Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
- Size 1.4MB
- Sample260801-mvb1tshe53
- SHA256 6bbfe4a65e7c2cb6ede7383d2faed02c129893068a59d5aa98e80bea196e4c0f
- MD5 8a9d57c7d0d81174485c33901449fccc
- SHA1 5a7aa807f791591ddc43b35ecfe43d476abfcef4
- SHA512 5211de6fe40cf470bd6dcddab64b2b7174ca2f5e7a5bc3e4d50e36e37fdbe988c54cade4d22eefaa158f7f8cf03a250cef0484f90be8d455f061b547d3737a51
- SSDEEP 24576:RAhYPl11tmlNQ2OnBdFQtP51llPup33kT:RL11tmlNQ2ayVup3
- TLSH T15565E01A3A5144F5D4614E304A62EB6DA369BC59D8070F9B22903ECFFFF2AD14F19A31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 884 alg.exe 1676 DiagnosticsHub.StandardCollector.Service.exe 2360 fxssvc.exe 4156 elevation_service.exe 1760 elevation_service.exe 4136 maintenanceservice.exe 3048 msdtc.exe 3516 OSE.EXE 868 PerceptionSimulationService.exe 4972 perfhost.exe 1864 locator.exe 2244 SensorDataService.exe 4908 snmptrap.exe 1960 spectrum.exe 4944 ssh-agent.exe 4660 TieringEngineService.exe 1992 AgentService.exe 760 vds.exe 2224 vssvc.exe 4752 wbengine.exe 4244 WmiApSrv.exe 3576 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\836373562d44b5a9.bin alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe alg.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8d8de2ca321dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003634222fa321dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000752a0c35a321dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009672df2ea321dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ec60935a321dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000293be12ca321dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7860e2da321dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1676 DiagnosticsHub.StandardCollector.Service.exe 1676 DiagnosticsHub.StandardCollector.Service.exe 1676 DiagnosticsHub.StandardCollector.Service.exe 1676 DiagnosticsHub.StandardCollector.Service.exe 1676 DiagnosticsHub.StandardCollector.Service.exe 1676 DiagnosticsHub.StandardCollector.Service.exe 1676 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2548 2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe Token: SeAuditPrivilege 2360 fxssvc.exe Token: SeRestorePrivilege 4660 TieringEngineService.exe Token: SeManageVolumePrivilege 4660 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1992 AgentService.exe Token: SeBackupPrivilege 2224 vssvc.exe Token: SeRestorePrivilege 2224 vssvc.exe Token: SeAuditPrivilege 2224 vssvc.exe Token: SeBackupPrivilege 4752 wbengine.exe Token: SeRestorePrivilege 4752 wbengine.exe Token: SeSecurityPrivilege 4752 wbengine.exe Token: 33 3576 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3576 SearchIndexer.exe Token: SeDebugPrivilege 884 alg.exe Token: SeDebugPrivilege 884 alg.exe Token: SeDebugPrivilege 884 alg.exe Token: SeDebugPrivilege 1676 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3576 wrote to memory of 2536 3576 SearchIndexer.exe 111 PID 3576 wrote to memory of 1016 3576 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:884
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1688
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4156
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1760
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4136
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3048
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3516
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:868
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4972
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1864
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2244
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1960
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4944
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2728
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:760
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4244
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2536
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:1016
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 6eb9de16e6ec8eda6605e01af60134b24bf6ab29a4794ee7f831d0f96aba9d24
- MD5 39b1740a9abac1f3ccbb75122a659682
- SHA1 64fc2d2d5098e2a4e073f6e2602fce196d42aeb3
- SHA512 9e99b1b0a2802ec6281bb5cf41d458d5b7a3ad7d578deb63648b228e198379d2da6e6f1215a0036a533941afb4331ee6f94af8f858976049ececc77bbdd9f73a
- SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxne11tmlNQ2ayVup3:e3q6sjBL11wlNQ1ya
- TLSH T15AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 a07e9f414769b46bd5c992499d1eed77df677a0f13d9e9d1ecac57b2b997a8d5
- MD5 f15fee12a017144eac036fa8a96aea8a
- SHA1 85a223c2a8f1eab98b2b120da00a6e2c07bbafcc
- SHA512 08ca89d766350d4f276f3956767e1292ea1446ae194ac7104147381bcb128495c5b738866dd1a5d421fe32e098f89fb052f4206583abdfc1e082946b2bbf27d2
- SSDEEP 24576:0XYfDtczAVl11tmlNQ2OnBdFQtP51llPup33kT:ztcw11tmlNQ2ayVup3
- TLSH T11065012837E50CF9EC678278C8B2C511EA7378954764E69B03A499251F333D85F3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 c95c302b75b28978eb7816f7aa899da60403ddf524045af440bb6766b968d3d0
- MD5 3848d4f7d79bcbeb401059fae5cac174
- SHA1 1784c5fd91b1f2d1050c4f1f0c398fcabbbfdedf
- SHA512 ab021537610748af975b2257ed6d2658016ee46adc6f74516de24b16f46b0293966b295b9b4a393710be835bd7c68fcb93b9274c16051341e9b28298a979b4ce
- SSDEEP 24576:+0Le5ji0hmxxrMOl11tmlNQ2OnBdFQtP51llPup33kT:+Pji0AjV11tmlNQ2ayVup3
- TLSH T16F85AD25F6748731D073C0B9C5D2A69AE97230865B3089CB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 377bbb60ad107017d60b39f07a66be5e2bce1d5fb05ff5e63fbd3afebce54130
- MD5 ec37fc3ec9ee8ea8ca4b26ed3dacaad6
- SHA1 359bd408c21362483ad585dbced46a58f84d2df2
- SHA512 d54e4778a7cd4f147d41885cf02fc82d54211bd1b9f4eb5d4d5a8b63367cdc9b235d197a19cc208826f8e8933230b4f6a16ff13e82fd462fd8952341eb05b551
- SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWn6q8wyu8l11tmlNQ2OnBdFQtP51llPup33kT:L/ezSC6vUzPveHjyJ11tmlNQ2ayVup3
- TLSH T1F5756D15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 e11d318368a37e2da9ca9f8017ba085cbc2bedfecb91118b8ae2a62744609c1d
- MD5 7537e5a2fed36d89a60bb89e1ce57824
- SHA1 ec329d2c10d2a9f537d11017363fd54ee71ed483
- SHA512 fb650c9c68703cff68d41b036a067cb3a0ff45f6a278212ebaf2c13518581460e15378c2a42950e6e06ea8696fad3e62d042a3b3c223dc3ca832a1f1193ef00e
- SSDEEP 24576:pVbqPb88hv/l+Yhl11tmlNQ2OnBdFQtP51llPup33kT:pVO88hXl+Y11tmlNQ2ayVup3
- TLSH T11C559E65F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C2E677E6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 ec65f39aa21e6bc04c763a4374f484aaf2c31fc76539f17c4f8948c65bbcfa4a
- MD5 960df218a2b6d3b3a92f98b23d03d5b7
- SHA1 cd560d6a77f74dcbc46b41fa59e396e5f27a53b2
- SHA512 17992449c6347802882a447cfc7f64cbfd4a4a901a695f07c4d9eabeece91279cad87d93b26722aa010ac5692aeb5d385bb246b67f6cfbd1cc654b3eb361ffcd
- SSDEEP 12288:dLalnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:dLal11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1C945230414661CE5DEA74B7060B38ED1A9EC6CDAFB8E24278700390916BD77D935F3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 7e2a217f69b5bd61df7a8c12ca2a4d1ace3506743bafb9e374b9ae2554984e27
- MD5 1abf8e728d8be2274f1d9ac8c39c627b
- SHA1 6a24ef30dc0b78948a8c6acb783cb54c0c2bd8fb
- SHA512 abc25a4c930c195205bf15aea8973d415023efde640d06c2214783b92f3ef5897eb77779435d669bf423342acb9b05d65ec13b93ffd3f742141dce87dc784bc6
- SSDEEP 24576:TJIUpl11tmlNQ2OnBdFQtP51llPup33kT:TJIUj11tmlNQ2ayVup3
- TLSH T12665D03BAE28FCD2C27A4DB85691C740D7B678714F52A3CBD124820EDE235E45E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 9343a66017ea7715402ef67ba3741548c280b6432964fb309b9ba2f7c1c407fe
- MD5 5764e6750040e479037328fdf28e68b6
- SHA1 96f0119bfdb8931d10411ab9536e87aabe14ccea
- SHA512 0aeedeab4d606fbaa3575fabc67ec496c4b9b5509b7288a5c834e74121bfbaf810efd5eb9eb6c93c38a196fb2dcda47223e6152491da2f2105c217fe9fcd93ef
- SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THN:YQvGAdlCEL8c/DRNw5CQ11wlNQ1ya
- TLSH T1AD267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 331062b7869467b084aa8c8d74b15ba20d61c662a82a4b2946b3f7f59a8050b3
- MD5 6b40dcba5c9e8d70aa499e3824c8edc3
- SHA1 93db5bb1b4506ffa26eb66003ba31f6bac8c2066
- SHA512 0b46775ad8dfb989812d91c82cf986fc2b9b644ef553e8fc8c924039bd0c477f4733cb28a18ec1dba81f28c9f7690609e55bf846278c48d77e4a0d6701df9bc3
- SSDEEP 24576:K0ewsAjHl11tmlNQ2OnBdFQtP51llPup33kT:LljF11tmlNQ2ayVup3
- TLSH T12B75F030FE74E436C6BB0DB21B36C716187CB9604F5219C3E3A85E9E59742D2237AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 acd93a3743702496730e63da26534cdb5dbca9283074bc7bba306fc1a9068047
- MD5 a1583cb721d23d1c6566ff1b187f2076
- SHA1 d4c9e564dd5e79f360e95efcd7dab119884f0b9c
- SHA512 8a4a49e2b428717819346a905eb23f78dbbe68342b930cdb621b46e62d1e57dd6bcbb4b1106daa6426a540560e1a3cdbb6af2587c52af966a668fc287413d5af
- SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHd11wl2:nUEtQevvqc2W1cpV2tI32RS2
- TLSH T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 b41789c194c683ee61adad8003a497ec6466c7c7464e583fb770cdd782f89170
- MD5 efe140ab732023f0a3ced86c6fa672dd
- SHA1 c4f481a217c399fdd1e8273b435c1d737ce3272e
- SHA512 c1c5535ef26a6ac6bc25223cb5d2370a32b9d76e829612febc4704eed7f82b7179c2f713e15551739103c6ab6b4075361276b32683963b8f09aedc18e9a6173a
- SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/zl11tmlNQ2ayVup3:LoquVjnmk11wlNQ1ya
- TLSH T119D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 cb3c84268a4050d835d023acd7d8a2d0412bad88326c5ffdcfaf1a03fc948826
- MD5 a0600812ea3f2d40aa6addc9fbfff973
- SHA1 e8dfde77bcfa9e95a2c780efa3f27aa7638c8cd0
- SHA512 0027c73c8ecd121fd26c85d9912749989c755e87536fbe2884f72523f27b88a2a7db56455ab188f4ae1c634fcadd9fd9e63a6d515683bd0dc94bfd181a9c0261
- SSDEEP 24576:1AhGL3IFoiwtA5l7S53Al11tmlNQ2OnBdFQtP51llPup33kT:1AMUFoiq5U11tmlNQ2ayVup3
- TLSH T114359D80E7F955D4F5B3AAB899B68571EA76BCAA5E31C20F2110D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 81b7f42bd3608e321d759b4d2d398580819f5c9ef3b61d2d438e284800309369
- MD5 88474246073237d0101442b88cb97052
- SHA1 2d8a07a69c17771d19f7e5a1c5491d95e7a9c05e
- SHA512 6b2bc513f1ed862661a5f0cf42b26ae6d9009d0d6bf7ea27fabe03196205fd2520e9d6755cf152b3a641fe9ad65c03dcdb51dc193a291b3b23365a18c5b50352
- SSDEEP 24576:0wu4OWrl11tmlNQ2OnBdFQtP51llPup33kT:0wvOo11tmlNQ2ayVup3
- TLSH T16D65F14936A50CF9E9A786388597C536F7F6BC022A25D71F0720C61B6F373616E2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 37a3dd13d3ebd26eaa455f9a6373a0515cfd8fc0af4090e41a7c8ca230be7bb4
- MD5 d8b787b67bdf9646b5496a401f50b987
- SHA1 137e8fe5a3a54733347b2fd5cc0c660c2dae51d5
- SHA512 6473a195d2df08b69bcffa4e6657aa7d86ef8d63290e282cf6ea4b30542c238dcb1e2a941bb169ef80467d02e1333324335d2fea9b2a288cf665a18ff0358eba
- SSDEEP 24576:BZu2l11tmlNQ2OnBdFQtP51llPup33kT:j11tmlNQ2ayVup3
- TLSH T13555124822E524F9E5A3477898F28A45E7B57897677603CF0710122A2F77BE51F3A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e6ceca9002bdd75a14a8d0664ee4f7badc27f8ff86d835aef6698629fc856797
- MD5 f438aa11b51ece378dc1679456351b7e
- SHA1 add95127ed5c74f44d3ebf451a98fb886a0f3a1b
- SHA512 9332570998da38914b5f87de8ce65e1edbcbf4f9db7d0bec4bf78a1301c64f3129daa69664d261ea48b0cf0303e899515d2f8a994040c4a85cff0c4961d6c64c
- SSDEEP 98304:lQRQyi36YOcPbLvw2gAf+PN3n11wlNQ1ya:cQyiKa/X+PN311wl2
- TLSH T1D9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 6af4f3d351c88ecdf0f853f43b4d22439a872e7a7e8b2ff0c95cd7c9b08448fb
- MD5 b7a32e85072ae365c2a37e569744e5bd
- SHA1 92987eea03d11e86eebc86780469080a85d390d6
- SHA512 23269508200625f75c62354ab35a41e932175f22a70e630437c4be29c2c0fb55ea8de0efa57afed30d6486074efbd24f90b9016b5bf42774e41cff4dbea0cf93
- SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3n11wlNQ1ya:hQyiKa/X+PN311wl2
- TLSH T137667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 335a4d7a2d760217353e36404949420ec3987835516c800ee53ab22762009f49
- MD5 87462ab2d158a3df7e994317f49b38fc
- SHA1 3d5fda949de6006b4f50b6880ed1374c16ee0251
- SHA512 ae0b9f2fa3b1207965c9da1c11bccc1eb77192209e2d965f4e9ffbd1260804841ce0cbd7c01191e7f3bb5fbc1e9146bf0bd77c00a39c9b2d5f1e3587c0b9615e
- SSDEEP 49152:P68Qg55nhceWu7PNU3/V11tmlNQ2ayVup3:JthLRc/V11wlNQ1ya
- TLSH T101B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8511720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 cec4e3c55199f734ac379de26b5a36a7363bb411b93bf5de35d916481e110a07
- MD5 25f79068743d183d65fe97d6f4766a32
- SHA1 c591d8071d700bde46927af4e781d2a56523625b
- SHA512 b40b016b9bb4a42804d19085528e7a0dff7b9ac29da3030409e9208c036d021da6ef8abec5e0389a5c627fbed461fe14c8442c70e951bddc14af7aab31083615
- SSDEEP 98304:5y5112gYy5azzVvt69nLKnhZi11wlNQ1ya:ULIHEWh811wl2
- TLSH T12C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 c7aa283646149f14d25429ee43dba5454ffbd8433fb51b89d79052debb327adc
- MD5 ac63a35c532926e15262158c49151f67
- SHA1 fb2536b2de90992f50b617529e24cf8d59b2a47d
- SHA512 cfffb4bde2ccc4c2cb8e18fc5728be2950d417fd3251fb1f793dfc924a103501a36640f7ce4f2d44298da3d75db54095e2d8ad0674d4f06959cca2f932551cc2
- SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glP11tmlNQ2ayVup3:Du6Jmdxd2dP11wlNQ1ya
- TLSH T182D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ef1e334a806183f0218ce1f23b63f008131f0b00888cca107aedbde7655321ec
- MD5 6e7d30ecb1d3ecf005179c2242a4dc52
- SHA1 ced3d76f0820a97e026e723a90b739b193abd8de
- SHA512 2f7909762bd657456ab9b87f853987e28e1d0135e287a4522ca03ab88ab1d0940bfdebbdfba009d0f9ab63685248ddf3b5d3293cdafe0a1e788f63d242b5f36e
- SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xD11tmlNQ2ayVup3:kmifPWRk11wlNQ1ya
- TLSH T1B6B5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 b95ca820067e6b5bd649db63118b58bbf3fcca53693bf13a7553c5753595138e
- MD5 8cabe553752e4a22ce455ebf77ecefcb
- SHA1 7883028a4ac263a27317617f85f37dd8890c07e8
- SHA512 ee696266691baa044fb5232973887ab12a6c3967983aa0ae46f27b1d11000dfe8f4eeca6cf90e755a94e9df87a8bd8f98620bb037fda0957279bfc01b9a85473
- SSDEEP 49152:5SuZQIY0Be2KcRVtOnks6NMHqO11tmlNQ2ayVup3:X5dKii61O11wlNQ1ya
- TLSH T139C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 740219a3af7575ed4ed263275c999800678ed12a154736ff384cc98ae74389fd
- MD5 d2b65348b0651f7f0119cd9a7aba68d5
- SHA1 307c8d6be50d8f3a65ce5ae2ff7776de5ab31f76
- SHA512 7aa89bddf00e351795ed0317e0fe41640d91d7c90d49e6eea87b4219cac3edce09cede01a110611f7b216a00aba03ea88af4ece1202012c64e8a40d17aaa2cfc
- SSDEEP 49152:vhtSn8EApI0fig3giDn0AP5w/11tmlNQ2ayVup3:+X2imphI11wlNQ1ya
- TLSH T13195BE13F2D900E8D05ED174C7568632EA62BC160B39BAEF0A50B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 6234fabbc44b178881bf50f0068b5b542252ad9e982cafcc4b7130cf23c09ae8
- MD5 b86c7ccd70840b586fd0533f896c57c9
- SHA1 94a4da00cb33ce1237f93300c1c4f7f1036c63b3
- SHA512 fbeabce51e7d4b77601fa0deb068b76257d84bc92165db0db8fa7256c08828b43570f7b33abbd742e16632ba9295c5e3ba35e6bc68a0c5714fe16f81235b52f0
- SSDEEP 12288:GilnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Gil11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T17C45230814A70CE9D9534BB090738AD4A9DC7DDBFB9B2067970030156BBA7BD135E2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 23e97912a1ab6f27194b4133eea34566b1451f5a94fade0334841af47839d892
- MD5 58a39177cf89b7322fe4c2f4daca1718
- SHA1 d957df7e361a0a5439f3fc1dd7a3c4f8c3f338bb
- SHA512 b0ca3719b20bddb0d9149f7abc0f5a50c8efe80e1fe9d5978bf0b3cb785b7311d06458b79772fceee04b65c31ae76c8889879a9decd331ab84ce34df378b6462
- SSDEEP 12288:ODlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:ODl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T19445230824A70CE9D8534BB050738AD4A9DC7DDBFB5B20679B0034156BB97BD135E2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 c81be64892836b6137059ebf2bca4d22d516671f6c0e28529678d6c233ed4069
- MD5 83e46356e4af41f866fab060803b4a0a
- SHA1 41f45c8840948b0c4e746c51375cd0fb07024108
- SHA512 01f02e2e589a089a6eca3d95e2485980cd7fff73dededa4ee31748cd8cbe696759a5e09a3fa80833e0b3f604248e4fc4774de1266bd00ecb33bb3a41eb15dbf0
- SSDEEP 12288:dRlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:dRl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1E845230814AB0CD9D8534BB050738AD4E9DC7DDBFB9B20679B0034156BBA7BD135E2EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 f674d1310755b8e97a962a2df9267c767ed4f3fc0e0b608b909a8b22f4716053
- MD5 7206ec4d933e5d67f765f02b19b99798
- SHA1 eeedd4f810e5c5a217a33f96fb155e7b0d620161
- SHA512 65dddf23e1fa51b176e9b57a8c120fc2df35364cb4d4ced91fb015b130f3a774e93106dcb72bb637e7a5278786ccc664a89eb32d1dcce928e7be504fd9d95992
- SSDEEP 12288:gVglnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Zl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T16145230425AB08D5DCA3C770D4738A95E6FC7CDAF767206F8B0024191FB67A827397A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 ad7341620437d3bf0cd18c8db5eadb69f98f8fbed850984cf505d808a1810a68
- MD5 05470aea9f76320dbff1633a5fe3c287
- SHA1 b804cf954f7160d9f4bd80252debc0953436621b
- SHA512 2af05c8726b9bdc07f2400fc054e5be93f024412e6c638a57c367602d992a6652af10fb63a44cff9e4da976d04eacfb8a4b23e135ae646b313c9eb8afdfbb769
- SSDEEP 12288:cYlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:cYl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1D645230824A70CD9D8574BB050738AD4A9DC7DDBFB9B20679B0030156BBE7BD135E2EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 4690e7af90d5787fccf1f7b7a846e47a784619afbdd05835726097496f623cf8
- MD5 8f2133f24be6a9dce5bc657862cb997c
- SHA1 6bb3ecdf5f6a15058b5d1281dc1564b45618852f
- SHA512 fd2c2798ea62194ceccb89684d4c1b1122664aac6fe82dfe640316e2516ac391c8802e1a1af2b3cc626457dab35aeb6da6e87f89e998cc4a9bf5248c71c396e9
- SSDEEP 12288:6vlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:6vl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T19D45230828A70CE9D8574BB050738AD4A9DC7DDBFB9B20675B0034156BB97BD131E2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 5250ce46e76a6ba312eb50a526e22121cedddd0f5dfa687d9aebd58e44149cbe
- MD5 b3402e033f8485ebd84a6d763e5685be
- SHA1 8c532a7cac562a5c1850db2af341d6e16dd748de
- SHA512 3a359ac2ece12c455f67d4e15eff6afa80a3cfcf9e108fe9d972eb8e19bf9bc6be77f9e83c6b3eaa171d7aa9b199dfe4f270169df418b9a222fe8550ff1cbda8
- SSDEEP 12288:NblnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Nbl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1E145231818A70CD9D9534BB050738AE4A9DC7DDBFB9B20279B00241567BE77D231E2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 f411163506c7d7e0f648abba1d838c0d3f414287cf76b7d57059460639f11e44
- MD5 5537524fe4ced4824d3278aff34bbc1c
- SHA1 0b73d6f654eba1ce34cb767ef99ba0f347208a73
- SHA512 5a40cf03e83576b5db4f947859b1cb3a98524d1461a530a75f4320cc0e52ec2cf2c4312a849d85fc5ad7f7a8f9581d236351f3bc4f42eab3581a2bfe7a627aa9
- SSDEEP 24576:VZMRzFVSOjl11tmlNQ2OnBdFQtP51llPup33kT:VZMRzf911tmlNQ2ayVup3
- TLSH T16265029473901CF8EC67823AC8668916D6F27C5A5B70C51F03A436275F733A11D3EBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 ea155aaa0a93c35110ff0f9d5c9dd8bb28f09fd32b9dcbca19b70ae8cc7fda75
- MD5 3e591450e1ac4873e769c510defc9b15
- SHA1 1a7ac674a46ce646c3609de13ba8c5c3d4d1fe2c
- SHA512 c5c934766d585895e1a4999fb776d6c5c9497bc793ef322b257be8d970677f6894e7cdeb20cd3212632638b541bed69f0c028b49a98ec0b2caf09e37eb7456b4
- SSDEEP 12288:7GlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:7Gl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1D545230824A70CD9D9534BB050738AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 d4e938ad3487d8d197fdce79c881ea57579a2d72e40df5485197a3993ab6de78
- MD5 e193b2ff9fb9be601906d31d88684437
- SHA1 b0182d6ac5e395a9e8a2016f4e0e0faf8cb48e11
- SHA512 7c37767de4e5052958af7ab16c6b5163928854346728c2211a03ee557458fbd0bb1c34f654bd5454753ad44533e868a6831ee84fd2c3555c8745f6f522f9353d
- SSDEEP 12288:pqlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:pql11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1EF45230824A70CE9D9534BB050738AD4A9DC7DDBFB9B20679B0034156BBD7BD131E2AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 b98159511cbe56bd7659d8bb70fa230eeebb08e7bea2aa10edb35c7f829ee8cc
- MD5 a43127058bbdc12fa95c7144e0c08243
- SHA1 f9b4c1501b6157adc044eba140ba09db4c179a48
- SHA512 bc793209b8035ef11929d0340044eb4736685ce6dd693dda14a8c453b61e3ca0833824a8417c732614474009b1afe52697194873d79e2f841f91505602389c48
- SSDEEP 24576:XzyXl11tmlNQ2OnBdFQtP51llPup33kT:XI11tmlNQ2ayVup3
- TLSH T14655020732A630F9D4778234C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 bcd0e4c173dc1aeaf2132f718fd9e369d865c1d57b83f68e8629f3d37496c556
- MD5 dc9484dcae655067f197b6c95afb740a
- SHA1 280b6e1e84ce44e7745eadd81fa7c1771f02fd93
- SHA512 e0df8e2b2ebcc0fb75a761315f29a733bdb91dd6017aeb7f83b22dc34e9fb28400da141d3f1c30d7c5201a3efdf9c81507d1bd62fabe74fc04ee3831b6d6e856
- SSDEEP 12288:MGlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:MGl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T18445230824A70CD9D9534BB050738AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 284e3e6a01f4b23a39ee0f6b8fe8e55ae9c5410ef99d7e640c2cc88900129670
- MD5 7afe314caf924ff86f8b3cfa27a05e1f
- SHA1 9e56a071c3da1b01805fcd1582e46d6a6be4f59d
- SHA512 ba085877a61ea6ccb0e06dc093b068b17df3dfa1898e76f5e895656d9a89d432240c8cc2a113f7260a0399aef9918c32acda392f62222ea54cc2c767f12f02cb
- SSDEEP 12288:MGlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:MGl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T13045230824A70CE9D9534BB050738AD4A9DC7DDBFB9B20679B0034156BBE77D131E2EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 a584fc2f9061ab9816c682f46a7bf91358a54a3cc7a7c4d735007674777c932d
- MD5 d8261374081ff5cee25d836289e4dede
- SHA1 f5327a596a727b3e17e7a4900df959498c433012
- SHA512 27093025c03f17422a1e6538d81fee5656d91dcb26bac01a45b051ce25022ab18e8f310ec98d37b656c10ac0c27df19a96f239ae094cf62eaa54e5bb42a4c02e
- SSDEEP 24576:GzyXl11tmlNQ2OnBdFQtP51llPup33kT:GI11tmlNQ2ayVup3
- TLSH T19255020732A630F9D4778234C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 66d039cd3db7976fd6f83b864449759481e5b4af1f62ea06ccb18c37cb59d730
- MD5 e8064c1d49703308a118b85859e81da5
- SHA1 e34534cbf3c8b31caf41051dc75bfd927513ddc3
- SHA512 fb8affd78fe0291d8385749c8f893095fd9822f75c74154d9413f6b8cce3e266605080125d1ef6ad62b1b89259b3d163142e86f2fb80288719bcd7a3f1f8dcd8
- SSDEEP 24576:ncP4mcvIjkGOxhKP2l71SNKbrh/8KB+l11tmlNQ2OnBdFQtP51llPup33kT:cP4m4IpOO67N8KQ11tmlNQ2ayVup3
- TLSH T13565AE2DABDC0096D0BB917485668A49FAB1742A2F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 0d826ad4fd38f5342f73fa56ccf85512d20bb0a8fba52a62a322cd618f5e8824
- MD5 1bd05020da24f643e269be4cb31260c9
- SHA1 56df9ef46461f58aec0f0c7b4ccf3ae276a3a87c
- SHA512 b804a5fe0f51bd0b864cb5cd9ddb97c57bc15d0303f4030f53f266fad8facde89e55920847219836453fa03e77ebfcbd6907b35f68691892c1c4f96b39d9825b
- SSDEEP 12288:ibsf2lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Z2l11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T13F550108D29801E8C06F5270C7624A41F37B7C6697E292CB57C0F53E1F7A6A45EEA753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 c428f9869ae9bafd74711c8a98c00166dabefef9e91b1c93b7b9acd6ebd83392
- MD5 b395e103b9d0ec02e97980f4096fa861
- SHA1 a67940fce27428ae70f180735c607a7cbc687995
- SHA512 022dff0d822e6ab9be724134e47b57382c596594342b7955818e18781b7202b8642662a679b927172f402e96cb5bb0706342fcd3347745e4ce6a023c7bfe80ce
- SSDEEP 12288:HWlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:HWl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T18245230415AA0CDAE8B74B701073CAB475AC7DAAFF5A1057A700311926BDBB91B3E35F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 2604fc9d70042c0d29059d4c4bffcbbcda71ac01aaa2694588968aa9830c43b9
- MD5 f444b4a425867db29948804494080b00
- SHA1 ee4de9b63a23d0ab8921019a7a393e515af55bbf
- SHA512 512bac48eca09027e6dca1c8dc061e16f770b83c3f61e7a5a69911a4ce837495ac3be205c1cec68649a8d91de1589042d4897fa9d237b925ad5fb04ca8cdc30e
- SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQc11tmlNQ2ayVup3:Wa0hNYG4Jwd11wlNQ1ya
- TLSH T18885AE1D67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE84E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 bf48695e420796adde56f04504d0c50d78b86779cfc95bab75e3464edc60d145
- MD5 df865522438919066be7ee9b51041534
- SHA1 d4dc5c8859eff72bab8ecb7407805124cdc6a801
- SHA512 b814d5706d053fdbb3c65418bc63487039135c1d83e7f512709907234f5b0ed63774292d667cba0cc0511829122e25636342c4360218cff71a673eb3e9b0c24e
- SSDEEP 24576:0hbHjPzl11tmlNQ2OnBdFQtP51llPup33kT:0hbHj511tmlNQ2ayVup3
- TLSH T10A55123D16AD14D9E572D27890A28646D774BC66271263EF1381813D0F3BFE81E39F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 5c95cb135aa46302db2349adc3a18ca6802cb36056f5956fc5a2ae680ca0a6fe
- MD5 e91fabb23e477aba811fb2693288ed3e
- SHA1 9c2573a994308f81e358c010b677924c98f93ecb
- SHA512 25308ac793806bcf6ee646aa5131affadea0566cac5bc48531a6559abcd04158af83dee50f55dbc8727b05723cf310baff5ce85500200f0b9e98e73b70a2c814
- SSDEEP 24576:j3YgnJcRTk4yti+R5dpR/rl11tmlNQ2OnBdFQtP51llPup33kT:jIgnaTk46ppR/p11tmlNQ2ayVup3
- TLSH T15A45BF2DF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 0d04aeef150c5a1392be4cd33d44ea5f0d6efa1b57489dc4fdeef14768a8a9b7
- MD5 93c96bc52a2b68ba18e473176c2ba487
- SHA1 d8bc205dbe9ac0bb8523345124ebaade468212a0
- SHA512 e413a70f813d6a0951304d5726380b819041d2aae84e56e16ce8e06c50c3e53d51da705d2b75c288733ffc531327cdd03d2f2da13726a9586a7d96bda6bf8440
- SSDEEP 12288:86lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:86l11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T18045230814671CD9DCA78BB050738AA4A5DC7D9ABB5B20E75700341927BE7FE133E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 904c7979188294a4ab74d7bb5e43ff2c954477aa492e7a36d2b2487244334759
- MD5 f1b69afeb85c862d3b2a18d72bd2d50a
- SHA1 29e7812d70cd49e26a51f056ef1df2d96ad3ea04
- SHA512 6d5b9d0e7811970dfa798780623eec215033940a60af5e86df8fb938d6743e03c2a275dbf9618733f1cc1c9bd4196a29ead0bc974d02d25886834c96c4223f1f
- SSDEEP 24576:TbL3UTVl11tmlNQ2OnBdFQtP51llPup33kT:TbL3Uj11tmlNQ2ayVup3
- TLSH T18775F114E6A504F9EC77823CC8B38A16E2B2B89D1764E6DF03684A251F637E54F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 1800a5c8c12f3de2f42f809bcf5693f3ad99c3a9c753e6384f5294ea7b709239
- MD5 ff7683d2ae65af0e17af2699abfdfd0a
- SHA1 d0cd457aa3f5cec57c9249d3631ee3c400e1902a
- SHA512 82b7cacb07bb4a946ba8fc75f97a79a8affab6afeddcf14b5953a05a99aecad4595067cf01ab4a29cb387f113676fa3371ef104352f2c7a9e9dcd191bcff6971
- SSDEEP 12288:upFtIOJlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:1OJl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1CF55121836ED14E5D476923885938749D3B5B8A6172213EF0380817E1FB7FF86D3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c7bf5be7095bd186e9b94becd92705b81183838a54173ba1507ae2bd2e76b397
- MD5 f8bdf12e7615aeb4b62e4c98f1db069f
- SHA1 bf8deae69a75b5382f9fdfef7df1bf3365b0f431
- SHA512 4bd567f0e8a340804f4c608bfb0211f12ec9dc94778b0cea07cbe89489f698d0c302bd573b7ced3094fca00a68b26b50d7e15dc4287b26faa7a751203e48bcba
- SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhsGl11tmlNQ2OnBdFQtP51llPup33kT:g7cBWMpPjN8DbEhx11tmlNQ2ayVup3
- TLSH T195659E2E6BEC81E5D477C13DC9A28645F6F1B4611B318ACB1252833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 85e3f465b7138b8d8b9b5b6e125166ed5a5326aa41192ff2e20045b81ad2caf3
- MD5 7df2e008abb580f2d457ce8f35aeb1b7
- SHA1 67e141055e49bda9ba201c74f83d9c029d9db350
- SHA512 1d09b1a1e2d1204165614a29cd37545b2037138c7886cd418e63e0d7b34da7d867ec60c92a535a712387b8346bc72f04dd5bb47660d59cf7b77a4663f2babc31
- SSDEEP 49152:jF2YuHNETovcvNYf8kme11tmlNQ2ayVup3:S6tCf8kD11wlNQ1ya
- TLSH T1A2857E2927ED80A4E0BBD27D45B7D286FAB2B8551B3055CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 3193e4122d704f0aad9cb8add06d98cfd78ed022e59f83e887f8f64f49c11fb8
- MD5 81d2db712cebbb7b7e37d1aaaeda8628
- SHA1 49e11a0bd3743084df26c8582a00a15dc37723bb
- SHA512 d912833d5d85928406db82db45ccc7bd150e4af3a8b3c8fca98cf5c2742a9f43bebca7a2c31cf9c9ab474797e7876a4af344bb0a2dcd8f2dbe4878ae21d9b4ca
- SSDEEP 24576:dAFs06+OmlfkNXEbTo9l11tmlNQ2OnBdFQtP51llPup33kT:SFs060lwXu811tmlNQ2ayVup3
- TLSH T13865AF2F62EC00D5D07ED17D8997C91AF6B1746707256ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 45ddcf26241e56365dadbd80e20271e7521d624b1f40cb69a783643866476bd2
- MD5 01dc97f1ea00b0ca7dd12dc9d7e622f4
- SHA1 2207ac960a7f82419da4e082755ef27b97739817
- SHA512 05d2f98251fb25c8892ff96c2dfc45d4ccc38dc7de5df0cc7a6dde56de477be1a8e8dc739c213d4ffb132d615fc373794666d5e74a993713022a43f0a0dee2ba
- SSDEEP 24576:AJnJ5D3Wt4l11tmlNQ2OnBdFQtP51llPup33kT:AJnJ5DGt811tmlNQ2ayVup3
- TLSH T17375D02CD2A810E8D4B7C374815A1B95FEB2387D2F2269C72864D5353F12FE09A79F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d6a82bbb89a3a42da539c84458ca4d11a00e75a0bad3968f9783d04882f2aa42
- MD5 60734a94c83759a359a7f8df73b4b1a5
- SHA1 9f1c7df777dea1d6f8ead28234bfb2cd0a38e062
- SHA512 ff8d645ab51f12a087fd48fc87b569c2d8c762a17e190667637ca808a855026b6bc07580d931872b30a7e87c320cadcc93e7280e6dd3dd318b0b2fa207b7eb0a
- SSDEEP 49152:no06DIKdwc+eQnSt65aVK11tmlNQ2ayVup3:o411wlNQ1ya
- TLSH T13B956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 e468739fd6ba881e26be7621a2bc4e0ba0fbd7d01055bf81aa28bbc7d5e657c5
- MD5 5b04c04d3f376ec82aeb89eb7a33c1cc
- SHA1 c49b3c2afc56f0780f3083a0dea63ff16b4fcd1e
- SHA512 f690bcfb3cab069457d4a78b33a28a20eb3c4e24838497a0da965681b67b29d99026b6da6deca39750e7cab5d29a932b7c9dcbcbd98e5ab4a9428e3060d6837b
- SSDEEP 12288:oEP3RrclnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Drcl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T14C55122C26AD20E9D427827880A28645D3B5F0B56B5327EF4750813E4F7BAF92F3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 ea766ce97777baa278f0bb8b28058df706813b984079a57e4f1f30b59b7b4b0b
- MD5 f284ab6ec05965c0032a50ea1f6a1203
- SHA1 0db63bbf90a35d8208d0c4976f561172a5a1c484
- SHA512 d16cb93a5c74eb7830e51405cc74401cafc70b1a74ce18ae9b8f097c65007dd528f793acc479dc42279e65e5f482a37521188de77a22eef9bebee3b1e9ac7605
- SSDEEP 24576:rIyDl11tmlNQ2OnBdFQtP51llPup33kT:rIM11tmlNQ2ayVup3
- TLSH T1AB552308239818D4D9B74734947382E09A7CBC61AF2211EF5240F63E6F77BE46A39B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 abcf9fa9cc537ff0776baa409512b3efa98334b51dc5c4d1bbc66683e7eb55d7
- MD5 83ecebffabb11d100397ba8405ede53d
- SHA1 77043b48ccd98194f78089ccc107a45f52e39c30
- SHA512 8c4acd1f9644a48e1d189dfe2f9a062fa75eb7b62a332ffa5f5aa29f201eecec12b9b5a49734b2aeb6a2312ef191e2b306223f99fc871b13e0a15736f28af6f1
- SSDEEP 12288:zFZlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:BZl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T1F745230C14672CD9DC634BB050738E9095EC78AABB5B30FB5700B1355BBA7E9133AA97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 8d2e0ab88e58a3417e01ce8cac3a78bd8ead7b0f305d83dce98c42122e3d7383
- MD5 4e285f9218e19bf004ad0baa92c8a19b
- SHA1 9f7c098a8684eb9c5ff86f6c61d85bde67517db5
- SHA512 a9fda47cc9c67f58ff1e17e4a44f76f6d39fae061d82f79bc67d3ad7d43cd0e652f4da82065ed9740276b7e322aee237f230e627d507bd0904756019046aa968
- SSDEEP 24576:gQ9MxZKdcz97w3ul11tmlNQ2OnBdFQtP51llPup33kT:gVKXG11tmlNQ2ayVup3
- TLSH T149558D2DABE909DAE177C27594A240C3A673B4311B35D6CF2448D03D4D7BEE8AA74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 486bdc8bd5ffa5fed8027e160f0f42e7ace12a8d59112df3ba5445cdc1fe1ba6
- MD5 8b81ab6ed7dea4d11c01195b1e00c23d
- SHA1 0ffacd6cce0953cf5e0b31ab07afed9387d2e011
- SHA512 a4f0ac4173a426bfb892b6ddac341ba30fb6dee1728239d532ea02025160f0a994532d14330451de7ad6255db4ca0ec95ac20a92a757cd0915c85a85c9a851ec
- SSDEEP 24576:zyocxApHl11tmlNQ2OnBdFQtP51llPup33kT:WocxApF11tmlNQ2ayVup3
- TLSH T17E65E01F776A00E2E076823888868745E7B3B0715B6213DB5681C33D4F67AED7E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 7e1ec2e1778aa3d2c78502e155b29cc3abf712752dc34af2322e153ad7662d84
- MD5 88fad32a8f735e5e60da1a1501d5db11
- SHA1 b2585e88d6a0f383d5f18f443cbb839f8c5f9080
- SHA512 d8d49439b2a35a1ebe8a9e3d247f18ddf5e56beac2711e79dce1049e318793f1ad54daf59fe03002541710e97f2d360a5d8cf534a78c271ab2e575b30a6310b1
- SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKF11tmlNQ2ayVup3:d0zuNIZ11wlNQ1ya
- TLSH T166A57B3DA2BC00A8D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 37c8db149b93e1bb2c1f7a683cfaa12ae7d6cbfc548b612e0eefe8466f59f48f
- MD5 eef08e9006680718680fa0b32f467ee8
- SHA1 2f0a7efd1dcd34e840f4729b71d0282e2791a33c
- SHA512 1a9d75a821b5438b3bf78b994495f9c22578358433afc1f824e54557f398db51e6aff265bbe32b733c7424c4d52b1ef2e0fe5f05027e57f35f26602f111f107c
- SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYujMqbcl11tmlNQ2OnBdFQtP51llPup33kT:dTDxR+N5YzT4jMj11tmlNQ2ayVup3
- TLSH T1A055B02E67F905E9D1BE86789A23C512FA727821033193CB4260C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 d938a40e6e41b28c75c9446bbf71ecf9688c278be890367afdd81f339b43756e
- MD5 e407a026aac6e22ed8d9de018cd8008f
- SHA1 6c139cba98a6a6d369b2621171746a5ecc4d85f8
- SHA512 86d4636dce550ef7a0f038925957f7dc5904dccd5abd932f2d5041e4d72ff6f1052020d8726789dd865249c80c5314b011219d1986d9a77e3b6e376e88d36a56
- SSDEEP 24576:uTMdOz0FFS+bmSLgl11tmlNQ2OnBdFQtP51llPup33kT:a0K+bmSLk11tmlNQ2ayVup3
- TLSH T13B75E13E63AD18E5E47BC27CD6538906E6723466032265DB0690C1793F6BFE43A3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 c4a430992c4b1237fcf0f70ebfb6a639385ba6d6a33dd2012e734ffffdcbf433
- MD5 02d67d977fb5cb208f36e979747c1936
- SHA1 85379afce6496a8152cd9e24d0a8bbf753a64b16
- SHA512 8491237e3c767b3a353d66233a0f7da0f28038ba0ae425b1484189180284d1f0565648cdb41ab4d16c467dbe792d4a222d11a56ec4c1650fef4900f16268578b
- SSDEEP 12288:Z47VlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:sVl11tmlNQ2OnBdFQtP51llPup33kT
- TLSH T18255120C22E938D4E87387709533469596B4BC76672624FF2680D53E4F3BBE89639B13
- MD5 SHA1 SHA512 SSDEEP TLSH