Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 08:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
- Size 12.2MB
- Sample260708-kagpgads2z
- SHA256 1456997eb9781c0ed8a51820a4b84e47e9696661b09e80c443127477f21569bc
- MD5 cb72fe5da07b8e3190696366c7a1d0ea
- SHA1 c017b64005e0f88a91f8aff87df0c52edf8cb5e6
- SHA512 bb9e8fcd2b7828f9abce18b5df6c4b24cd5a24ee1a6e6d18080b917267e0baf64e60f15394fea3d14d4c62e4f36adff3383672ec27e2e9769a786af2199d6316
- SSDEEP 98304:YuBaR7bSiWvlBLwZ1aKMuD/DA0dZ7jzFzkpSODPcy1DQq/b3EvuKBPwox8WLOEJ1:YtuLwZS8xXoHPzkueNLXt8FfKW7X
- TLSH T169D68D8A62F901D4D1E6D079C60E954BE7B27C5103708BEF01659ABA5F376E38E3B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4748 alg.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 2152 fxssvc.exe 680 elevation_service.exe 1436 elevation_service.exe 4636 maintenanceservice.exe 5036 msdtc.exe 3868 OSE.EXE 920 PerceptionSimulationService.exe 220 perfhost.exe 2700 locator.exe 4212 SensorDataService.exe 3544 snmptrap.exe 3204 spectrum.exe 4124 ssh-agent.exe 1912 TieringEngineService.exe 3396 AgentService.exe 4756 vds.exe 1776 vssvc.exe 3612 wbengine.exe 1816 WmiApSrv.exe 3456 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a7622ff02d44b5a9.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000030d8b27b30edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d05e3c27b30edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 1192 DiagnosticsHub.StandardCollector.Service.exe 1192 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeAuditPrivilege 2152 fxssvc.exe Token: SeRestorePrivilege 1912 TieringEngineService.exe Token: SeManageVolumePrivilege 1912 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3396 AgentService.exe Token: SeBackupPrivilege 1776 vssvc.exe Token: SeRestorePrivilege 1776 vssvc.exe Token: SeAuditPrivilege 1776 vssvc.exe Token: SeBackupPrivilege 3612 wbengine.exe Token: SeRestorePrivilege 3612 wbengine.exe Token: SeSecurityPrivilege 3612 wbengine.exe Token: 33 3456 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3456 SearchIndexer.exe Token: SeDebugPrivilege 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe Token: SeDebugPrivilege 1192 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe 1864 2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3456 wrote to memory of 4192 3456 SearchIndexer.exe 111 PID 3456 wrote to memory of 1632 3456 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1864
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4748
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4256
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:680
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1436
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4636
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5036
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3868
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:920
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:220
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2700
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4212
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3544
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3204
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4124
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1108
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4756
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1816
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4192
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:1632
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b4e0fa206777b38ab1997af540da781dcd579b4ad79aed37451464811b13e88e
- MD5 fcf71d3506b9c0d00e1ec6cdf9e72d40
- SHA1 5fc586cfbeb67cb9d33115c204ed2238c34aaa80
- SHA512 3d2c93986ff54d3ed5573a0790a13ee083630b2bf6281ae42c96ad37dff6fc79aa130c533a6c189da0099e205984af1274ee944f95eabb1234a36e8e9f0234bc
- SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2x4x8EVep:/3q6HjB9ix8EVy
- TLSH T1B1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 9722837088d36aa6a29ec3c11d8a994e1c775a7baf93e80b53fd7599607856f0
- MD5 768d610d249b9aca2b801e1029564a1d
- SHA1 d6a603faa1bfea2b97e7a223e0c06182abe27fcd
- SHA512 53e040255f84a1030f6909a0e9be4c521b2fc815df75a3bb01c06f187d293c453db41febf35c3920e82f0412748ee1c96d78240d689ce23a72dd5351ed808e31
- SSDEEP 12288:01XLsswWkxy2lRq2czAm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:SXYfDtczAmyxknw4FYnshx8OfVe247
- TLSH T18175F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 ee3cb107ccb5cdd8906171b6fa7b4ca960541010fe3a06bd7d9f210e62785535
- MD5 b1a583566a98f918ba76d7dfcae8c964
- SHA1 26daeff4dc556c28b305d54f2afae2d27e21020d
- SHA512 b398a51dfce8b0d8a7df6bd4edeba29a0cd036b57553ad591f992c92e988d2fbbe4dbd14c40a3a556b7d5e9354d6c1a305a2fdb63204c436230427d10ce0cc10
- SSDEEP 24576:60Le5ji0hmx1rMryxknw4FYnshx8OfVe247:6Pji0A7/x4x8EVep
- TLSH T1CC95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 91f49e2cb574d3c97b6ce64a73094fb8152954b0b852668d85c62a2003a132a5
- MD5 a21c1a5ac14f1f4e31d7fbdd6086650f
- SHA1 375de97565c8d7735eff705b8714cbda26aea1a5
- SHA512 f9794ed1251ea2270d44a6495d44698de83e8b921fa28102ed6a1f0b724bf722be93970ac87365de9824a63fc947bfd0f9239c0334bda60a73342c93eb95e39b
- SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyu9yxknw4FYnshx8OfVe247:C/ezSC6vUzPvxHjy7x4x8EVep
- TLSH T138756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 346da9875c22d896b9ad69260006c0ae35844c1103e2f94b1e76298e17968245
- MD5 78895758509f001dd53fc2122e36de4a
- SHA1 a294ab67f7747809c862a25539065e8294096c35
- SHA512 0feb0cad4ecfa1f1c33fc586791b8e84013f7282ae84bceaae9a5b2a89b59df765a838d80e23d6270174b70df419d66c51c714bab2b999f63df32bb9d75b34a7
- SSDEEP 24576:VVbqPb88hv/l+6yyxknw4FYnshx8OfVe247:VVO88hXl+ax4x8EVep
- TLSH T1A6559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 05839288ae23b5e845d7590ce2cdf95627155ce3fa14307c3468b242e7febb19
- MD5 924f742dfcec2af8c617afbd1a87621e
- SHA1 bd99cb796f16ad5ae037116dc80a379138862a6a
- SHA512 e07c187dfd41bf583fcaf15dfe6aa3e29f4c9aade8e05d148b2d8398b9d22150a7f3a0f02f77826a88288e81c654e49f888244a7bae3a16106ee19499f5e2cab
- SSDEEP 12288:JN3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JN3yxknw4FYnshx8OfVe247
- TLSH T18A65237CA7DDA4E1FB5E15331B7572622616B9A4DA74C11BC778B14EE0F0CA0E06E223
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 447dd2eb1abbf76dc767c2e48daf9e8e96f6b17404f3f9907d152273694088c1
- MD5 7388e6236159ed5b3d4e4c34f83e5bcd
- SHA1 408a1fb84cc82fb05749d02a24d05de00faff0b1
- SHA512 bc5957165de3f7430d737a18b84089903227c6acc46f94a5c14d9c6e1b39e819c668179d5cd477f54f16f61fa15fd341acbc0d61cb633667d99b523ef45bbe51
- SSDEEP 12288:peBNUbTVO86Uq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pJIUqyxknw4FYnshx8OfVe247
- TLSH T11575CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 6021d400f772363008abcaed30c8de5ca4d1709bc5f932415188d91d4c4ad01d
- MD5 351f114b1d4d137279dea8cd7a380d78
- SHA1 a420c7a1cf19a261650e691423ae3a67c4def290
- SHA512 c74fcd79c70828125e2f247200a37e6e0560e1fbd9184bef2318f6a74232ee1f3501c1333440dc80fe216832fb55969c17e78bdd9e72e4bca60701aef05a1b5a
- SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:zQvGAdlCEL8c/yRNw5CYix8EVy
- TLSH T14D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 29906032d56ac6b97ef243f28658203280f2e50653d0e67d37a86f31ca60262a
- MD5 f148f1e4db299a96910c28bf64940035
- SHA1 5955caedf90b2bfe74702a1bc959e085e9092a25
- SHA512 e45231f89f49dbd11cd502806097a8e9a4a4c6854caf7e66c580baaad99f6e0f0668ecdd1ed05db5fad71cd06931027ca7302465de5d14f66097ebde4eafdcf9
- SSDEEP 12288:bAwSfxL/2Dc3LDLLmt0LDQewsAjU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:E6ewsAjUyxknw4FYnshx8OfVe247
- TLSH T1BB85E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c0a0f5752bbad9eed19829a0425289b4d3be0b4bf3b4d3f0882c3311af1096ea
- MD5 3a58064236e199f700dbd9500c520fe4
- SHA1 adffa0405b93371e68e90b7e94707656099bb7ea
- SHA512 7f7c43aa1111f04ad690688f78cf553338e8e734c71ef123601ac4e8d4f602684a22ad5df2f0dd960d003cbf424796d0411006e3e6d6f7abe2846d4d75e32c67
- SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS:sUEtQevvqc2W1cpV2EI32
- TLSH T1E0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 8ce502d055a4eb3771928666d803fe889224a1315d5b6d73186b99f52426f976
- MD5 2fdf9023895d967c71e573519a6a762a
- SHA1 cbe0160198b891413b9d36f0aca817601767b1b4
- SHA512 c75c0fc9e1ff95d2d4e0d63efaa6cdb7f568ff746a6f5a3d14292904f0f43ab9b5bc51af336a9aad0e3af7fe57d98fb524a2e338469beb0513feb758630d90ab
- SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/zPx4x8EVep:/oqtVjnm0ix8EVy
- TLSH T1DBD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 c75e6cb9629e8e0ac10e1742c16e4d1c457211defc29ea4d88905ff998c2517f
- MD5 e4cd1da1e7192c325f1b054be74cf8a4
- SHA1 28e3c96c2637d4482c4989afccf3fa626536d2c8
- SHA512 fe18837ecf3576e55f0bf3f0a0778769ec20ce20487e7d7a2b80b1dac5ce035cd9746cfbbf141d06af8c039c0bef33e6c082710c1bab6f938865f3beb4175d52
- SSDEEP 24576:fAhGLJIFoiwtA5l7S53Ryxknw4FYnshx8OfVe247:fAMyFoiq5kx4x8EVep
- TLSH T1A435AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 2745c3b238cddd3090315f5f58f8f705a605314b4edfdaece25847b0b8c381e7
- MD5 b497199daba818badaa7b5f72c93f959
- SHA1 8193a31ec64296fc40bfa9e231bacd9943335890
- SHA512 089d3f69d3af21f172cdf9f3d6c37039750508a4cb7ac821846e5d4d2159e42b6e22e04482a6bc5a53c39484084ad84300039b18436e87ea7e02fd3d1d26c7d5
- SSDEEP 12288:Pmw5HEjsChN4BFgl0WDm+Cd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:uwuVOW4yxknw4FYnshx8OfVe247
- TLSH T11D75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 71aa9c652ac19a9ceb57854724c5ac06a9a8ec0534f93c7d41b07cb340b8b917
- MD5 ef2e3d52809b3b3fb93bbac8a118b4c6
- SHA1 fd83731d7652022ebcbeecfec6225257ebcd0549
- SHA512 1ea640541f8c1896983cf6a1b1b0afc5a7f00a53f5ba40d979db6526fa20c6e003efbdbd4204587456fb534f1c204e0ec332d767f925d07ff8a39fde46967aaa
- SSDEEP 12288:sFZ1IyE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uZujyxknw4FYnshx8OfVe247
- TLSH T1B36512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 8a3edf0061c9288d6b321b005f914b297552f7fbb34a5e76c80fce7e27516911
- MD5 dc90ad71fae357abb39100e624384310
- SHA1 f805fed8f7afada0f80b42fbce768e27e29fc356
- SHA512 673c6e86802f0ff0625da0379f752a80243f276c934b12e8363f0e476b59139322a2afeaaeedccd09a82103885ac3da9ec9532177cb111a1a1e07281c348c525
- SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:gQRQyi36YOcPQLvw2gAf+PN3xix8EVy
- TLSH T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 d238b6e66cf587607e645dc45440769744f2698b43f8db8b05f69912247fef2a
- MD5 cc2f7b69ec031ae7ac3e35f099cd8d86
- SHA1 581f95a410f892a9087bcfda703c77c4360f9765
- SHA512 adfe5b934c742d35f86bd6e0ef11567620b5e92f460401050d8803cf839f9ed14b8b3b49626a696c913a0717ef1e3c3206da490d8cefb83b27a10043d1327420
- SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:cQRQyi36YOcPQLvw2gAf+PN3xix8EVy
- TLSH T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 75db7db14ccf85820931527492692e2c8fadf228f07b556d934478be3fbe6409
- MD5 570f1d0e6d4496f6859a772e8f67b4e4
- SHA1 e1d630d27918195cc8c49a554cf6a576dbcfc2d2
- SHA512 71e762d3ddc4f7bfd1a4b4ebc10e54eb634d41f43695d21f7469fc8864153e9826bce2f4e537902d79b7d54e2eb90d47d49b8bf3b729c91074bb953ae5f63d39
- SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0zyxknw4FYnshx8Z:q68Qg55nhheWu7PNU3//x4x8EVep
- TLSH T111B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 223878bb5e9637ac4e5366065ac8356418a5cd7ec04b508a753e1ceddc04d297
- MD5 1f8e8b2aa1cbc1182803e369e1a04d69
- SHA1 9386c94cf1ba05a341b67162cdcd4810eadf3d1a
- SHA512 a75b1ff1de0453bc6506ea757f4772524536b58302f0ffa8de9070109fd8d4c792a3c7fb649d2077de3e80c135c689eedfbd2e7e08c644464e948d277a51d1e9
- SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:ay5112gYy5azzVvL69nLKnhZCix8EVy
- TLSH T1AE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 68652c6df172617c67a5cddadfe1e78c05d2f6067168228182934d4b4c011ac2
- MD5 03207572cb12d8867df6c4e65524e017
- SHA1 c303ed0c71985c43bb59848a465a82ba01dff608
- SHA512 ba0659361c72abc73081e9dea7cba5e583eb150bf1ad2b7944cedd9b6ece4c9ad727470e31e5a927d5fec06e4ea9d13c5db919d30af2641b2953a0eacc4c81c9
- SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpx4x8EVep:du6JmVxd2dpix8EVy
- TLSH T105D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 8b41217be1c01fb3dc254a5c2232835d07ac5f520bf09c8cacdf586695568af9
- MD5 24ca2b38dfc29101b70f9b1a037c2272
- SHA1 e2bdd122758641ae088a334542ca39ba8524cdb4
- SHA512 0b9d47e784c543e53102af60dd24d080a7177ec3c07c4f59817f4ed224d40ae8c1dfe03119c4461145edf925a8bd0ecb7206f9276ab000cb3897ed72de8306f8
- SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xlx4x8EVep:fmifPbR0ix8EVy
- TLSH T127B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 7d06c5a3b8b9c57958a5a8bb2d4eb974e8d9fe9093f824a74bbb11686acc5592
- MD5 6aaa5b1194a17c67d8c80a35509221a8
- SHA1 aab705dee09f3c8ee80dfabf8eecdcf386e43c79
- SHA512 b972c278ea017df9c1df384b3b0bc0af670ebf81d0ec48e04e5bebcc0a10c7bd74134e05ceb6d214fef6fed687e8970ab4ede63e2d3e24b0f53a37fa2efaad97
- SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqmx4x8EVep:p5dKTi61mix8EVy
- TLSH T138C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 c04c91f493835ee6ea5662ba05851913e7712a5fecc29a754defdeed597bab82
- MD5 66d647395021badf7170dcac3c3b0d6b
- SHA1 22e959d33edcee2c3d36e2b530cc7af02f0b5a10
- SHA512 51a5fdfb1a817862bb61f03197bd8878291ee1325ba07b51dfbb4a98703bf702ed121cc25999237fdcb504a4b5e1456a07e52e56806d1b54d3730be1338a2bcc
- SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wZx4x8EVep:RX2iyphAix8EVy
- TLSH T19495BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 fd495698e88cde4d12c4073e486128814f70ce2eadfaf560fc70a125ec3a13bb
- MD5 2c18cc49498d76c4cbddcceb9dad73c3
- SHA1 48544097ebcbac4800957d4c2637d518e470efff
- SHA512 f8872e69dba73c727549a03367f5b075f33c86011e166d0c399b238227c0614a4be42f86884e63df31501f186707adc9d93ff246fb7868b120988b19102c284c
- SSDEEP 12288:5v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5vyxknw4FYnshx8OfVe247
- TLSH T12865237CBBDE95E2E50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 2ba1adb661801baa17b569bf828a49e6204feb0c0cc4b3910c07c7a2d3cc23ea
- MD5 cc5e318a6ffcec5350bd89126dbf3fce
- SHA1 4fcb7a4c1876c4ee76112917ec2a67efbf5526e8
- SHA512 a918205b1327b407c86a72a2671d8858fa62616b1d1f29245a99d42924129ac088d90d093ccba66e2e123ea6ea9bce0660c1f4373047046052d903708460b2f9
- SSDEEP 12288:YA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YAyxknw4FYnshx8OfVe247
- TLSH T10F65237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 0b201a40093616ee5452a0e3261687a9dffb70a578cbd7658fe85d4a0d77f2eb
- MD5 e58f3b36560853d937b15fa47684907f
- SHA1 9df99638d77142e563e024e8d08a371f47364a7e
- SHA512 da5af9e496da3ac92c46723c40c1da7dd0efcf1b349819fa979e0f2ba1dd9dc81686aa34f04afe8ff23b4920432b9d0ed8c2fbd33ce3877543c3f20abf457718
- SSDEEP 12288:YC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YCyxknw4FYnshx8OfVe247
- TLSH T1B365237CBBDFA5D2E54D11734B7263626609B1A5EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 e17041bc558348a4bb66efa586f3712c0293b7f5a669186815746c72be0315ef
- MD5 0f674ebd02eaf6c4a1f719a877398bcd
- SHA1 5860c846d30c14900296e26d34766240073ea66a
- SHA512 7887d3ed4c23771e0d54b4d5d9f7bade497625aadc80fc1303441a33118a643af080d0719481b9e2e0c244129e056123d878c121aac2119a2faf19d9834a27c6
- SSDEEP 12288:YVx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Syxknw4FYnshx8OfVe247
- TLSH T1DE65236C77EE50D1E85A51738A726222B365B8E5E731835FCB24710EE9F0890E43DB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 4e0c309a4e024ad0ac995d8f31ef523698b7d91a0bd62b5f3ffeaad16b7b2c77
- MD5 96d2f59ffba0d219933a7f35f8fa68b0
- SHA1 c18d582fdc4218f3488d7b8960a947990920b329
- SHA512 09143936a76d7d035810ba84885329b1146e347a98e410dd3150e1816cea5dfb1e6f7fee56fee32878e896660cdf1148bcb110e112f7881fd7c0cc37954ee3f5
- SSDEEP 12288:v5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:v5yxknw4FYnshx8OfVe247
- TLSH T1D865237CBBDFA5D2E50D11734B7263626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 1592594fa73f0bf9bea8850bce28a99a3cecf191e2588d8e8a40509f26aae3c6
- MD5 12740fea94409624842893d5a28bb0b0
- SHA1 1495105c5238911f7f3395ea2a157a48f31966a4
- SHA512 0fc330bacd7697d71b0d469de312d2a08eb08114e361877636b4247ca655d8f8db80436c0cac3126656126f6ed8f560caa777a413abb493b75b9ba325b232e71
- SSDEEP 12288:xs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xsyxknw4FYnshx8OfVe247
- TLSH T1EC6523BCBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 0ca426a134eb4039f8171015e2356f9e53f3b72b42bdff69840c45e33922b626
- MD5 a64411d3286d86f52f2b6b280906e744
- SHA1 82f06b30356f6730303c7d05680fe09cadbaf232
- SHA512 de0a8be7e0095bebdc2139db4fd8cce164696dfb1f344738fe57479fc255dae3f1a96193ab8c541c96d78f85bdc45beb71acbc96990bbf1f9cbedce5a74318da
- SSDEEP 12288:KI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KIyxknw4FYnshx8OfVe247
- TLSH T17E65237CBBDB95E2E50D01734B7172626609B5A5EA75811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 f8742f901b266655ef65a0ba5f60985721494269b2a42c2a90d63d53a3e29503
- MD5 3f5e111548b3adc8b63395bb3ac4c0a3
- SHA1 2421c13bd2498fafd09c76fa8af034a5f5d537f5
- SHA512 b673ecb95aa883776bcc6d3e64b305f20443153653ec4c15abdd6b87b64286ebaaee6fb009e321c8d188133bed9c661b49026cae12e7a6a41cd43a3e94b48e9c
- SSDEEP 12288:FiZwbZzzFEoS2cPvyg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IZMdzFVSOgyxknw4FYnshx8OfVe247
- TLSH T15F7502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 23c43974ee2c73798f16f724f929a30faf9b46a04d29fd7c64d8249102ca9247
- MD5 df2df4fbc5f82c09e95ee53a7e853673
- SHA1 06ba71ff17ee1ee026887a858adc2a9f469bda24
- SHA512 5cf58bd22ba0aad231a6812e6bf175ce9e7fac6ec0006187faaf4d0597047599a276db43053f03fb17e4622499d1813494218dfca25d5127e25574925f2e3463
- SSDEEP 12288:1T+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Tyxknw4FYnshx8OfVe247
- TLSH T16065237CBBDEA4D2F54D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 c5a7b0fadcd65fefd5fad39709ea4f3f6ef27899578babf3d563fcdef93624d7
- MD5 2f1c17dfa26b21acc3611b46e74cb8ee
- SHA1 3ec333989214332d083ef4c0c949677c1af6f8df
- SHA512 1eb4723eceeec59fa124aab9b704df19315de57ea3076c0ff6504386f850ed5a19679f9243c198425c8a512d5c6f3f3137469e32225156353f74c1945df27f35
- SSDEEP 12288:en+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:enyxknw4FYnshx8OfVe247
- TLSH T1EA65237CBBDE95E2E50D11734B7173626609B6A5EA71821BCB7DB00EF1F0CA0A01E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 03b8a484412891d6f21c037b69622d53a1d61e221720cada960e012fa7b423bf
- MD5 50d0894fc723690b2e4b981398fa68ff
- SHA1 2f1cf750e78f24b07368839107895fd371915c17
- SHA512 d0a5e9744476e91bf2804f5fbb1f9f5fd2e08c2f555bcb160f9c3e77069a166d603a63f9c2cfed4e4ddb693fcb5f73b5cd91b9a6aac2ab2f2b2f3d5e01073234
- SSDEEP 12288:MyPz5L8E+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VzyEyxknw4FYnshx8OfVe247
- TLSH T19975125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 595062fa643ce6b75b48adac086177a615cdf44996b61b9a1a25e12398052cfa
- MD5 77f62264bce7c6f470352dac74ab1a70
- SHA1 2c6fa28f15c26caad500258baa38789be8ae3927
- SHA512 2be0dd2c752e92d09bbcbb267adb991c26dd5f45a5cb461daf8ed3480f57d46c281119cfac9517beec54330dcd21f3eff1a8c99f35b224c4aa61e8074d9c0e26
- SSDEEP 12288:AT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ATyxknw4FYnshx8OfVe247
- TLSH T16B65237CBBDEA4E2F54D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 0e7d8362235b57abff3a16caedad38e1c7e87f074ec7988614fafef13f8c0452
- MD5 65a5083471682cdec70c07fe722c6af7
- SHA1 9f108db16dd59316d6b32a1b0b378de5083cba2f
- SHA512 5eb43a76906912fe04987f0bad8b8dc4beacc34a3f6e12c9ce91e9c323c3817e9d5f415d3387d2cefbe16706ed4e04b6ac4518d070279e4957175a94ccaf8895
- SSDEEP 12288:KT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KTyxknw4FYnshx8OfVe247
- TLSH T1D965237CB7DEA4D2F54D01734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 5fa9b75f81fae02b9707acffbc520fa1d41748e4c3d2cd28ad07e8294e595fdd
- MD5 bfc796f0bfc55e2025ea8af20487097d
- SHA1 15d3d71d3d60b03323a51c24451eec0d2f538c07
- SHA512 494087eb2b1d84b8da920d78e07fa481b8ab342ae15ac232a4a79ebabda0432f803d5936973c6127b53af57828abd02433dff0bec0bf11785f270171248a1b9e
- SSDEEP 12288:ZyPz5L8E+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YzyEyxknw4FYnshx8OfVe247
- TLSH T19A75125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 f7cfda1ad4b9d318dfe3e762526dcae5582ba52f24556766362cd3fb58f291e9
- MD5 1ab2a80592a3426703ce66768153d366
- SHA1 652396956133000edabe49c640e1e371261059f3
- SHA512 430ef9399f5bd76efdf13bf4f50ad2cddfc5a9a46455a458016c51f076e51e119f6786711178ce59c1a75258fcd853efcaedffeb055b32e9064fd92a6680800f
- SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KB7yxknw4FYnshx8OfVe247:AP4m4IpOO67W8KYx4x8EVep
- TLSH T12F65BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 931ed752d09727659fc53f2dc8df624a8a991c43050aeb1365cc3817073bcad6
- MD5 145955793acd3cb6dea4b0592c151dd2
- SHA1 cae2a2f4526d6b7cdedeff088644230df5946381
- SHA512 632bf8ac58d1b438f6dd2dae8920c881fe3d19e32ed72152850c98d5e94c245f47ffd67d4bf0090e0c782d79849ca25ce95a0eaf2f4c1587d85d4a53a7b59a80
- SSDEEP 12288:8+sfj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ujyxknw4FYnshx8OfVe247
- TLSH T14D75F028E29842E4D06E2176CB625641B3237C6597F1D3CB97E0F13E1F71990ADEAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 aa97166885836cec8917ff45b7652186dfa481f837020be2349b8d8f1d9d235a
- MD5 38c9074e28bbe4949b1a94be339fe402
- SHA1 78a57f1b7fe05b27562f635583fbb251b4cad5aa
- SHA512 dbff7406695366a8ed1258e72073867cb1c89cafec1ee72e34db003234517c15530a0c47a2345df1f11f95fce7edbe108e7eef21fc37f30b8cd045e605c08e87
- SSDEEP 12288:vD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vDyxknw4FYnshx8OfVe247
- TLSH T1EF65237CA7DDA592F56D15730A31A231361AB2B4DF70C14BD768B11EE4B0CA0E83E617
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 6666d0b31ab9026b7150cae518a3e4f8b9a10513a3b424ecdefa1ee06a1f12ba
- MD5 51f1b4dba3307fe3bea9949973916fae
- SHA1 601d75a33d98cc25f9614f26abe83af040ed0c8f
- SHA512 213b29c31de68e139efe8098e5fe6de10ab46f50b1167cec503d43f7a0541043463e83c5d4647d481b0e870b28b68c0fd23a8b8669ed583a83cd5f3e08a94dd6
- SSDEEP 49152:7a0h2GEkuAe73q3pp46zwwQ8x4x8EVep:7a0hNYG4JwXix8EVy
- TLSH T10585AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.4MB
- SHA256 ddcf2603fa4a6ee1e6d281b06f91114b3cfc109dbea18747bf0f158c52862d0f
- MD5 59a5f1ab7b46899de71626a01ae46042
- SHA1 96afb2a1a51119a5551dd53d4168fc01ed8a5591
- SHA512 c5a48796f8551e8a756fe8b834baee053fe77ee58165f1e9ce50c13a545089a22db1cdd7a7f423e5ab7ddf9b42243b2dc5165e566787ce31ca5d60246c63a41c
- SSDEEP 12288:2hbHjfXQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2hbHjPQyxknw4FYnshx8OfVe247
- TLSH T18965117C27ED20D1F175A17A86A28206D331B8651B3193EF93A5923E9F32CE45C39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 5732ea8eda80b76892946fab000f2b9ab8b2eec49b309df36faffb60e9268016
- MD5 8204b5b1561773823761833069fdda42
- SHA1 2e50e1807e861be57727a04eda245284d07fa265
- SHA512 0059a10b6b08dbab4b67c2566ca7ad392c883c93ef270726055c7493dcdea34093b0010c3ab5c8234e6f355ec8fbdf725471629a4e5b82c4fc5a0a9e05e0ebf9
- SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/4yxknw4FYnshx8OfVe247:gIgnaTk46pBR/bx4x8EVep
- TLSH T15F45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 5f1c95137f2c0b139b4aa048f590c4ad5c77a9bdd0b8550fe63d61d9ff5cc7c5
- MD5 ca9b4253ce53fd133af0118fbb52a371
- SHA1 bd41d42fa92cc730a066eddc5f79f25c8258138c
- SHA512 6af78df60b1af4f05a1f9cc7533a531da2581768cb857140779437f72fb7068fb6848d428c3158094d1c480edb918b836d6bd92f92325be1ee6c13a9a092d814
- SSDEEP 12288:/X+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/Xyxknw4FYnshx8OfVe247
- TLSH T17665237C67DEA4D2E95D15730A7262263605B2A0EB7182DBC77DB10EE1F0CE0A03E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 58c547db7bb1642078f717508c5c52f149aa6dd2296f22775e3f0e5beac796bd
- MD5 1731946f4999ebf74271aa7413fb4678
- SHA1 4a5b087d6c82956f281dd5fc0b2f9cafd8ee93b4
- SHA512 bb4c98741e41a0e254d4cf58e99ad7267088df19f4fb8abe662386bdcaf51d2b3b49d0a806125e31a757df9668fc94e2b038410e9c564aa1d36b37ba3ea979ef
- SSDEEP 12288:WOb6A4LWOsvAYFTm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/CL3UTmyxknw4FYnshx8OfVe247
- TLSH T18C850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 552fdb2aabfdabc7cf0cdff991180884aa81d7cdb7bdf66ba18f06cd002d5511
- MD5 1965fc61f111a5b421d953bc300a0d47
- SHA1 5cda416d06c56bb7196ac6b9b3efd87fc9a8a9aa
- SHA512 0e5250ab1f789cce154eecf2d4c3f5eb29b2dde27a83ed8b5926576d5da294e524d62b018e56a0afc961ff9fc9b5ff0ba0cec8511ad6e88c9498b2773160644c
- SSDEEP 12288:ypFtkOK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dOKyxknw4FYnshx8OfVe247
- TLSH T16365022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9d8a621ec48858981ddb0f51f2671cc34484da034010300524f272ade70e0930
- MD5 c7646ec7ea58a901a6ba81e15e3caa48
- SHA1 9c2787522b93b89108c950c2e7c4e2826a859409
- SHA512 865436ca39344a93a8eeeb212367d14ec57981d82fb5058bda983bfc10fb39a9983f9655a780aab46e449eb46bc304b5c3a5868a06444a0062b2735850120c4c
- SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhsTyxknw4FYnshx8OfVe247:H7cBWMpPjN8DbEhzx4x8EVep
- TLSH T17B659E2D6BEC81D5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 7322b8cfb78b6068d8cce249573b02a35e5e571059981301d050732c6fe85823
- MD5 c315e9051861b69e290c69c5370490dc
- SHA1 53795eb0e937210e4fa8744d97baf81befb67e1a
- SHA512 0075a462541f5a8e19f7f19b0c87d73be1167a06919a891b3404c3b367ad7146b9b625566c799e289a0daa539226a7603555b2beb79bf36054df2066272ecb46
- SSDEEP 24576:DW6BApg2YuyuNDYTabvcdvNYf8km1Fyxknw4FYnshx8OfVe247:DF2YuHNETovAvNYf8km2x4x8EVep
- TLSH T1EE858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 b038bb60275a3e198126744479cc12e9412e15c9522fd69e1b01e1c50bb69f85
- MD5 a56b8e09f343bdda97d1203ae796e450
- SHA1 e36dd1350c81d1622c02103ea9b6d51b21e91eec
- SHA512 2d7f474622f0afd70479322aeb050e073c864ec9101e8d073a2ff862e21927e254938134626a2d3d41b9d3360784cdedd44ecaa28717ab04318ea645b1954392
- SSDEEP 24576:CAFs06+Omlf3NXEbToeyxknw4FYnshx8OfVe247:7Fs060lVXucx4x8EVep
- TLSH T10A65AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 51da5cce662cb14884e6c3d5bc6e05d4dc8633d5d954cc625c1e254cb32a73e7
- MD5 1814030756e48bb016c5400151cfabfa
- SHA1 5bf7b7a507359dd3a6dd311aeb0991d51db5036b
- SHA512 523f02609f26c8d5479624f707fbe6ccebf21e0bb04fcf9732a189d6c6a7ece7ac31e4944e1dc8f9b9284e7da820a633b06b9dc464c6a9d820524343c468b4f3
- SSDEEP 12288:rCJnJ5D3Vkr8zxz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mJnJ5D3WoZyxknw4FYnshx8OfVe247
- TLSH T17485D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a2751cbb6d3ffe14d7bbc6aa4c8a516002c87d2a1770dd03d046f010fb8d1fbc
- MD5 7b8e9d508c1f663262e68fb6bd2e76f1
- SHA1 956b910a98ae44e912a69aebf4344f297f1a993a
- SHA512 97e52f343c3ce6ac5099f0732b58b80b3e7add89224b44bc36c439998d8993b8071e31bd5d0f06594d7da59721e43e25308abf17a5b4470457ed29f0c9e90491
- SSDEEP 24576:IEPghm6/7IIXdwcXrif7qQncjlP65i3Vu4yxknw4FYnshx8OfVe247:ng06DIKdwc+eQnSt65aVax4x8EVep
- TLSH T116955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.4MB
- SHA256 0272d09235485ff59583a79eb5c4c0727f24440de51383d37ece71332439c104
- MD5 7cd8e97cb7e09322c65b476b25c39472
- SHA1 b0c0c0cbc3032a4c68b474e39d978b7ab36adcdf
- SHA512 917239f1736a2e83f6e51d568216cfeb1d172a4b0ce43baed4a792e1e7212dfca1bd409106dd5fbfc0338983e566a27970a75665aad1762de21b90d4d9f3b670
- SSDEEP 12288:UEP3RMd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PMdyxknw4FYnshx8OfVe247
- TLSH T15865126C77DDB0E1E52A503A86A18205D372F0706B6253EF87A5D23E8E72CE46D3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.5MB
- SHA256 c67037e6e40182f4173c04a5d3ebdd9b78f08a3b8c82af85f4c787ef809afb3b
- MD5 4842f16b55659d144244d66d93002c05
- SHA1 859f5da50fd90e3150cc658d543f307a7ceca6de
- SHA512 f06d9e7ac491a95383d135210b4265c6006b36829581dbd44583347bc40cb36f8a67d67eb612ebc793a111af21d56a1f18d74ea9cdc7a98f18105b7a61ec4576
- SSDEEP 12288:5jkyA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5IyAyxknw4FYnshx8OfVe247
- TLSH T15E75121C63D8A0D1E5B905369A7352A19A35BC709F3193DFD290F23EAE71DD0A839B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 39afd1b5b254aef1b9b6822f2f1544d798b51d0998f73d95cce54b86b4aea18a
- MD5 fc5742fb60af2e1448d37955acc3a06e
- SHA1 ad930ae6234732bc7ba85f54fe1e2ab9d7f9b8ec
- SHA512 f41d7cbb243bbf393bafb1632402ba3f8bbd42cfe903c126dd1430c040a2f32d5d83cd50dd243583eece12e678729fdeecef78ea05bf20cdf9d1d66c03943f3b
- SSDEEP 12288:fG6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:O6yxknw4FYnshx8OfVe247
- TLSH T10765236C67AAB4D1E91901734A3163626215B1B4AB7191EFC6F8F13EE6B0CD0A03E953
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 f29d742305cd7606baad9801d351c19c9183545992c5c6e342dbc1b8e5d9fbac
- MD5 e221fbd794c7003914b22d0bb95c3f04
- SHA1 fd02744ade928e85bfb826c90d4db830d37357cc
- SHA512 7cfe6009037f74f8c788b23c5318e06ead1de1dbafda918c708211dc14925911d1783837f211d6a44450f7adebae1e2abadc50b6695b68904429ea5ce40d6c89
- SSDEEP 24576:+Q9MxZKdcz9dw3Lyxknw4FYnshx8OfVe247:+VKZux4x8EVep
- TLSH T11A558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 fea0ec50795a4bd1603d40ce1ebdee1ae1b4324f80d1f4d535cfd3de8b099da4
- MD5 3b14f8416fdd06aa87cbab78d819464f
- SHA1 9abd0b5f5de54954048f16438132f79ae3566662
- SHA512 7aca9407d6e17125c2c782e4cf89bb1aa7eedb980a617feefd202c02fd1718b228815b74f5e40a671fde1febaa4e53e1445e8a25bf33cbdd78159ad32efbf368
- SSDEEP 12288:JyoKo2SRple9pU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JyocgApUyxknw4FYnshx8OfVe247
- TLSH T1BF75E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 a18acdd0f9dba49625b0699caa64133301efc3116dc43394d17959fb8116b809
- MD5 d61a36317cab662e51da459fdf5883f2
- SHA1 9ad6e0703a3567347d8960d8ca555a1f76687b7d
- SHA512 6c86b619f7846281a70f63481179e5fca6a1a8434cbe4da542be25252b61cf9bd336e570995dc1413bed3ec58bdbcddcce0f80b867fd97686475980e95873e3d
- SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKvx4x8EVep:E0zuNIZix8EVy
- TLSH T1A6A57B3DA2EC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3ae669dcebdacac53fdcd9c29466ce896b90381fdc426496e52321ac37efa414
- MD5 c8d30344e39c2fc8e2e4c9e747be849f
- SHA1 948fa78e539e42623fae99e726c124ff0b3ef539
- SHA512 d89abe386808b66db725bb73e7cfbccbe399e8851ff4bdc4f209408d6e9de591e232c1f9f8313d5788aa614df2ed443d90a939344b75ef28039549490b9fb809
- SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYtjMqbdyxknw4FYnshx8OfVe247:zTDxR+N5YzTfjMFx4x8EVep
- TLSH T1D455B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.7MB
- SHA256 99e2d0e42757385a56d47b309ad5bc649b0e879d2f747130ba19023c36b05af6
- MD5 bc61df465f73d7d8e16505b7433cc0e6
- SHA1 de43f6fe0d567f2e2c919337d7e4c3893b5a9e68
- SHA512 252a009243a9e5c0a5f382578422e5ce6b2af871f95b7539e48f1f137d04f7a38ff8635688106bf518e11da5b60b571894f89cdb1aa7970b16f0f60b4cee4b56
- SSDEEP 24576:6TMdOz0FFS+7mSLxyxknw4FYnshx8OfVe247:W0K+7mSL0x4x8EVep
- TLSH T11E85F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 04a7842b019e9c17ac3d2bd222b8f3e35acb27daf2d01b2c7a366647e7525df5
- MD5 0b642d97692523552b315857bf6a75b7
- SHA1 9d7107c290587cfa2d43ce1da9f57e5390aca76b
- SHA512 809860aefac2044f55b5deaf130f17ac743582c289450e9d4c56a9b649d0fc6b47656fb1b5aabbc00c9a14ef0a0e6decffb9cfc6b1e65a132feb31781e20ecc2
- SSDEEP 12288:Y4pm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1myxknw4FYnshx8OfVe247
- TLSH T12E65122C23EC30E1F46A52328A3252169631B875673192FF6AE4E17E9F718E4D53DB13
- MD5 SHA1 SHA512 SSDEEP TLSH