Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/07/2026, 12:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe
- Size 1.4MB
- Sample260711-pxmapaay5k
- SHA256 575caf1eb225c02e0bfa8c58721690d051a97ba4cb87d5ed60a33ab68db65510
- MD5 a91298583b4e872b7ef42f993f2bee5a
- SHA1 3cad6dadefe056f1bb9fb4386e6eacff96f718e3
- SHA512 52fc2a248fe065618efb3d57dc97bd1a3ef793259cdaac9ee89c17f1d0e6513ddb1e7d53eb440faf8b6316c950013e9c9edd5f007882f55357f28bf78b8698e9
- SSDEEP 12288:LAmZXuYpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LAhYpsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12465E06A7A5480F5D0614D308651F66DA326BC29D8134F9B32917ECFFFF29D08E29A31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1652 alg.exe 1248 DiagnosticsHub.StandardCollector.Service.exe 2900 fxssvc.exe 5948 elevation_service.exe 820 elevation_service.exe 2700 maintenanceservice.exe 5640 msdtc.exe 2040 OSE.EXE 2268 PerceptionSimulationService.exe 2748 perfhost.exe 2652 locator.exe 5068 SensorDataService.exe 2064 snmptrap.exe 2532 spectrum.exe 1604 ssh-agent.exe 5756 TieringEngineService.exe 6116 AgentService.exe 3240 vds.exe 3560 vssvc.exe 5764 wbengine.exe 1864 WmiApSrv.exe 3336 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a821a45b5a3b5d25.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000276e97c83211dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021f7a0c83211dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000102eb0cf3211dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000510e57c83211dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ef2b4cf3211dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f7e80cf3211dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1248 DiagnosticsHub.StandardCollector.Service.exe 1248 DiagnosticsHub.StandardCollector.Service.exe 1248 DiagnosticsHub.StandardCollector.Service.exe 1248 DiagnosticsHub.StandardCollector.Service.exe 1248 DiagnosticsHub.StandardCollector.Service.exe 1248 DiagnosticsHub.StandardCollector.Service.exe 1248 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5636 2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe Token: SeAuditPrivilege 2900 fxssvc.exe Token: SeRestorePrivilege 5756 TieringEngineService.exe Token: SeManageVolumePrivilege 5756 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 6116 AgentService.exe Token: SeBackupPrivilege 3560 vssvc.exe Token: SeRestorePrivilege 3560 vssvc.exe Token: SeAuditPrivilege 3560 vssvc.exe Token: SeBackupPrivilege 5764 wbengine.exe Token: SeRestorePrivilege 5764 wbengine.exe Token: SeSecurityPrivilege 5764 wbengine.exe Token: 33 3336 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3336 SearchIndexer.exe Token: SeDebugPrivilege 1652 alg.exe Token: SeDebugPrivilege 1652 alg.exe Token: SeDebugPrivilege 1652 alg.exe Token: SeDebugPrivilege 1248 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3336 wrote to memory of 5740 3336 SearchIndexer.exe 113 PID 3336 wrote to memory of 1624 3336 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_a91298583b4e872b7ef42f993f2bee5a_icedid.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5636
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5588
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5948
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:820
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2700
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5640
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2040
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2268
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2748
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2652
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5068
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2064
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2532
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1604
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5204
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6116
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3240
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1864
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5740
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:1624
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 144a3e530cb837920d963fa5570cc13d860395ecf24b8b1bb0a9997bd4399b4d
- MD5 6d57f4dc6cf18e2dc91e3a02a0f80b00
- SHA1 829edd811468a80af4468c2a417274e7095c6fa0
- SHA512 5d12b8cda9ef47ef6cb6f9a56e5febd4c00cf504be689108bd2ce3dbe34b109ea0df4a1b2f4c7114900775a0f22bd5c292edd1c43f8ea338c15f38010018ce3e
- SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnMDmg27RnWGj:L3q6sjBPD527BWG
- TLSH T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 7eb63cc65c41ccc66f0f1e66f85074297fba21481650ab730040706cba6d6fad
- MD5 3ae9648462ed98b6de1078ea6c8ba1bb
- SHA1 5bc9d1381ac565976fec1b2339945a3544369f32
- SHA512 2357e32030f4ea873f7eb7b654053087d05faebcf9545e103ffbd1cfabaced81667754d096f1b5ade2f6a7b6a72b4614037a8fb6292f164516c479c617ab7849
- SSDEEP 24576:cXYfDtczAfsqjnhMgeiCl7G0nehbGZpbD:btcSDmg27RnWGj
- TLSH T1F065F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 b298873bc6252b4740e50998e66abcb127c170822ec8e8f90f3adb77d18e6c4c
- MD5 1fe6f57a44b17fccd8b38674478a5bea
- SHA1 f1cfa35c3f2a66ee5c4a9072c77e95e34e2d8f1c
- SHA512 0ee8c95b6b0c0e1065aa7411d262adf5bd651dbc79d36d84459a871102ef1da0620fe8d5fc05fd981bb134dfc373250c2b1af6a012101ed46abd742cde84fd6f
- SSDEEP 24576:a0Le5ji0hmxxrMIsqjnhMgeiCl7G0nehbGZpbD:aPji0AjFDmg27RnWGj
- TLSH T167859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 2a55da70f302180a7840610061dc68e370b791dee879061cdb216438a77d438b
- MD5 2a38628c939296eaca80acb1318862b7
- SHA1 70b9b4d2ea88df2fd106969afe60a023859fb56c
- SHA512 3f4a003fb3c120ff3ca595dae7b40b1879d38510d3dbb856f6ff0bb31b984bbce9b827724fd316ac66d2c65a8392d2d803daca1c6c824f4767211370045c73a5
- SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuOsqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPveHjyJDmg27RnWGj
- TLSH T14B755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 6afdb7dc6703949c4a9e30c6e875352a6f6645c540bf5ba4c3032cf0eab7042b
- MD5 3eca37f4d19e06b0aa8e936c5676dae4
- SHA1 4de86a102eb733233ec92df073e5075d3be1c9d3
- SHA512 705432b9b0df0d6bdadefb85ff19d61f54f82eeb0b4ef665b98ae435ffe78679f0206b1e9555fb510cfebb38dbce7fff674227cc5af07aec56085c9ccc02e58a
- SSDEEP 24576:UVbqPb88hv/l+YrsqjnhMgeiCl7G0nehbGZpbD:UVO88hXl+aDmg27RnWGj
- TLSH T14B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 27ddaffff4305b2e6069b797d02447307740769e56c380c2fbc9ceaab0b3d42b
- MD5 ca51fe9e74b27f7ba4a9c8ecc0b5814e
- SHA1 d070d636f780528a2a89589242b6bd3d76c57814
- SHA512 3af30c71451a2963fd9ec3676b0fcc15a6f00ada05982cd50175be3e9e467bcdbbf6f03455bf24163759bc8cbd4a0ad7bd3c11b2f6f03e66b4671267ed1411e0
- SSDEEP 12288:kLUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kLUsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A24523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 5ca6ce98d52a1d7bf06009e1d076bf7117bbe2d8ca545a5224d533cba03b9710
- MD5 73bf69f793e86688fd5dd065b0456a5b
- SHA1 133bc76b0fa6f5ba63ac26445f1016daa68ae087
- SHA512 4c42fb7ed6aaccf89b1e921a96f81456a0a11c978d9e437f560727633fb2e6e0723777b1d61411d0618ac3915549a1b23ee9f9ee7fccc1a4cefebf5d00834fc3
- SSDEEP 12288:oeBNUbTVO86UjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:oJIUjsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11165CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 08c2569d8ab353774500c1d3d7aa6916142aeeac55c0145a84e1429e2701e16b
- MD5 59961fceb4488689464dac927b17ef09
- SHA1 c3d445ac5a78a4a0a6cef81921da2c9efae91b53
- SHA512 8edb2e5928e93383f6237d46df424df166f759b196dabc91b5093bd014778fd81ba7aaf6657022a589ebb527265906e12d1b447dcf807c3f44f9a732741156c2
- SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH+:8QvGAdlCEL8c/DRNw5CyD527BWG
- TLSH T112266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 6335668b361b58b9cbb64a87069ea24bc78ccc6bef2984fc1e870b5639f2b877
- MD5 5d131cfe68197cccc29c03adca51f009
- SHA1 614175c24a750e3cf3293a50808d095bf0d06298
- SHA512 a7e876f26875be402a7d49153449b539da951da9ebd58d5e26254d72bfd265225b0ade1c0bae70441b95ac97bb782296bbb51a0cc21a299162f21cef65cbcb1e
- SSDEEP 12288:PAwSfxL/2Dc3RDLLmt0LDQewsAjBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:Y0ewsAjBsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16C75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 cfdb518b955b56712c39eb8027436d51722b01b8f5c6c580ffc4d7e386eb9cee
- MD5 3d7113d03a82def21090b3fc7c2c88bd
- SHA1 6532aa5912abed34f8d6e4115e324aaa6ada87d9
- SHA512 d9aa9fc5bce1cb9a65a714c21dfec99ae926a5b2738cc909b25c58165540f200118d233d2a39f9c1368dfcc07ebd0f8b82068bef30353f50c767dc473ae6be42
- SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtVQBWG:OUEtQevvqc2W1cpV2tI324B
- TLSH T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 4e3552d6f0e9fbd60d99d6c042b8f90d97cff655bba02d3cee8d3cb6f658fb4f
- MD5 838b2c360803c5369d36da8ea7e021a4
- SHA1 be792d337d6926b7c505d4c078148e923e84e61a
- SHA512 e185335a73f9178ac6b097aea3277d988acf884362469e6213c657c6426c56773e09acbbbbfbfc0533b8033d0de25f937708b4cc11b36b1e90ee2e87a6e1498a
- SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/z1Dmg27RnWGj:/oquVjnm2D527BWG
- TLSH T1ABD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b124925aef537ed1e138f4904913eb5263d6b7e670d1d4b5ffe607c40a91a3e8
- MD5 20671bde49f7dcf341fe30670a7613a6
- SHA1 75b23212ffdc65ae9ede6afa12d107e3f2f9d85b
- SHA512 df036883d0235a37b7ad5fdcb6c5ec70cc226b211fa8c469a2a3aa8bbd914c4af0eed8359a3f13868b392a69897c8827862e2f6d7352e3b19cc0c30ef2934773
- SSDEEP 24576:JAhGL3IFoiwtA5l7S53SsqjnhMgeiCl7G0nehbGZpbD:JAMUFoiq5GDmg27RnWGj
- TLSH T190359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 c0f64bd18e188da8f24bae9723e12e8962ad32bff6399b848800f56814cc6935
- MD5 878cf6f7544d78b57803c5d882ae284e
- SHA1 c8200bf68e3e2b99c3bca047b25671cfbfcb4eaa
- SHA512 2b5fae7d3ace092ae27191c39f79f63d2a9a5863986f402a5766b286050ff4336795c7e3f22ed9e05c107b932849d10b1e16e66bcde25d8fc568406d06addfef
- SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+CuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:rwu4OW1sqjnhMgeiCl7G0nehbGZpbD
- TLSH T12465F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 601c5424cd6f5392288c50fbafe9ade318a00976c839bf65a7c23023aaac16c9
- MD5 ab96b0700986acdd8734b491fdc7f706
- SHA1 60614281bc6ebb9b428fd4a2827b148cc6f3be51
- SHA512 9022cb8abd3f2aa5fe234a26121694a134f3815689413b48d1a0baa51e0e50c934ff00d26bd965e0721ddbaef143197e2e35c0f46028adce1cc8fc61a1905dea
- SSDEEP 12288:LeZ1IyRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qZugsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1775512AE239820FAE163417CC5E5D609EB337C62673043CF166256AA6F739D44E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 d92e3c380b06672106a0e6af9c9118c31ed8c14080349835d754ad6ae0ae70c8
- MD5 36ac7dd820160c238259f11ccce962b0
- SHA1 ff342b0ba474812f2e8afbf54924d82f59680c57
- SHA512 14cbea9992059aec2540070465558efbe58e3b34b3018ea4870697b9da142205090533d0d78a370d7630919e1b917fc258e681b625c3c6775088340200c6ff7b
- SSDEEP 98304:pQRQyi36YOcPbLvw2gAf+PN3rD527BWG:AQyiKa/X+PNbVQBWG
- TLSH T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 99aecbabc0523875b6783dda3ede0446a59bd2abaf4db1a186415d8c7befc086
- MD5 392336e1a0fb2412e59672db8cc0e588
- SHA1 10040ddab3a61620a940cb4936071574c0ecef6b
- SHA512 b210882aa5e56e7bc1e518cf7ecbe9b195230dc130dc3f19ad7b8f52f527e8cbdfca44670475d39c662461498b40344c462d6f4df7402c1ea067fcaf18ed1138
- SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3rD527BWG:oQyiKa/X+PNbVQBWG
- TLSH T18B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 dcc55c5bd42144177b4140a678768c960b8a79b3af5f2e66bf4936fc0182e167
- MD5 32f387e8924b1a389004736abfe98e47
- SHA1 e86b4904aeccc4498f411c9dcd8bada54430e6cd
- SHA512 845c520b44b8b55025629ef44cb21886a8e4bb36c7dca2466947278ca3e4bb89d1eaa4e5db834218e1ce5488c34152a5b051de3475722243a37eafda4b47b502
- SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0QsqjnhMgeiCl7Ge:l68Qg55nhceWu7PNU3/FDmg27RnWGj
- TLSH T12DB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 eecffdf8fb13dc11f90dd296d56d58b8a85b8e0732b848212e4fa818b2bf0843
- MD5 1c46f38e5bfbaccebadebc77c9933022
- SHA1 9f475c42cf74f1faad140384cc291d1f1d346024
- SHA512 89319c95e471337d17ad3633a742a0dedd59c11402dab3714d799a741ce8ef84f21c76ab3fe7430ec9bc13bd526c4e241bd317d119bd01a04e82ff05e8c87afb
- SSDEEP 98304:ny5112gYy5azzVvt69nLKnhZwD527BWG:6LIHEWhuVQBWG
- TLSH T1E9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a2997bc3e7868d1b095fe09603f517bd232769f1b0c810b0ca375f2b2f421f20
- MD5 44441e403a7161038989e418421182d3
- SHA1 6f5ee12765ded34bba80237a0d25a93827c38734
- SHA512 a812950ccea4f0d759b2e05978ec9cf03384d65a16b22896fe6eeb4c65d2baa4f544545bfecb5ffd963252a5c59a7bf7cb5718f96012401102d5beb59068715c
- SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glzDmg27RnWGj:mu6Jmdxd2dzD527BWG
- TLSH T1D2D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 264e5c278c35f5a6c8c06c0cea9dfae777c3570be7a7cd4218fca21c11b0cc19
- MD5 5e3756344c70c0f4668b67d884dbda78
- SHA1 88f37aac5df6ab884f7f89a8857f756913362405
- SHA512 2a346a7cd0a8e28cb69a5822cf57c361e55643e5457baec83861ceef7f716753efe4f36e40daa3a1afb14018d9dcc994b33b2e2e5951b9799a4608a34e79541a
- SSDEEP 49152:e1hpsNoJpF1A63U44CwH7R4xHDmg27RnWGj:emifPWR2D527BWG
- TLSH T14CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 97efb8558ac9295195ffa5934e784d46116040fb82ab6c20e42db89bd34bbf3b
- MD5 812ac28e576c950f5d96f13eb9881047
- SHA1 576c8fcbb7e65d900fb2a6172a49e31df168416d
- SHA512 913624186e62800eca22583d031236ee72cc5f82fad9a7914f1325de8f7986d8b6dc9be63de71bc719317264a6622e69c4a9d56da15c3359829e97cb7a843a7b
- SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHqcDmg27RnWGj:x5dKii61cD527BWG
- TLSH T133C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 827fbf0d90dd614424a48ebbd50d6d86c3b220d606c15f7c22efc58b12f04f2a
- MD5 55b4d7480774a845e56cf5261fe13f37
- SHA1 525c275f3e7bbf03a6792002e08ceb295a6f073f
- SHA512 79ed53c71c1976c00b7d019d41ae08b79701cae017d431c1d7bc9908b2ecf57233e620074a919fe40591b463cfad8d910f05570c3ae4b986000a25f652b9f0fc
- SSDEEP 49152:RhtSn8EApI0fig3giDn0AP5wDDmg27RnWGj:AX2imphqD527BWG
- TLSH T1F095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 c4facd17357653c2854f696e4a2a5ff05083b8281cc8fa4238590f178dcd8ef6
- MD5 f19991a6218397ede7cbf820b823e5c3
- SHA1 2b9bf7ab8671274b5f46d4807ad32a583fe1101b
- SHA512 dc48700b23ae644f2b5ebe5ee171dade2f76a02445c9607c3dd0a635e40eb0d4f60c6612d995aa0060ed9179fdca3de39409aa5961cc519045151243d46f96c5
- SSDEEP 12288:LMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LMsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E24523BF965C41CBE52609B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 3d318c959465a141739ac936bb1bd14db42d035192e3ccab026aa6b9475d1995
- MD5 b08cbcfda4673cd7011ff172d7ba8b52
- SHA1 2c6f9d5b71e3d8ad9b0b2d3707a9af5f02ac41c6
- SHA512 487e677126f6bdb891c2a8abadc5162a1742bb978866f6f3b82cfdb1ab5e8835977a9bdb2d0f43426ac4e3d8166a1af7b67820b4db4858c905cc8dbf99ddd5df
- SSDEEP 12288:89Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:89sqjnhMgeiCl7G0nehbGZpbD
- TLSH T18A4523BF965C41CBE52648B5C3E5F10DAC073E5BA92004937A977CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 71acca51a9c729982853f116b096c450150da86528795a1f6cfba0ac53559b26
- MD5 6844510b005a4560cdf4dee7fed30a10
- SHA1 1772030c64dc7cd462296f7089442dc65819f433
- SHA512 0e01b94d19b51e7ee2095583e6d675921085992eefd4788e4863f50ed4aa1e64fd5184f74c95d27ae4e05e920428bd287924fec86373337e32b5df9bb6745cd8
- SSDEEP 12288:ZbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZbsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1CD4523BF965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 345622c69d37b14d1ed3b3a3d312fc23281fee95d0ba209fd3262b6e3aeda751
- MD5 32c0177a42d471a628679b9944b8bbcc
- SHA1 bbd2fee52591e6ca7e37c1c6daeb46a5714206fe
- SHA512 2044ff1fcb8dd0e7acb91bfe3512c6d0885e9f41377bd20d6d65b48e5187e517ef053af704e3a23ba6b1b7114c3ebfa8524548060d23c934202ac407563a7963
- SSDEEP 12288:PVyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11745236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 3ea551e9d7121b3e6f56e1d200ba3bf9f843d28c6c87d1cd0a56bba8150f4cd9
- MD5 598e7b5576f21bd91edcbfdd626aebba
- SHA1 791c192965e3afbb93a71a2f528ccd5124f93160
- SHA512 c48551fa22a348d1198aec0bedd6b36ce02b7a92c6c5e483f2bd5b6a592441ffbda1b4add1cc5b491b40f460243d868f9cec5e3ceb45a789ea22f51d36dc6c39
- SSDEEP 12288:L6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L6sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D44523BF965C41CBE52608B5C3E5F14DAC073E5BE92004937A977CB9FBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 1e24bf2b72a38d66bbd82373372d1e761142e6e07bc9f6318276e00f3f0d6cbe
- MD5 0a8867ef39aef353ac348f225cfc59a3
- SHA1 b5277e4f0fa66aea1b7795cf003d8e03516763b2
- SHA512 55415ff185ca0097c8394308fdf2148af167a2b47f6bd7538ddeb7427412188babbb958f9cda16ceb21a1dd8d9ea06c91c7769e745d6ee4c84ce20db7ac13604
- SSDEEP 12288:E5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E5sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1ED4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 d07ba724a0132ec76bd7ab56b90a8ce2b85360d4f9a0d0937f9861e77acdeb62
- MD5 afa2765d5744752a55f2eb392bb34a49
- SHA1 071f892513cb933bd33ea324b4df09d3e35e95c2
- SHA512 c8e3208168772d5b1019dc35d5e2b898ebd4352a21c708d808d4010ed72d6047d8f1351711f23c12f0a00e2fc128ee89e446c7d45a5c879f5e6e4d7ba27480d2
- SSDEEP 12288:ElXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ElsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16B4523BF965C41CAE52604B5C3E5F11DAC073E5BE92004937A97BCBAF7B14684B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 103d0abc3cf3c724c64754bb999ddf32a358b12388b41256b37fb25feeb400d3
- MD5 41ac155e2d5f6743ecdddcaf3f36b438
- SHA1 a0cbd3e114c0261ce74d3d7d5e48becec4e92129
- SHA512 b58e6d34cdcc2a04bc1dfe79a61391be6a1fc3ab9c972e3703e67ae30dc4faa3c028afa36c5b4318bd6bbdda1fb424fc20a82be2b6a5f38952647c8527d910c8
- SSDEEP 24576:0ZMRzFVSOdsqjnhMgeiCl7G0nehbGZpbD:0ZMRzfNDmg27RnWGj
- TLSH T1C16501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 9f1de1b268fcf964bb0d1a61f0b7146766fa8b96174773a475eeb0a5a1f06685
- MD5 e2fe3846270843c76f0cdc1330287825
- SHA1 17b562ec285f6c6e5a2d3d7ce195114c6c615af5
- SHA512 f9be1c4c128c87c9182ea3b00031dbca30689f7750b28e41338c598526d08141050279ca18cd150a7808012dabb9899fbf2c08d92997af20abd7938add9fa96f
- SSDEEP 12288:dwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dwsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A84523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 30c037d5cbfb2b2ec3aa2f8ed267ebbe922e98a3d8aa26ff739541b2fcadd1fb
- MD5 0b2c4c68a4c774268fd76414c82a15b3
- SHA1 cb9444ef539b398ee9fb057b1865eb8a199f5a8e
- SHA512 f5e7c10513c36e7f6b6fa173cc6797a6201c33deed297dac5859b78c7d7ace9ecd19f002658e6abe72bbc3ef65d35d145d3e083b10d40042b60019e523e370fe
- SSDEEP 12288:GkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GksqjnhMgeiCl7G0nehbGZpbD
- TLSH T1F74523BF955C41CAE92608B5C3E5F10DAC073E5BE92004837A977CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 ad49c2c403d0185504a0b9564cbe0d858ccc7d0f38ef6855a8cc1a73035d7a84
- MD5 f6a25d050c735844efbf38b828385374
- SHA1 c3de874b25ff6e95b1dab3ea88119d4436ba041e
- SHA512 7c1b1678278a7e11ba5952a1f181a600374c6a87e679338f48cc26891f635cfa37605d5a4b9629e29b01fd82dd7292fcf783320189d47a9b18339c09fbbe973a
- SSDEEP 12288:0yPz5L8RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzyRsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1ED55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 ed5b34eafcb47025b72b9a5d7a0d94bc805d0ad56045fccac6a47d280bfa4e28
- MD5 831fbd71d1674780d719d95bdc473f79
- SHA1 e79bf6c0105e6cf350f8821a21757f9ed98140b3
- SHA512 47878af27aa305aa8ce2ccb2c4fc26e7c35998bf2019c06c57d84e9c773c3087186da346d3b9b532c0cb04b94545b0a4166bd6fef3a9bc41d3a77636032af288
- SSDEEP 12288:NwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NwsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1874523BF965C51CAE92608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 4c5a1df8c1f613a91062245aeb63b34211cb32c4c97e40052c72e5667f2eb10d
- MD5 f81da4e31bf37b1653254737484480bd
- SHA1 a23403b118b1b684febee6c8c3ff091178e42f24
- SHA512 c01bf497c37bf2af33bfc80c56b5d397eff21fcd196579fcf346bc255fd7373c7e3f427630555069277d9840ff2c464387c4b146423a5a8e0126e9b9b7d289be
- SSDEEP 12288:xwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xwsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1124523BF955C51CAE92608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 30917d1739f7832ff28189ac7183785db8cf3285b65821dba440b82a6d3fa675
- MD5 963fdea30a01574b60824a25ed51dec1
- SHA1 bfcb5f51f1453c70a969dced780d533d1286ae45
- SHA512 4aba807c0ce9aefcae7d26a5f99718dd35f9bd90ac9e275b7d185cdc1f26f8481ff8578c5cff56908756bab78411ae40bbf26e95bc56c68ad9510572044b6cdc
- SSDEEP 12288:xyPz5L8RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzyRsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A555125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736904E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 4c626c0240b30c1104adfda815d59ccdab25c833ecda427dad4f1c7b184d56e5
- MD5 e3e215a875b1237620268e019212d03d
- SHA1 09761288ac2221fd51db3607bcdbcab3a465087a
- SHA512 9e605a2fd9a8102497dac26e341d34860fab65f248aeb8b896335b950848210f3a1b8f38ae2b21ec1ce23afac66b2503b6566e10736b41385f9b623deba554f2
- SSDEEP 24576:1cP4mcvIjkGOxhKP2l71SNKbrh/8KB4sqjnhMgeiCl7G0nehbGZpbD:aP4m4IpOO67N8KyDmg27RnWGj
- TLSH T15E65BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 770ef4fbae958226eb1d7ad509f9562d15f9fe5c8efffe0af4ac4a2ea1101b8b
- MD5 30c4aba2d404d681311e5b8e368c8871
- SHA1 8330755a426dd69ba82b84e8132199fd77e5bfd9
- SHA512 ed4044d0bc7d593c517367476b5569f4493de3e5de4f9a1c1d96b44e46d6e8c0f90400fb624c8dc0ed467ac3e66ca65d70a400d8a5128cd2e1aabf564f908248
- SSDEEP 12288:bbsfgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OgsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1FD55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 d5d473ece1c9c108dc319d9e6210b4649cbf61d3d881bf548d79a37eaca200e3
- MD5 6955af3d12bad1e16019913c6133c3bb
- SHA1 ed3345e9e309d6ede8718807a3f8c0426818906c
- SHA512 ae6ef028d9d72070af727d08ec7fa1295d0cef1891a87983370caadeb72bd4c0b608a2b50893a4bcc9328bb75d78efb918bae3c4351b9eb7894a76531103eda0
- SSDEEP 12288:1AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1AsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19645237FD35C518BE57619B082E9E12D781B3E669E204483BA4378FDF6B08948F38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 3e4a472425fddc6347b3d4e1cbccab1eba3ebdb606dd87d57ee194a1a55ac3d5
- MD5 82ac5d6efe0f60e70f689f234185b2e8
- SHA1 67f54c17636f827fa397e20fd78f8501ca0e4609
- SHA512 bdf25ded676cacb1c9e4820bf21ca4e298c008d147e53766f1b72a037ff3abf849d6068e4fa5342878ea891b48b89ef452bf5a4c88cfa1fb6c6f99b3fa2cf47f
- SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQODmg27RnWGj:Sa0hNYG4JwtD527BWG
- TLSH T12D85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 de1fbc56dfff028925490ee750ef4ced1147828629332ade4dc6f592ba34f35a
- MD5 f49be3f98c73944ad4670bbd5c5854ff
- SHA1 bd36ab36a91cbe95c172694b97fdcafc3ce72385
- SHA512 7fded8d3557e3b23ff9a61c55ce3ca024e66cec6e3b6e8341b538c01a3ddc75f3c475b6a91d4fe8aff9b8016d9a611afee0d802203e3be05d96432f2a6a66118
- SSDEEP 12288:ehbHjfXtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ehbHjPtsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14055127E16AC20C9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 124afcdeecaab92cf21392b5ab2a561a8e5df669f20f113363828cf377c1dc92
- MD5 4daf44a77b2e9906f72729d8a8ca2f1c
- SHA1 3df90a14e537cfb10c4c6ac3b48b35889c35aef6
- SHA512 4d9084ea2e732744da6d9bde3320e54e1e4fedee74db6010e3729b272b15c6ba6138c2fd934abe8259b29ed4c0842a4e32ed3fe1eaf6825dca52147cbe869412
- SSDEEP 24576:e3YgnJcRTk4yti+R5dpR/1sqjnhMgeiCl7G0nehbGZpbD:eIgnaTk46ppR/pDmg27RnWGj
- TLSH T16545BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 a925001f3488b8391a38e7674d22fb437cdd745f78a52421074ff85737a1256e
- MD5 83eeccac23d76f50946cad9f1d3acde8
- SHA1 041a7bb2640b0d68de66a5fcdd06f92c145f72d3
- SHA512 b3ed57b722f8643ce06ad9d809d6bfd75ad85fa7f6c01b15f1bed5c5c00c7e9820532bc3a00ce0677a87476af232e950efc698bb920eeeb4390a22952985c4c1
- SSDEEP 12288:n0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n0sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1FF4523BE924C51CAD93649F5C3E6E11DA8073E56AB2004D379A77CBDE7B18E84B38413
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 1d22aaaf49dc898a7078184d068bd5bfb6f43711324d4a8ae0d7a92f983b5649
- MD5 fa25ac18d9d467a15f93af8ea81be9c3
- SHA1 58b5b6ad2cc876b04ff89f64c1ab47f9b1168b4f
- SHA512 a1827d39db03454b3e66c60d4b076ba5130744e57ebf9102642d3f1f6ea649a9a3c0118771bf3c4af2dd460394afa48e27944373fedeee60ca69062ab1f85eef
- SSDEEP 12288:kObfA4LWOsvAYFTfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:JbL3UTfsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E7750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 1de56fe1b9e07e086432de84523afea012036e00fd6f7e4a6abcc95af4a6e4fd
- MD5 6355b883aa401e113839df6587af8130
- SHA1 bfba202f6c859bee6ba0c63d30a7a60e8e0163e4
- SHA512 9cb69731f0b7b7e92fbc00aa6895e109ff2e08f2c1db82e3fec5ed449e6aa60035822d9886e6d2a0ad465179b992bf46833887d6d0fa812c620a7c653bea1741
- SSDEEP 12288:3pFtIODXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aODsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19355022E32EC10E9E536917CC692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 99c17b5e9647ca88e73c8a110fdd1d78d3be1cd4a11f0d6a29283609fab1eee5
- MD5 eec8f589444bb1ab96717773de397d70
- SHA1 4d881976b2bc44b12a1815174640260e2895eb6c
- SHA512 dec057679114a22ffe13c3f22a3dfaa30e605c31ed9cecefd5d5cb5aac6aba482782fc627e12f5ba56ed8c6833ab6d066bfc05a24f430cf12f4d45ba0b033c9e
- SSDEEP 24576:z7NM9YmZqmWMUkPjZM48Mv6bEhswsqjnhMgeiCl7G0nehbGZpbD:z7cBWMpPjN8DbEhxDmg27RnWGj
- TLSH T1EF659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 1af80bae7d68bbb24b1c7577fda69d7312b5731b7ea9aefeebaa2f2b2ab5e78a
- MD5 962b5d393c96090798a775ce6dc9b6d1
- SHA1 2d82a60b835f6748ec31926f288242676b60aba0
- SHA512 7563593978332d06562574dbc6a917c5accea7a2eb61db592fdc3d0bb99b746915afdac9cdaf7ad93c596cd14f33dd364c30f372f23493a92459c9b3a034fb54
- SSDEEP 24576:XW6BApg2YuyuNDYTabvcRvNYf8km1WsqjnhMgeiCl7G0nehbGZpbD:XF2YuHNETovcvNYf8kmMDmg27RnWGj
- TLSH T16B857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 5b1aa965dcbf3814020803a9654a649d241806e6f644dcacd2cc18582ab8f8c1
- MD5 1f70916a2923ffa263ac8eb7b33bf6ef
- SHA1 44f54ab0912de3ded2d1388bd9e08983e44e4ce5
- SHA512 4676baa9e210a43c92c5c005bbd0d4fe4a5e3fdaa345ab6590c703b733f23a987c81577d1316b11867e5a577e573969ea24161dffd0834efa31f98762f4d224d
- SSDEEP 24576:hAFs06+OmlfkNXEbTo3sqjnhMgeiCl7G0nehbGZpbD:2Fs060lwXuuDmg27RnWGj
- TLSH T16565AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 c79dabcb54b425ce435817cb5da5b23a745f1339f046a5728d0434b0d96fe459
- MD5 aee99d7ec9f029ec0bdd1af588f29c24
- SHA1 628a2299f6700a3533a6808b29df2bccd6e6e1e3
- SHA512 c9143aeda356187737a925245ceedaeafcbb46ff522276b47f58ad650e5b67bb874a2af1d040ee22c7c9249e79c156e8d86562396df8aa48ea465a00835958d4
- SSDEEP 24576:mJnJ5D3WtasqjnhMgeiCl7G0nehbGZpbD:mJnJ5DGtuDmg27RnWGj
- TLSH T1C875E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 11bce8829c23da144457bfc360eb79c35e63cfefbf0ef0d1524ab49a551c12d8
- MD5 3413eb8253bcebc19e2bee8fcf0d1bd0
- SHA1 2ffa1ea0986273980790738d6da02438159bbb7a
- SHA512 4fe01e2c76c35d026c5e6c50db526c278cd420e6899d38492cd41471f1b43c4b86d45f2338826364dc78487d251640df3e1fde7882f64527cb8084f06b802c27
- SSDEEP 24576:0EPohm6/7IIXdwcXrif7qQncjlP65i3Vu1sqjnhMgeiCl7G0nehbGZpbD:bo06DIKdwc+eQnSt65aV4Dmg27RnWGj
- TLSH T11A955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 eb0955748b75510b1c300b3a73e2fd6453325f6ffc313def8ef1e354787c209f
- MD5 55633b2f741e4861a7f30563d1a5a794
- SHA1 3e02b581de099349a2ec8e8ef3d83aa94a40164d
- SHA512 8b21e947050362cf6167bc5a3740fb7b7d05a39f9853436503ecfe120ac9e14522bad57b46924c8e59b0b5dd42436c55de58d5f395fab1647532a4a612ae3c62
- SSDEEP 12288:oEP3RruXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DrusqjnhMgeiCl7G0nehbGZpbD
- TLSH T10B55126E679C60DAD536907D8291C209D733F4716B2127EF2692C57E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 837e9fa3b1f71ad4f27926435097ce675c19743c5e47f28cbd07487de7cbdbc8
- MD5 567996b7c4dbe4a0f061c7fa916edad0
- SHA1 11fbedadd8276004bfdeadae480e27b41f038f5c
- SHA512 3eae393202e3f425248fffd3fe27289a93d76a6e812e7293a40efac1ca99631b607482643fedbfd25f9533b27647d6b15a59178565db691200f9892b15ff5e4b
- SSDEEP 12288:Pjky9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PIy9sqjnhMgeiCl7G0nehbGZpbD
- TLSH T179551219639C60C9EA760578C6B3D1589C36BC319F2046DF6191FA3EAF72BD48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 f4af9c7c3d26cf05f4334f38dc2799b1420c44699a3427c6ab7c3582e67dd0ca
- MD5 7131635d37bb63f39b8ac5408fcacb1c
- SHA1 5deca6888f51ecd17fda7f8edaae440472cb6534
- SHA512 4a515b382fef88f86af62d62944267c2156c8803310b17c39c0ce4485095222bed11836a6ad307e8ad1dd64c347b38f2d0d9b8328187deb1c5e04b0af861d5c1
- SSDEEP 12288:UFTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:STsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13745237E525C61CAE93605B8C3A5E21DA8133D766B2014E739E3FCBDEBB24D44739812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 c6077f1a9898db37b985e315165e82df48dfd3f0199ca328a68f75290f7ea235
- MD5 97187bcb642916a2e5ec51f54f54b502
- SHA1 65fbb15f6882d8a2c8e610dc50f41fa6a1e50933
- SHA512 74b67d939986469c9edbd63d192ac51c8355e7cde875366cce4043bc93081e583fba59cb3a27a9c4e92fb32ac10ddeee2af95b02ce756158a641cfca9c25189e
- SSDEEP 24576:tQ9MxZKdcz97w3osqjnhMgeiCl7G0nehbGZpbD:tVKXUDmg27RnWGj
- TLSH T188558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 3c4970b4571ec7a1afb12ea336039047c5ebb16184dd418cc610462ed2160a08
- MD5 28764e35657d45b85f350203866f5d59
- SHA1 dd3f40a37c49489ba393e0cd76576230f2286c10
- SHA512 c848d1b24e51e39e4b690d6c8dace1ede4097bbd0ef82baa03c2c68919068b95d73bc197b2efc04130cd669348925bc7b234e8eafad2ca6b975c21ca6af48f5b
- SSDEEP 12288:qyoKo2HRple9pBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:qyocxApBsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10765E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 ba481c900a42f36b673d898cdbcbfb397e58a6cbad2a6716a12edcf60e8b97d4
- MD5 50d39b843f3863bf3c07e8a67c2db116
- SHA1 6abf6719644c82eb8906917131ff49ff44dde27d
- SHA512 4660736a5d00c09807846599fe5d78452bc77c10ccce7f2f721dcf4bd5ab098b80ab1353b837c12737da601f7c716a0a1e1611c44eb5a8383aa0bde7ffdd8e90
- SSDEEP 49152:KWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKVDmg27RnWGj:M0zuNI5D527BWG
- TLSH T1DDA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 85a74d65e52acfb08ed24a234b249522f5965d3763ca285c2710e02c850b3699
- MD5 4c859c2f75a79452e5da368600d814ad
- SHA1 ae1cc56a1efabd40eb9291fa0b8247f06d2c7105
- SHA512 9463982cfa87df30452df2854251b3891435c23847a1907e20d9d8f9f5e4cc10bac3270c91c59b231d21c0a98c2a18ee5f784acec6fe7bd5293cb5099314d6ff
- SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYujMqbusqjnhMgeiCl7G0nehbGZpbD:CTDxR+N5YzT4jMnDmg27RnWGj
- TLSH T14255B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 75108e58d68601ff81c922c359cc6c1640bc2b4ac34e7411ef15f79fd868600b
- MD5 0aadc7942a5d902d31250f994b52c3ef
- SHA1 6d4ab5a011f4b5cc8137d307ed2cd018bd894fdd
- SHA512 0bb9f5c37af5c487d488aef3646e69ab9e9f1d42739983a47d3cd425a8f8829e1d6ccf3b5fd5c38329f3cf94cf05d83895b566427853d6975282a45dae29cef8
- SSDEEP 24576:pTMdOz0FFS+bmSLysqjnhMgeiCl7G0nehbGZpbD:j0K+bmSL2Dmg27RnWGj
- TLSH T1AC75E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE47A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 bbdcf46fd786850ab77a97e63fb24dcf09794908fc16c1bc6cfc9b06c8b6c395
- MD5 6f4d695fe3e5399a926c4974cc5f1794
- SHA1 ca4b496402d7bd23b69249cf1842e146727824fe
- SHA512 830620951d925a05623d003fde401580f8460707056bc3ae377dafdd1c2b3a7c6b277a28185c8251ef1246a36785207d87f2ff4404f28af74b34a996f096562b
- SSDEEP 12288:j47fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mfsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18755126E63EC20D9E4325574C6B6D1099432BC36272015FF39E2D9BE9F729D48A38B12
- MD5 SHA1 SHA512 SSDEEP TLSH