622f6fc2ae452c270bb9eb15228da234bb44c04a70fff832d60412204ab28a5c3e487861693592685bef56051abe0fcd0fb7fb649ec0b1d4195ea2fba
- SSDEEP 24576:+ZMSzFVSOM/uTVy26yOJ2bQcshjGAdGWSeqiCC:+ZMSzfguxyHQQNhjrGWSR
- TLSH T12A0501A573A018F8ECA7413ACD569902D2F27C5A4B60C64F13E832675F737912C2EF96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 e87a30b06a89b2d5e6022d75d6eef9fe10d464505aadc417e157411ac22bd16a
- MD5 c418227a454025a1b3db101cd832bbb6
- SHA1 a3a979f5efbaf334423e03d0f001048c722adcec
- SHA512 371402a3ce3169d048c53f405a644bce7752a5e45622d3695f178dabb40326ae2f112b135165c51c306b9d1d96879fc2b1ef9b6ae0b152e057e92cdaf7233f2e
- SSDEEP 12288:kOI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:kB/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T182C423E61AE342B6F2F405B08D57E9D2D1D83C9DAD40A5C372CE7311AA7AD4930CF952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 9c959fc6eb022d3a8cccfd1b682c71b7555757f774926e193b6a22fb7d7a0175
- MD5 6ad0f7eaebd6ee6b8dd5fee347a64fc5
- SHA1 5a4b13bf28b7b16720e6e094c3c16e12539a260a
- SHA512 412323ec9b75f3303d5fb01d763dc4c136452b600aa7b9e2e3dae015858b3e43f303d6f65df8ecf15c05c254c2dd123563ad51fc6ade158b396452e31236cc2d
- SSDEEP 12288:yCI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:yl/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1FFC423E61AE342B6F2F405B08D57E8D2D1E83D5EAD40A1C372CE7311AA7AD4930CF952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 7c37a2f20e88efb36a465f7072ca523ead42255553ff83ddbabdd00feb5e6e93
- MD5 21048924544bf1038e2ca9b2b0fc1913
- SHA1 754d9f4153466f053f8a7db290aa83c5f9d231b5
- SHA512 b47c034b138ffbd1043c686cee716c4640e66a9ed4b8555181d4a8b9fb01e768f63e7a7c9d9483a05d92c2a2c4720734f5ae533d31c27a072e4632a532ce3969
- SSDEEP 12288:syPz5L8PI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:1zyg/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1E9F4025727A221F9E1B64234CC625942F3B57C364B209ADF239413762F37A806D7FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 5f435af1d466bcdede3a77ec353d3da72b61ba2e8ba144ed7a8f8029d899dd1c
- MD5 f0e76978ed00d321898c0fe202db51b7
- SHA1 9ea4065671a8b1552f8d4a3f75ba3e634f699347
- SHA512 cab719d3a8da5741e12fbc40d7dbbd858e8e2b5685e9403fc1ce9cfdc10b4c2d5936e867890d0019674a0e84e7652897b235b526341f4dff34abf241c19c863e
- SSDEEP 12288:YOI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:YB/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T148C423E61AE342B6F2F404B08D57A9D2D5D83C5EAD40A5C372CE7311EA7AD4930CF952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 31ebf59aa9cc9dd25107f04ef281a3b6cf33d8a1a8409b10b6eda5cb12212a9a
- MD5 848b79c1e96c960e7f322d98f6b2ce3f
- SHA1 910daa989f02f8c500895bb73162ecb40e102bf5
- SHA512 14ffd91b5a167fa8339f189df859325ac28e5e7fa69e87b5261ce9d6133e555d248f42bf3bc3007bfdb6d722b5f7548bab60a5884a9fac691f107f910bef8a56
- SSDEEP 24576:JcP4mcvIjkGOxhKP2l71nNKbrh/8KB5/uTVy26yOJ2bQcshjGAdGWSeqiCC:+P4m4IpOO67W8KHuxyHQQNhjrGWSR
- TLSH T1A565BE2DABDC0096D0BA917485658A4AFAB1742E2F3286CB1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 6218bae8d8ca96744a2627ee7fe764881ba12b566d8b1ada00878beb9b147b64
- MD5 c4a8828355a9bc97aeb778ee5698d288
- SHA1 a670e0aa3ccd4a662d5146632c9de15b3f77eb5e
- SHA512 60b2042b1b3d4853530c599dc168e1e77512ea76c3c2d4065bcab53833d9bcf85b578a7a9be1b41eb2ce28d83c8e44dd55d189051cc08ce2c3916e36b66e9c39
- SSDEEP 12288:ENsfeI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:VR/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T15BE4015AD29402E8D0AE1175CB569A41F3773C659BE0D3CB62C0F13E1F76A846DEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\debug.log
- Size 244B
- SHA256 9d761ee9793fcad91508a0ce94c44790057d30e4e906815998e70a770c63b2a2
- MD5 34d0f2433195c0b5a41cf166370e8edc
- SHA1 7de35c5b75c7381f6bb18c007a456fead2fcad84
- SHA512 a646561545d86fff4a397c20b643156a7ac35631243d5d74b4756531974255682f156f52881bba3b9d5d307e1af2d85e3c7b517dc5fa2e0b525da76d22272200
- TLSH T1B5D02B339A093AAC201E54503248B5C91450008CC12430B0D1970481254E4D0235FF09
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\2f72a80a5a3b5d25.bin
- Size 12KB
- SHA256 5be403921c2a8740130dd0ee1de00491718c2bb3090f2106e8ad0ea47b65a6c3
- MD5 9ea3f1af1365e4f58fc7db3cd645e382
- SHA1 7a809710b210b9b93b0f70fa861c81efc1d0222c
- SHA512 86bee81941c5cddd416d28a66c61189f08635103743d281ed487e4722c0e6087dffc3fc44bd41772c49e1ddce8fb5f827e8e954b3eed2b8a17877be3d6fb4556
- SSDEEP 384:r1nYMpeyvS3GC4x0gKp2YJb4kRupdwME8:rtv053GBCb24bnR2E8
- TLSH T1EB42D0043AA2E46AB507016253F4B4A2B1A3E65A36727DF30F762CD2DDDC05E9748E08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 c206677fe34347fb88da360a330120370f434184be5455e000e2037d80c56174
- MD5 195b0b661c98fe44a403d2547fde756f
- SHA1 50586db327090aa77f7e20b07d8c6afbde6a6a21
- SHA512 7f3d0cec7a1eeae8886e5de80e2baee982c94bf273bb293ffcfd8fa3d55a03cb8de10c045633ddad8def79edeac27f221418afb04f90ac1d48ce2b268fec4721
- SSDEEP 12288:g+I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:gx/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T129D423A60BE652B7F2F419B04D17E862E1EC3D6C9E00E5C3B1897315A979D45788FB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 d7e3f730c04689d616f0a2ed2720b840d4630b476316369b4912fa55f734420d
- MD5 9f4e5e0be9e5ab778c38090c6c751907
- SHA1 e63e55c5ddacbab79a7e04027298c9fdec1cc8c7
- SHA512 937f002a1d18ca7d155a66fced5aa079e7b71601f22c9581ae92f1ff7dd4a0b3858ce51065a55c9300cb660635610a650f49d7361e53bdc6847e1096f3b85a18
- SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQ7uxyHQQNhjrGWSR:Ra0hNYG4JwjsHQQbtSR
- TLSH T138859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 0f6494a0014a8358693cf6d971e21511e16c34543f9fae00535d2507d1a82cf7
- MD5 b27b46b1d0f9ba34d3a7b43fefef8952
- SHA1 00dbc3bfe1a07371432724e3ca37ce6432e0ce85
- SHA512 7a2b0c1b6b4c7d3b238fa9f39d04f1c7bbdd1a4f8ce6b03dac1dd11fc2666139e3000cdb8155912661960e5201e4aed74a590dba993bf752f71517c439696f05
- SSDEEP 12288:WhbHjfXLI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:WhbHjP8/uTVy26yOJ2bQcshjGAdGWSet
- TLSH T1F4E412BE17ED11E9F1B0A17889528546D3B07C251B11A3DF22C2927A5F3BED42C7AF42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 0d9b98867dd168a6329bfb1cefb0b58b55e1732712bbe30ca6e7a4746b76dff0
- MD5 c253e846874ab80af9f65d15147db4be
- SHA1 51ba4068ac119b79703429674427e962cb040586
- SHA512 36a40ae511f3f23af8bd4e1d5ccb22ed1dcc906db138721a62e80bac1c57e5ce8b578dceb1b3c8d69811f360de137ec99fd7fd1f57a38505bb6f955fe4effd9f
- SSDEEP 24576:W3YgnJcRTk4yti+R5dBR/U/uTVy26yOJ2bQcshjGAdGWSeqiCC:WIgnaTk46pBR/UuxyHQQNhjrGWSR
- TLSH T10045BF2EF3B910B9D4AAD136450147B5FB71782D1F209ACB0170C638AF1AED85E39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 876b672c47c6f5a0313b88291d37678c515c2ec2e7ee835cac55b318a1a9b01f
- MD5 787f8328caec3c0f1be34566a56ea3a2
- SHA1 9447f2a12149c032037bfbe8a332e32d8383ec29
- SHA512 c2c85abac92ac73a3992828fde21b55486d48f6a82c149c44f780d2c9156c4cf787de641fb5c03e29103fcb0a5a12545f862ff2c0f1218a03a66b42c24f6d47e
- SSDEEP 12288:HyI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:HV/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1E5C423E61BD352B6F2F405B04D57E892D1D83D589F00A6C370CAB311AA7ADC974EFA42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 72f2e979207505274d7d2db916ea1f56b7163b5a62f66a649df0fc0572f10780
- MD5 88b13a5d15f4c2d314ca3e745447b54d
- SHA1 4fa839e82fb7313ebe9e747ef7374d1934a0b0a5
- SHA512 ec5b1b9d4a916b20a330664aa0cc698c4eeec6e918b32a400f240fedcef74cef3a306513ceedd4543a9a34905fb82d7f455d22378a766773964f80a402440ac9
- SSDEEP 24576:npL3UTO/uTVy26yOJ2bQcshjGAdGWSeqiCC:npL3UiuxyHQQNhjrGWSR
- TLSH T1A9250155E7E500F9E9BB813CC9A28912E2B2785D0760E7DF03A84B651F237E15E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 e8a68539d17a4cccb5763e69ad956bf7e0f29f05f1e809b701f6a1319c4fa74d
- MD5 215b6c3fd731b8a72b1f155034a18045
- SHA1 3dda902d3edd8e88d324f232e20270df9d338910
- SHA512 ce12a21dcc5adeafd7cc0094133570b358b07b87ab03224e3d9880b62350b60211aec708290c44260bbcac429afc8976a41b1a05193dd4f3f113fda9c64f4c79
- SSDEEP 12288:zpFtpOdI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:POC/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T19BE4016A37ED10F5E1B561388983924AD3B17C660B1153DF02D0827E5FB7EE86C3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ee5fa5560103b2aa5a39027305d5db0d153beb2c78b05889753e17212bb25642
- MD5 280497e1ade5b23efad34f0fc235d5b1
- SHA1 26876ee248b1d868b57184dd6f75f49c694eb591
- SHA512 722bd2cdeebffbbd36132a9bdea3e7b60bc1b52f21df300dbf81eebf3e9dc612209f60ce44d570b8c684c626f106ecc51fb0484244a105be566c8d2bb44e5afe
- SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhsB/uTVy26yOJ2bQcshjGAdGWSeqiCC:R7cBWMpPjN8DbEhsuxyHQQNhjrGWSR
- TLSH T17165AE2E6BEC81E5D576D13DC9A28206F2F1B4611B318ACB1152833E7F37AE45E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 5217cba8f47310b8c4e1ccd5387ee51b748e5fad3b41db3943b8937e6da3bbf8
- MD5 a51a70e353d3d37845b585bb2b070a68
- SHA1 447b446f2ed2fd4049ef08cda2cdaed512bce6ac
- SHA512 04b7185834b3cea3ed97c232ac2474af2d0978fc1d59e19def4fb36123dd19fb7a2e8d91a73c92fac1cd4c0a553ba6fc55c88d0ec7addfedc99e82c370a763d3
- SSDEEP 49152:pF2YuHNETovAvNYf8kmZuxyHQQNhjrGWSR:c6BCf8kdsHQQbtSR
- TLSH T1C2858E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 f5d4168440151978631f88fa8b1f5c08ad6d71fed0b7a5dac53257dcf13684cb
- MD5 1de661aafa7dc1b1a9656ab9f05fd931
- SHA1 f5f633ba22db4ccda12bb3140c72dc878dce18bc
- SHA512 c0162e6de300913947e4519dece6460182e7a63e2b5f537a670f0a908618de53d80f30bae0dd01045477882238a4c0fdfd32204d12c089f66738fe8a0b9eed34
- SSDEEP 24576:QAFs06+Omlf3NXEbTo2/uTVy26yOJ2bQcshjGAdGWSeqiCC:lFs060lVXubuxyHQQNhjrGWSR
- TLSH T11965BF2F66EC00D5D07ED17D8997C91AF2B1786707255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 c4a975463e2ee25a478df2aadfbbf9435285e6ca517e96c321cc423bd98281dc
- MD5 aa77c4ed4f165d782f85a56007bc9a4d
- SHA1 b4a3151606c1c7c111fa402a13ae8529249fc56a
- SHA512 5ce8c8e24b2cb178f1d44bde43988722153bfb07bd8e418d77f0313b24d31f40c8e47ddda5be708f64a08ee52151bfd2d9fd004e517f2ed819387180362e498b
- SSDEEP 24576:nJnJ5D3WXb/uTVy26yOJ2bQcshjGAdGWSeqiCC:nJnJ5DGXbuxyHQQNhjrGWSR
- TLSH T15915D02DD2A810F8E0B7C274815A5B96FEB1387D2F2269C724B4D5357F22ED0A979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e27a50f965d3a0859d8c5fe9ffe3e9c483d05686194e1e245350b8a9ca46920e
- MD5 2e20efdb392d040bb2acae2ff730e5b9
- SHA1 079fede6d72dc6fc0861860b31b14c985c86ec4a
- SHA512 0d3af13743d4b67bc1429011e0192afe05d871f31250a1e65ed5776a0de2cffd8e666f4b990194e4b51651319ae743c47d9e267b9d255631988abd5dfb931ad1
- SSDEEP 49152:7g06DIKdwc+eQnSt65aVduxyHQQNhjrGWSR:0GsHQQbtSR
- TLSH T1F2956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 70156af340fa6945c1525d55af4f3c24d8370033f1f4a083f45bc8bb9f6183f7
- MD5 e739e8cb9b7c2cef476b510925a707e4
- SHA1 731dd64aa4e35a167171e1dfd371a1db75e43ea0
- SHA512 c97b4f3f25da202e1a76dd5a26a7b05353762d203fa4c9e63051655d2203a2c1f65412243eb8d235191405171c6902d5aa7c760f2ba92500dd46f2cb5c603075
- SSDEEP 12288:/EP3RnNI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Eny/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T11FE412AE2BAD60F5E1B5507889928541D3B1B8742B0167DF22D1C23E8E77ED93D3EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 6acab5520f9d134b24e97ab8492523c6377e1727156cb5baac3ed14fece0a558
- MD5 4b61c9681b1439898fb76fc7261a8b49
- SHA1 79560fe3fdeabb8b32ba474608c8b0949e76e0b8
- SHA512 48a6eefa5540d111376b1a3bf6b50c0a73cfbda7d2683a74158495f79ee5046f7857e59684aae09401702e07c8ffddcd871461c5f48406a38dfc9625873f2ef0
- SSDEEP 12288:djky7I/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:dIys/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T1C1F4125923D461A5E2F506748E639591DAB47C20AF10A2CF61C0F33EAF76FC4787AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 e53f5b9549bb799c32030bb761e07b8c2ec02f25316f075ef0e1dca95ed42b23
- MD5 b3a7506d3353f9da9ee4fcfaf18bd075
- SHA1 7f9001c3d61344698b0c9f66dbdd6d555b407365
- SHA512 e11f28f72e874cfe733e22c758bfb972c8a490061965c9b0c7527447942d0a1d45236f8b60e7ead9eb130ea8d576bf66eac9bf95e0dd0db4b735f8ac0bd16577
- SSDEEP 12288:pyNI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:Yy/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T119D423AD17E262BAF2F405B08D17A992D1E43C696F0065CB70C5F231DA7ADC570AFE42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 2bd7cff891bd96306266f4a511337d601d0c23e1ce21be43f1b090762103306b
- MD5 c5270ffa67004d3b4efab97c0d0f4d4d
- SHA1 c89a8c0fb8b0f0d6d2e21a8cc7265c4df057af96
- SHA512 720c28f1c7c13b8fc2eb202b231a1fd146e8114894fb7095523801af78cd9adfcf8d6860e2a72f63f6b782526dc1535524ffa910df1a9b75547fba4671b7a6de
- SSDEEP 24576:xQ9MxZKdcz9dw3J/uTVy26yOJ2bQcshjGAdGWSeqiCC:xVKZxuxyHQQNhjrGWSR
- TLSH T1B8558C2DABE9059AE177D27594A250C3A673B4301B31D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 b3e68b3187d9b52d87c285086330ef3c9390469e3b0705d9e6862e74194524f1
- MD5 a1439a28c0052e1e788b7407563cc592
- SHA1 d00842aeae4c5771a10dce72e47f4caeec454833
- SHA512 b9c21953d4653c56b72c5d91b3a0d7eb03b2823614b63d9e8e0960a50b237fa6ed5167873078244733987c565cf129a16b7d3b46c1499869690d7789968ffd7a
- SSDEEP 24576:myocDApw/uTVy26yOJ2bQcshjGAdGWSeqiCC:7ocDAp4uxyHQQNhjrGWSR
- TLSH T15DF4E05F7BAA40E2E176813C89858641E7B374305B5263CB6181C33D8F77AE9BD39B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 727dad9784d1b102b42ad1d4936fe145d15b81892e73906d42c41953d1e3cb36
- MD5 4eb98ddc4efe9d84dbdf81b3e7251597
- SHA1 485752796414f84f03f1a205735a47e8b17a3570
- SHA512 438efebb9e71b2158843e325f28eb45a6179df04a28c39af0fbfcf5d9e61bce3c7c2e46a4a1b802401a9c8e1f56db7f08177849e5a9e068257dbd43b9e0c209f
- SSDEEP 49152:3WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4uxyHQQNhjrGWSR:v0zuNIRsHQQbtSR
- TLSH T14CA57C3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 b390d8d7f250cafe3f3192afb990a092e05bb2bf80caeffa7686ad934c94c66e
- MD5 f133afbfbe19b9f7639424ed4757e6e8
- SHA1 8f79f17e7f04cea17819b9146c17242a55f5e98b
- SHA512 ed4c0d076cbe0fca37d91f508d7775cce6deef30fade60fc631236416111e686d216e85a4dc2ed750380b20e77a91bab3295645f4d32c0e099d6b30cdbed8d1d
- SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYtjMqbP/uTVy26yOJ2bQcshjGAdGWSeqiCC:ITDxR+N5YzTfjMiuxyHQQNhjrGWSR
- TLSH T14755B02E67F915E9D1BE85788A23C512FB727821073193CB42A0C17E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 6c5bc1396132a7cf48834324c1a90cf82b56e2f5159a3be63263f87b963ce2d0
- MD5 65fcc74276f23d2fa1288477d0404041
- SHA1 8259d64bc612ffe10a181664beefbfba1129847c
- SHA512 956f1defd39fb2cc2d78e067043e3d0b23c229a5d2a6d26bf49037e1eb5510342d98099c84763cb72ad2872d0fe3fc5cdc2f6f5eedd1724bf3d102c882f1b116
- SSDEEP 24576:nTMdOz0FFS+imSLD/uTVy26yOJ2bQcshjGAdGWSeqiCC:V0K+imSLzuxyHQQNhjrGWSR
- TLSH T1E515E17E63AD14F5E57AC27C9A438906E6B238650321A6DB02D0C1793F6BED4397EF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 4f6a5f15c421b5fff79ba696429c71e3105adc4ea75b3db8423a6d106e86c308
- MD5 6fe8ad27dbe75ff65ddf97bbca988cdf
- SHA1 ec8fd2f1021dace7f62814ed60d9c4216ff5e4ed
- SHA512 92eaf0bda83c8c5c6ee2d7907ecdb530ab2d0864974b8d2d8098c77decdff4ce85f876a951eac5b63c12c043b8cc62d3d28b762824e554c8475bfa88c0f020f7
- SSDEEP 12288:m4KZI/FETVy2J0mlcyO+A2YceRP0oiWhjOs+KTK9ODzYOGWS83xqiCC:UO/uTVy26yOJ2bQcshjGAdGWSeqiCC
- TLSH T135D4125D17E930E5F0B152708E279542C2B07C792B10A6EF31D5E27A9F37EC8A47AB02
- MD5 SHA1 SHA512 SSDEEP TLSH