Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 13:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
- Size 14.0MB
- Sample260802-qqdkmsbj31
- SHA256 8a695ade82ad6e860561952dee9d007732facf12eed79fb0fdda293fb75a627e
- MD5 e8136737750153149f9af26a184fa20a
- SHA1 9a6f0a1aee6b44a7d686e44fd09a7c07af16e648
- SHA512 2f7dfc326004da9464d3b59d7c3d06414b8cc1defe0637b81481080b00febe1c7035ec22eb6d9d2f118db4e0dd74b8c2bb50cfe8d544868cdaf449a018b5800b
- SSDEEP 98304:jxW2sUhKyJAM01FAZJaAcQgpyI3D527BWG:jx3rhbo+aZjprVQBWG
- TLSH T160E6A2364178CAA9C1526837C5494CF693ADBC10C6B352B7D6443D37FABE1C2CA7E286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1648 alg.exe 5088 DiagnosticsHub.StandardCollector.Service.exe 956 fxssvc.exe 2016 elevation_service.exe 3732 elevation_service.exe 2348 maintenanceservice.exe 4976 msdtc.exe 3384 OSE.EXE 4524 PerceptionSimulationService.exe 3808 perfhost.exe 3932 locator.exe 376 SensorDataService.exe 3428 snmptrap.exe 3024 spectrum.exe 5108 ssh-agent.exe 4160 TieringEngineService.exe 3816 AgentService.exe 1656 vds.exe 4720 vssvc.exe 548 wbengine.exe 2468 WmiApSrv.exe 1768 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4630c71e68b29bb.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000154125bf8222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e288ebf8222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3a8cabe8222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5f5d8be8222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013bf26c08222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ee4a6be8222dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c360c7bf8222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd57dbbe8222dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000701fa2be8222dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f2d12bf8222dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 5088 DiagnosticsHub.StandardCollector.Service.exe 5088 DiagnosticsHub.StandardCollector.Service.exe 5088 DiagnosticsHub.StandardCollector.Service.exe 5088 DiagnosticsHub.StandardCollector.Service.exe 5088 DiagnosticsHub.StandardCollector.Service.exe 5088 DiagnosticsHub.StandardCollector.Service.exe 5088 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3648 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe Token: SeAuditPrivilege 956 fxssvc.exe Token: SeRestorePrivilege 4160 TieringEngineService.exe Token: SeManageVolumePrivilege 4160 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3816 AgentService.exe Token: SeBackupPrivilege 4720 vssvc.exe Token: SeRestorePrivilege 4720 vssvc.exe Token: SeAuditPrivilege 4720 vssvc.exe Token: SeBackupPrivilege 548 wbengine.exe Token: SeRestorePrivilege 548 wbengine.exe Token: SeSecurityPrivilege 548 wbengine.exe Token: 33 1768 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1768 SearchIndexer.exe Token: SeDebugPrivilege 1648 alg.exe Token: SeDebugPrivilege 1648 alg.exe Token: SeDebugPrivilege 1648 alg.exe Token: SeDebugPrivilege 5088 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3648 2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1768 wrote to memory of 4628 1768 SearchIndexer.exe 110 PID 1768 wrote to memory of 3320 1768 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3648
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4696
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:956
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2016
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3732
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2348
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4976
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3384
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4524
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3808
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3932
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:376
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3428
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3024
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1632
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1656
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2468
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4628
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:3320
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 1a2700dbf150a24ba52f88ff6be23f0b62f38a8ae27de3f968b833980c08fca0
- MD5 780d1c42da7e335196733a0cbdc7ba23
- SHA1 fd20a008afa35851558c88be22b4eca9e7fb484e
- SHA512 56b2077c389a760271b5a0f67ef1dd382142f9e11f2288af20e0595474fe3b907ff3cf375b6c85b9444f346dadff1db895f5bc2a45d1905bc1f7d12f5752eedf
- SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnLDmg27RnWGj:23q6sjBYD527BWG
- TLSH T185D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 76d8c6fb62cd029f97695492b45bffc82237c0117a5dad2beb4b676fdda6ecc6
- MD5 3f6f3fa4fe8276938d848ca4515721cd
- SHA1 330901edf2c835e56d5d8a1bfac1762fa2680304
- SHA512 2444d914e5c8bc10d47604eec145e6e5e9371e96c7de10b620d8f220d012baada5654c022ade5c2db3ea581b539872f5dd067a2a0a67d06dbda97abed5cc94fc
- SSDEEP 24576:lXYfDtczAYsqjnhMgeiCl7G0nehbGZpbD:wtcNDmg27RnWGj
- TLSH T12A650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 0b9e781426c1883ec00eed45b62c9e092889cde1230e58750caf7920bc2a75c5
- MD5 d61aee8d0fd05fcce4ef8fa891e6109c
- SHA1 ff70d4c03315d3eeb0cad1e2e5757033657906ee
- SHA512 0a45b2d663b845e297c1c685de6ec887872a0ecdb6044bcba477b54a5ce5b95c9f77aa9c6f075f8b82636c1185d3cfa4ab00ac52b63482bd8a4ef4555e4d9605
- SSDEEP 24576:P0Le5ji0hmxxrMfsqjnhMgeiCl7G0nehbGZpbD:PPji0AjaDmg27RnWGj
- TLSH T117859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 cf3345740f1180979e436f7bf4aabdec6d1a7282aa7b21bcf3ac0c491e5cfa6d
- MD5 db68ea9e1f03721765305a4f6bcaa922
- SHA1 9f8d49f49badfd2803f2c105df7d58ff99c401db
- SHA512 9f2b8ec1045e852b639301bec38a2608bd647b0dfae467163fe51304d62f71234b01f6c26d7e2048abf9c6145d83d1798d2ff816dfac86339baa62fa7965fa91
- SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyu5sqjnhMgeiCl7G0nehbGZpbD:C/ezSC6vUzPveHjyWDmg27RnWGj
- TLSH T16B755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 940fe3369589cb3bf9105442fdae96cd266931ae57077005afae05bd30079744
- MD5 70ec1c740eaab1e527501302038b5702
- SHA1 2224f60f973b38d1636d0cae78b923eed84fabad
- SHA512 7d8b0df204d57c3b62203430ece1be2b94a268d295dd9f33c7b56874bf9bf58974c1b039a844b86134c3fb324b774e49b59e31301dbc8e78c9a826ee8e6c4d6c
- SSDEEP 24576:dVbqPb88hv/l+YcsqjnhMgeiCl7G0nehbGZpbD:dVO88hXl+lDmg27RnWGj
- TLSH T183559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 fa327503cf9684773dca6cbeccced47b1bc983603f413cebbaa6cb1171a815e6
- MD5 75c91cbbc14cfff49280474ae2d6a1bf
- SHA1 7bebdf26c6a421bb3d1f60181c150c7c22d0e9d5
- SHA512 6795d56400d75a4261448d1c731fe1b1b7de5e211d9ad18b0de17a610c7e205a31aac3b952bced66d4c9914b940107d33011c0f0a89e81404c47a04b61b74a49
- SSDEEP 12288:wLjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wLjsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1024523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 52602081b9af02bdd37fbbcdba650bd1eed65a5bec601fee7f587cdc7033b0b0
- MD5 51dfe393d3c575b2292c2bdc4ba5bff2
- SHA1 630c8f2a86b486431a1b7121d4b19c764f814ad1
- SHA512 6a18084da6d6b7f0d58a2ffdf0d7b1455db91747ee185d543213eae14df507c0bec4823c3ed4b40fc8f56ccc9e65c5d860837027010a78ee89064efe30419b6c
- SSDEEP 12288:+eBNUbTVO86UkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:+JIUksqjnhMgeiCl7G0nehbGZpbD
- TLSH T10365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 ef372ab2201f099887b351b42ebe650cb1f3b61f7c00d2717143052c9fc075b7
- MD5 2f5c07062fe83eb2c2571fb14c4d7432
- SHA1 13a1a8e0d4bd8f166bbfd1fb77b247ddb9db3cb3
- SHA512 3bc593f19a779e3bad7fffd8f95af5cf1dcf541326e89054ec2ba56ab311abdef40c487aa615cb33d94781f093f182a881e611f3f0bcef2dccdfd66937143b69
- SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:EQvGAdlCEL8c/DRNw5CtD527BWG
- TLSH T1F9266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 df284e071ea0a32d0521fba67dbaa31284d2cfb512aaf36d2ee3dbad55ba0c94
- MD5 e2679f7e56a8905803eaad6a41424ea9
- SHA1 6b1dca950d4ccf878e66232ec24e358eaf97c325
- SHA512 416da76eb35e55fc99dd06c8cc44c4054cec55b99b1792c0dd83a0264a973a179654a994ecff1e9647ac3263a578ef94a79d2005f743d8ef0e28593197331f46
- SSDEEP 12288:tAwSfxL/2Dc3RDLLmt0LDQewsAjGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:e0ewsAjGsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D875E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 ac871f1e177b20bf13ffa2bc85eec13027e1d473a53b6b665d200623f3ee8431
- MD5 41b1cfe9b84ee0b332e99e1f40dcd3f1
- SHA1 2b1ab8c0a775070682a2d7482abebca860d43ffd
- SHA512 d937920799638f8aeab0e277c14daff5cc5ce4cb1b4750be14417bb1e08376b47129bca876820d16e62c9d55998ea756150255451ce0ad0e860cbb7c558d4071
- SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSVQBWG:kUEtQevvqc2W1cpV2tI32FB
- TLSH T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 00f4f3538df714784d0d6f4e1588ced738d2628d5c79c49d2bc49a5d233ab731
- MD5 1296ddfdd57b80fdfaa6ee49c5e2dcd8
- SHA1 c9fc4f3590e260fb7f332011a57222076a732343
- SHA512 3cd32399f964abb616483a6f498135fd3ce42a9b5a3fcfb82f7a653c83d7ec237eadc530e2a7a3e36ee2ca30bf3ad01a6e0b5837c20bc104bfc4f13af334dd00
- SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/zqDmg27RnWGj:KoquVjnmZD527BWG
- TLSH T1F1D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 11be97a2fb54b3a9166b1a3c88e834d9ec75b50c447aa0c28aba443ca2f3213c
- MD5 7f1be1d484c0126164ee13e6e867aa38
- SHA1 f748d6aa6ffe17a7be9d1cd0b5c797f996fb986c
- SHA512 14bb1998f0faad123445ab8c1037c43a2fb09f0d7f66468b4c7e363a19213ee98b57e66db79504b04a507e783fe1f0fcd30eba2ae68cc4252bdd787b054c814d
- SSDEEP 24576:3AhGL3IFoiwtA5l7S53FsqjnhMgeiCl7G0nehbGZpbD:3AMUFoiq5JDmg27RnWGj
- TLSH T1C2359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 dfdfc6da98a1ece786f35b5a89e2d2b21478462f9e93b6145f1ca70a7df516a2
- MD5 ef1e4b398dfefcbddda8b2f42ba3fef3
- SHA1 5f9fc54f800a1fb179004b54c64d7f3192acbf87
- SHA512 e10baa933c61985079b5df55515a5ac59257bcecb33503ecc5e3838e4da016f3756ecc8af95871085a169616b05c0ce214f16f8dadd49c9db50ecd37cea2f2bf
- SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+CZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:uwu4OWysqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AA65F14A76A81CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 6a550295b2fdf1e6226a74864538e04b90bcbdc0b4cc42413a1b25c2a3e94b5f
- MD5 54e96cf711306244f48d92a35c0b914a
- SHA1 7fbbdb658b75dfbd1b92557198458debff26541f
- SHA512 0782dad96bf666e491d84003895cdabf567f1e1c5b733a1499237eead90d1c1805d4a0d58f9aa29fde90bc7d52fe444feb7d0886028c5e316bbf58b9df72ccbb
- SSDEEP 12288:JeZ1Iy2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sZunsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15B5512AE239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 82c089e2a61f7a252642962f8d0f5cce5242b68de1042c4666dee5180ef1b78f
- MD5 c652ef4d8910aa75601df3b59740b65a
- SHA1 5eded922d9351238257cc059354b4401eb91c1c6
- SHA512 5d0b9b554a612619a2dd800ffd1340324950904d841055c36030056866180b8699a5564d5ea2dd7dff1addc852ca8dd737fd0a0d206cc9c755f8dfceb0574bb4
- SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN38D527BWG:6QyiKa/X+PNMVQBWG
- TLSH T1B1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 314a1315403c320fa4de558bbcbfb2e70081bc37b228b35342169eb68d1fa5f4
- MD5 ced516789ef7267a013b506dc904dfc3
- SHA1 36d3183cb06f526d2ebe8f3e89e1b02827c9b7c4
- SHA512 c988fb123c5cb300c98829b915ef6c42107f0f6f65a696366eac53ad8715e2591f592d210c63e036f9f51fc87abec388cb90132094b8cec6209a495a63f506e5
- SSDEEP 98304:8QRQyi36YOcPbLvw2gAf+PN38D527BWG:jQyiKa/X+PNMVQBWG
- TLSH T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 36cf12a8dff81a3933c52472633ddb4aebcc40ebed0587301c8cd143aebb4074
- MD5 7f78ab6a44ec70cc1e375786a8612d50
- SHA1 5440813996d0552ae707f51bf426e8d70052b204
- SHA512 d0ba9dbc99c15ef3a60527efe84bf53a4247387ffa7c699a44014b947ea5afff42cb5323a574f89855fb71dec6a44848b1aa260f52eaca177aa883e1ee4389f0
- SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL03sqjnhMgeiCl7Ge:G68Qg55nhceWu7PNU3/aDmg27RnWGj
- TLSH T187B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 0dcbafd0ee17f7ec077a1d2c6558e5c0d9949f94ebd8c22df8263aab4790eb94
- MD5 c7a17b0d22918b8bca465bddaad0b14a
- SHA1 700810b3af1acc920f7b45933bb1275641e2e7d5
- SHA512 a4439db5fa3ae5babecc29d16212a36e744c10a37b58ee29f0134a83edf50e25acb600f2eb2c308e8bc7e2d9a296eecd3a8af5c5bbf61c847c73ef33168a2d07
- SSDEEP 98304:dy5112gYy5azzVvt69nLKnhZnD527BWG:ALIHEWhhVQBWG
- TLSH T125167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6c61a14ccaf656abd9f7d5da1298b9fe618834284e58f3d8796e68a554480c76
- MD5 0e75753ba8231cb31c43a60a5a1a1981
- SHA1 d3dfe2f360bb077d656f58b7558b2772338a6d98
- SHA512 bd0ae5cf257dc98e3bc66333cc80341411037edac7ddc23a92475c19f8f8ed9688ea907b378f522c61842d23fb40b6e65fe33208ca0da54fbd86425be2c0875d
- SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glUDmg27RnWGj:Uu6Jmdxd2dUD527BWG
- TLSH T131D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 6be9336686fd8560c9bfd8e2c581b1410c57e7dc6e3929fc41557b67efffc31e
- MD5 33dc0bd4a494a37e1a111d6aff1ed70a
- SHA1 e5c045016a222b7680dd963357bca2e658d8ef51
- SHA512 3b842ac57e1777c786dd38f0cb1ee5b3fca0b6912bc2bdb60be0af87fba00e76dabd3492a400b49f11e0c60e758040feaa0264353ea36f6ac83f235212c5b749
- SSDEEP 49152:Z1hpsNoJpF1A63U44CwH7R4xgDmg27RnWGj:ZmifPWRZD527BWG
- TLSH T160B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 bcaad5a02af68385240c0d6db6f206fcb8dc257191c04a2b0eddb6020942d7d9
- MD5 1c7a21e9e4d5d42021f3490157a2d1e5
- SHA1 ec06c8dfdc394c1aea3134feeaa07e8e74078efe
- SHA512 2eaa91d35571d28fc202bc521c45a6d135789acd787f187b9992d3cbe1d329300c13ef38653a21278d14c53c5a3a9ab89c7612b6f84ae484da555cb81e8142ad
- SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHq7Dmg27RnWGj:G5dKii617D527BWG
- TLSH T166C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 91c88b0d27dcf49b6caafabd26189a6fc3b2648aa69e721728f10f2693d56df5
- MD5 43cca7b2f72c5a2183da800705a501a1
- SHA1 ca24e28d71fa13a055625b698f1fb5e138a344b5
- SHA512 579adb7fc59c53c1898bab65af2b2bdd1c49026765626c48453f3bc18cd1999af1cbca1a2d7cbedd7bff2650e7ca50ba38a5e98983c893f84a140b32e0728915
- SSDEEP 49152:4htSn8EApI0fig3giDn0AP5wEDmg27RnWGj:pX2imphVD527BWG
- TLSH T16B95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 d5097f5bde39e9d9fdbded1fe54cef327d44ab54391ec50a387cd86990123c5b
- MD5 7cad58e4b9745ac32365e71d8b5d26d6
- SHA1 1449bdbdec3c4fac7e056d957810b9be60b4e5e1
- SHA512 f5ccfd0db22f9734105d5b9459c7282864626270f21e89c5429f28f2ebe2b08de90d2e6a27c17163890463e42607a8c6aa29eb80b37bf7b88c1deec31257dbb7
- SSDEEP 12288:FrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FrsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1BD4523BE964C51CAE52249B5C3E5F10DAC073E5BE92004937A9B7CBEF7B24584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 90d3f24c33e92ee004b3ebcd56518bb74f2135ecc6ebd4f82dd7eb3d579290a2
- MD5 7595eda7dc38eac932e6e00dfa63a214
- SHA1 faf20f3abae387d79a3bac32bdd978d8afbbc1f8
- SHA512 94b2d442e5316af486bf9134f39799091670782c210df30bd549c144d49abf1edbaa30035310eda7b145e61531dbe098468d5b26917b462bb1f88e5803cf0b0a
- SSDEEP 12288:6KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6KsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1264523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 07e23616c04b30fb96cb1cfec0b0f08e5ca848ef362a37365bfea47147d790fe
- MD5 b4d02cbfd7727fb757d1c5fe69a17580
- SHA1 154ae17bbc3420218024bba27fbf72644572dd52
- SHA512 0be857bbcde78b6296c4ffa63d51c4b71bdd616658b26461f5b32fc1bc1de2bf8cd2e9cda35400cb9ac610d45f62a5af9c7f70cd0613b9085ec73ea92fb57890
- SSDEEP 12288:/sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D34523BE964C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B24584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 34ce1c8161c2a4b3dc844eb1b55dd958c292c52bcdf8f202df51286f228f2698
- MD5 1817460ed830adc43702f9e9bf71ea71
- SHA1 7f12f550630a6f238fe9c5ebe5b15d8d8fbfac0f
- SHA512 70b9905613b8141524423952a5e02abccc1ed76760dc5b71e6feacb57859ae76a953c629fb183037a97e2b4d632062696a0ff2d9024ded572eb70f65071708d3
- SSDEEP 12288:1VlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1sqjnhMgeiCl7G0nehbGZpbD
- TLSH T19345236F675C00C6D83285B4C2F5E11DE8277D56EB30059B6B532CEEAFB16944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 f8efd50e1673670050186cb6070449a0e0336ff51dcbcfbbb81f89715f3561be
- MD5 71f53fb7b1ed73dce72a8bf8a10be138
- SHA1 2e2313aa2e3f99fd2e9f9cb6f5f2d3fe0c564df4
- SHA512 599f5199569b8b74b8589b2d505f14ca79523f59db8fbf308e3cf35402d723a4c168cff9711e856201044798f60d358e9bcd9874d376b94753d884872210b1c4
- SSDEEP 12288:EdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EdsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1304523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 b242c25f7f2c4cddc71b71815292e496972b9169b73fce22090b5fdabe5304c5
- MD5 090d9214d4fd2e18785387806081291d
- SHA1 33e4aa098256bffc763e8e74d9327d7c9eb3abdf
- SHA512 693671c7c074ad82478a83ce63016710e5e24c922c22174648a24809a2417eaee63d2348a4cdb7edb37a1db70d475040ceed8027190eb176aaa74af347c98628
- SSDEEP 12288:CuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CusqjnhMgeiCl7G0nehbGZpbD
- TLSH T13C4523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 464ac6e71315d27d08cee42b1fa0804da706aa18865d780383bb19d5dca0b9bc
- MD5 547f124286584e230394fd6ca04c8916
- SHA1 1c6039142d68fb78134ade897451803b40c0d8dc
- SHA512 320421a5867629f60686d4555186b59e4320db7abcb3f626b928fe2fcbd72e6f51f28285cbe0173d8e30eeab81bfc87987d76b4043da27b39bbaccd6678a4176
- SSDEEP 12288:3CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3CsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1454523BE964C41CAE52644B5C3E5F11DAC073E5BE9200493BA5B7CBEF7B14684B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 ab8fe266b7baf37a4a459f055551c777618499c2031d7e0d6e3d6e6bd08cbc58
- MD5 e769e0f84d529c1101be83b5a104a16f
- SHA1 7e2943c297185a19bdf0a71f7d3c8e9d4020ead3
- SHA512 44e238df9c2dfd30ae743c8b4979d8dcda47d04e87b097dedba42401044dfff076a6c56b2a9aea2613ed40ec4183d48ceb62bb5b95b37207853799452ac21532
- SSDEEP 24576:xZMRzFVSOqsqjnhMgeiCl7G0nehbGZpbD:xZMRzfyDmg27RnWGj
- TLSH T15D6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 757885fbf71aa23744acef45ada9de11d0fa869d96f2f86f0a4c2671a55b8618
- MD5 91927fd33f70eb79c5ffe2bd87f3c8d0
- SHA1 3aaa0cd8b7241faf56ba0d87ca99234eef944540
- SHA512 87d6abd22592d4316dbc822c34e9722aaf1e683de80ee27171c87b3b7161e842f14627cd76c72089975f86279d0ea98c97b9fd5d068f4292de00dc9af0ef3430
- SSDEEP 12288:MXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C24523BF964C51CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDF7B28584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 5f9b6cb90be1fd5a8e672499af752351e109da76497cd8e94a025af33217277a
- MD5 d0b047034cebbff50231da8d9a8c7d4b
- SHA1 36aff6141e3371dabd73fa25fa96fcaca0f6ce14
- SHA512 8d3ce4ce42a9b6fc83e1011d1187fa7a2c2895c950e30039f070f6f65629a9cbbac1c5e015ba89e82a4dc73fb849c639ef0a3d5a03d9300f7342cd01616613bb
- SSDEEP 12288:WTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WTsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D94523BE964C41CAE62644B5C3E9F14DAC173E5BE9200483BA5B7CBAF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 c3a83c6b09aa38fa166c97732b31d25612488d1d417769be8b19abfadde6b4f3
- MD5 b390a6fdc4cd33838f4dd983391f2641
- SHA1 5028f52bfc2b00341473a6b48540f0f0887ec10f
- SHA512 3e176a454c96a218cf12f32030e6dcd08fa71770395c4bb778ae02df2218e5cceee8461214237ebf82ade7f39bfe4ceadaf280fdcf069f63bcb5411ea8efae66
- SSDEEP 12288:7yPz5L82Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zy2sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B855025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 063791ce49b918010ecf58e67fa2b01138485d9e7a81fcbc69449587ee823891
- MD5 6199097815afcba4bd7bc95b6ce1020c
- SHA1 334f3325a4af91a566876d7d99805247b8c9af40
- SHA512 03dfde23bfb294ae7aad7e61c8816e980d37e59fb7fa1acbd4a4e84ebabceaf13cadb2ce2661022b4d2be7597d65593178df0468a5b1d062215c2014289b8b67
- SSDEEP 12288:PXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1624523BF964C51CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDF7B28584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 9a45702669d3f63834a54dee6e4aa547034ebb5fcffae9150dbec48cb72c7803
- MD5 a1d070ae3dcadde351ff9a370f0255ed
- SHA1 11dbc6146b4077548aecbcc8eb358bdf8ef30dd5
- SHA512 025da6eeef6e05d4f0bc32c6d931a16ef5dabaee4ba16206da153687dee606ae771cf045cf71bac5d601f3172bb214a99f33e7c020a8c6d806ee0e99f9beb8b8
- SSDEEP 12288:qXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C24523BFA64C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 82292d78ad0ad538071102d09285c7cc759e64d4b8d828d734a740cd649877fb
- MD5 b494fb0baf5229df78bd90767b2dbc2f
- SHA1 e7e47d21e4c76d0b8a9bc7d556531d03b11f4e21
- SHA512 1e82465233b963c0325a06c791ef24a7afe2d7c793b2545184d598110b7904254e97198c4c9f85658755becab3574190b8c6abb7b72ea12c99fa9e21d7f3d6d0
- SSDEEP 12288:HyPz5L82Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzy2sqjnhMgeiCl7G0nehbGZpbD
- TLSH T15055025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 c56cd525a12537c251e009021902bbf780e5ab07775c898e0b7d2642f577ee29
- MD5 de98846b06b2fb577850f3b6ac631c3f
- SHA1 a95cb233ecea9524e741a1f1b1f5ca334294616c
- SHA512 382dadca3e3527b48ac6a811bf11cda8032d47fef753c6570cf388ed12da032198db7b54da7de7db13e88a0801c0476c70c662e8f8423c4531c639bbd2fa381f
- SSDEEP 24576:McP4mcvIjkGOxhKP2l71SNKbrh/8KBvsqjnhMgeiCl7G0nehbGZpbD:nP4m4IpOO67N8KtDmg27RnWGj
- TLSH T10165BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 d5f71a0ad7bdc1bfacf459c098e29969814fd3b8840acf89d927cd2c28429031
- MD5 84b3d1f8d9883fa4372cbabe74876ca6
- SHA1 fd4b336c8d7cbc3d4b40aabb9ccbbc75443cb576
- SHA512 a8524b64bdec83772e6e916a3dd3053a76bce5c03115ccef0a7245caeae6c61a09f093e2f423c89b2d9322ce9e29a135478f8026acb1a57614024eb386b04914
- SSDEEP 12288:QbsfnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3nsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19C55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 b4da93ca41f051495b836258ec65c812bab700499cc862c15af5539a3be763b3
- MD5 2bbdc1eac0b54c9af160f2cfa41bcb15
- SHA1 9f975802fc98d81dffd5351021506544f18e117b
- SHA512 d8ef5826658650b1a50033e2488722e197554968bba4ff5f8ab7d4e52fe2160b18262304a358d8e7e587f998548c124d27cdf91898b8b4721773f96d030338a8
- SSDEEP 12288:nHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nHsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16B45237FD34C518BE57649B082E9E12D680B3E669E204483BA477CFDB6B18948F38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 6e9b00e3284f5543b41b36596f7e1d2c33920cb1c5009204ff3516d3d20614be
- MD5 f9165751eb55a399c1ba80f92fb576a7
- SHA1 b10b6737b228cf2d39b86725999cb1bd80638d96
- SHA512 4ba5270a6c59a51d1ae0138420a06e22a7a161476dd37a9e437f73a9735eaca965c6d33334f305aa1f57c23f6cd75b1212d6cf02d7a0f1a26f054059bb6ed3bd
- SSDEEP 49152:ba0h2GEkuAe73q3pp46zwwQBDmg27RnWGj:ba0hNYG4JwSD527BWG
- TLSH T10A85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 110c0d5391b07a9b3da795d836736297f3099ffab9e97030904f1dc092535c76
- MD5 d5f8a16e3eae9dc757d5b3584a27f97c
- SHA1 c47660bac9facf1ed69c3715a9fbd1cee6cf3456
- SHA512 c2d2a6a8b502d559f5b61f722b39f685f9d5e2df95464e5946d412cff322a4014340656b258e42031fa129c8504e47c5513e2698cc251614bccf764d6ce582cb
- SSDEEP 12288:MhbHjfXaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MhbHjPasqjnhMgeiCl7G0nehbGZpbD
- TLSH T16955127E16AC20C9E572A1BD8295D10AD632BC261B2053EF23D281BE5F37DE44D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 e4c2e6f476e88aa6ba243da805be506dfe8a3581221f64e270a4ee0968d171cb
- MD5 297903e513b12ca7fd40847e285ac86a
- SHA1 37f37beaaac8c2062f02c76496722dff96cf33c4
- SHA512 caeac6679d9646260529950c9e5bb7c65d3763f14ae605be05e4a3395d02b5383f5731bb909cc1904724bd44b2533a98a86639f089f2f83671b187d48e7223ef
- SSDEEP 24576:m3YgnJcRTk4yti+R5dpR/ysqjnhMgeiCl7G0nehbGZpbD:mIgnaTk46ppR/2Dmg27RnWGj
- TLSH T1A945BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 7fc45e70f7beddbe8fd1a1bc7361240297d1ac789e7f5ab986a6ad7a9c49a340
- MD5 03d9e6a88d599689b584164662f01336
- SHA1 8007b8ea51b3e160efe3bee4e9d6473934783c3b
- SHA512 5854e768945e33c86f802870767f1303e2786dd44e7cf3ee27f153465fe3def3097fbe9eb4b79ff1ab561f1c5f4fadfb596292423a9a22ce20cde9ae06148e84
- SSDEEP 12288:pDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pDsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1564523BE924C51CAD53649F583E5E11DA8073E56AB2004D379A77CFEE7B18E84B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 22637050f3fb0dd1006e70d71c38fc4f4e130c6f2e51cee151dd3a8262f06b1c
- MD5 001208201bd7381b948a98360778dd1e
- SHA1 657c47e4e17261d1d07813ef5e4639255523cb6c
- SHA512 201624cb409e1a1130cb10d93dc053e46d3ea38135ce163a7580a5e10a0fb892e33892c8982e4fb7a8bc858b01cff624ee2d452e07c4859fe94c4eb85ba138a2
- SSDEEP 12288:uObfA4LWOsvAYFTYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:XbL3UTYsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D2750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 f00060135a1e305fefea091e2539c73dd7014d5fca3d49c0c2befe5baa412a58
- MD5 217c2c88d285b1f5fb3b339321cfa65e
- SHA1 0347039a280075ad8b4bd42ef9d161d21c88d089
- SHA512 ca4d5001390b79d30629065feef2feeebfd34647973f48eeea88c4914e95dc59b35d3b60f422f7ff632d2e0b6a6e2d8960452d86218609f682b7974b9ba77db7
- SSDEEP 12288:6pFtIOEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ROEsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12B55022E33DC10E9E536A17C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6fe81d2558800f280470aa8b34d70c38784a1d8d476d5a7df38bd8245ca653c5
- MD5 dd554436f304eec26fb9959f1beb762f
- SHA1 d11a0c85eb234579d6b7d4d9e2d814e1d0cd67ec
- SHA512 2344b73d5d551f7dd12252a395d4006ed3ed36273ea006e82945ddca26c4c078ff6d7282bd4830323cc44a082f8602a659b8760a547398ffb0c8defe483e3708
- SSDEEP 24576:W7NM9YmZqmWMUkPjZM48Mv6bEhsXsqjnhMgeiCl7G0nehbGZpbD:W7cBWMpPjN8DbEhODmg27RnWGj
- TLSH T1AE659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 1a41c04a43e6e06e20e7309321036a7510f9a2317dc83d87e611ba7df65b02d8
- MD5 2e64537a707ea472614d75e3d754f523
- SHA1 a4c18bbff1ca2122f7e50db111cd277f4d799b9d
- SHA512 2f214731b3175bd5629a0621ab179d9110396d4602e3ca45c997ebb83d9890cb958c6c2f68a6f4b6cd7ad247e127cee3e84ed80811fe9a654e34a0537683f51a
- SSDEEP 24576:AW6BApg2YuyuNDYTabvcRvNYf8km1RsqjnhMgeiCl7G0nehbGZpbD:AF2YuHNETovcvNYf8kmLDmg27RnWGj
- TLSH T169857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 e2040c56647c76e754c7d827af497cd22fba7d847ad121c29609fa8a89db6e38
- MD5 810acf8cacecf2b751553c939b66eff5
- SHA1 2c3a189f070d6be7cbca337a621bc1909105e3c3
- SHA512 bef633bf0643247fdfa5b340ff2e5067a354037e40722ecf291e9b37a55ac97264ad162975265a10886b9952ebcd10a60a6b3fd0d5269834d20f3cd7e10127b3
- SSDEEP 24576:hAFs06+OmlfkNXEbTogsqjnhMgeiCl7G0nehbGZpbD:2Fs060lwXuhDmg27RnWGj
- TLSH T1B265AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 cf057e82780724093cb9a011d5e86e1ed8feece6a79dfcc3937db3692c0120fd
- MD5 f4373f1aa4c6b08d0e5279db24ef15e7
- SHA1 7463712744a5ab6ff4023b89d12ab7b5f3298b33
- SHA512 24f8cf28688a0b890d60ad6f96eb0f8d2f7e84f0294c8c67ec7179f90c6b8ffb7174834f6ed81fec4247ed14443f5798c957858a27dbea78edb0d102a774918a
- SSDEEP 24576:AJnJ5D3Wt9sqjnhMgeiCl7G0nehbGZpbD:AJnJ5DGthDmg27RnWGj
- TLSH T1CE75E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D4357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 3240e9480ded19e6c456438fb2e507ca090c0e2ab3ff00d030bca42744d43d6a
- MD5 4398751f78d8b8436355e101964688da
- SHA1 8aa37a0a8f275b27d7e8e7ee1fa9bea484150532
- SHA512 8e20598def05bda4ec21c48af6656ebdab326abf6b842a90a1107aeee0408d736656c5d7b6bdd16f8a07c0710af9de036c4a4ae72001f7a125dd980e65f8c22e
- SSDEEP 24576:cEPohm6/7IIXdwcXrif7qQncjlP65i3VuysqjnhMgeiCl7G0nehbGZpbD:Do06DIKdwc+eQnSt65aVfDmg27RnWGj
- TLSH T10D955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 a69d671beb964a13fdd3d85f290624549cbf4dfb516d803032bad4a33a14b530
- MD5 5a2cbc1ede745b20b86ce88c48fd426d
- SHA1 7147b255a3b262118a28a6cb25634b5919754098
- SHA512 5c4b858f63ae9b0516e040773be394da96d2fa9a9d224a7e2dcc0231b13a6ac17f5ce340ad65976bb37f380c91d16e08fada79ad57c6cf3d8e37e237b5d053d2
- SSDEEP 12288:NEP3RrZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:urZsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EA55126E679C60DAD136907D82A1C209D733F4716B2127EF2692C57E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 e2164fc97c208eb5230dc20e6be307447b49b4c1f5a0f71107a5b8b93fe41a98
- MD5 0c91196386f546597ec7d97690343eaf
- SHA1 d034cf0eba94799bcef9dd20ef40da9d89f31045
- SHA512 439c0725750a05bff84a8ef49f56503cd226ea2f4db20f7bc93b866b4c6eb8cd1fd41f1837117e3e85b50701ddf434d257205001285c8f7109ca9c79d10859e5
- SSDEEP 12288:0jkyKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0IyKsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D1551219639C60C9E6760578C6B3D1589C36BC319F2042DF6591FA3EAF72BD48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 a2edbbfa6b3a829276678278f75260157c927db80544a53855ae6a828ac673b5
- MD5 ab17821892f7f4592b67a5d969cd4fc2
- SHA1 c1d8ac1cc2079710298bc60c0dd4639d6207a3ff
- SHA512 1011cecf1466eaa644c969cc694e751102999bbc89e8b98419303afe8803172d55371e89f6483ba457cb27f9c3823cfa5f5c1a01e30368f011902d47ca1b5cc4
- SSDEEP 12288:HF0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l0sqjnhMgeiCl7G0nehbGZpbD
- TLSH T18045237E525C60CEE93245B8C3A5E20D98133D76AB2014E779E7BCBDEBB24D44739812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 7b0cf35c4f48276d684c31b704b895ec6ddc90f3f9f6e94eea84ea931c9e6e13
- MD5 b0ef8fbfb95e86e8ea7ef2c9aa89f46c
- SHA1 1343325c3e3d6137ef500b94ab82a5206d82d502
- SHA512 ddf27133da3965cb801dde3d19bdeb632ffe61f20d6d9ddaf12b2b9adefdae3e22342c31c6ce6286d4f59c1a1ac2112f1fd735b559316ffc295b7b8b82639807
- SSDEEP 24576:SQ9MxZKdcz97w3/sqjnhMgeiCl7G0nehbGZpbD:SVKXjDmg27RnWGj
- TLSH T195557C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 c73e28cc44e5b73f21dbc7d34da0482b752beff8e937563c7ff6a3f50c5c533f
- MD5 a3239aa5520d758d2a754478486e1a30
- SHA1 aa57e131fb14e45cfe11816542648f98a57807aa
- SHA512 fead4e8d5a18a390d1c2a3637e246eeebdd21f1be2f694a70af2b57e6be6af8ac3ea05b1c55d480e9b61c4177691de13f87d150e9f46b5f1f755fbf5e7d98dda
- SSDEEP 12288:UyoKo2HRple9pGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:UyocxApGsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1BA65E01FB76D40E2E176813C8985C249E673B4305B6257CB6692C73D8F639E8BD38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 7027857f6d6a65eb5938ed742d3c8a19929e87738f9c3c66da127e83be3fa9d5
- MD5 04304988a26185573b3d417de88679e1
- SHA1 33e8e18123bef030e4a642ce2bcce4db944e08ca
- SHA512 bfe927068479072a384de621754fa83538be27c730c05d98a163010068badf86c48566e2f25238c951570da825f3a8615597a7455aaed3e5d8aedcb6a13f0878
- SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKKDmg27RnWGj:10zuNImD527BWG
- TLSH T125A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 2909aa37d7378770688f7e28c7c348d2c6ab31cfb8e8735a4327112df71ba7cf
- MD5 cc088bf2d000b5e94bc829da1aaf24f0
- SHA1 aa1569a9fa4f77c84cdc103eb0220c694cc5154e
- SHA512 79bec2c76765a0877ee1fe402c5f8eb395520dcb6f05fda63f30c065a7599b11f9be385e0b9cd7dab592f5f80d00d3dce01999ee6642da74f714c2ec85645a37
- SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYujMqbZsqjnhMgeiCl7G0nehbGZpbD:UTDxR+N5YzT4jMADmg27RnWGj
- TLSH T1C755B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 5b28528777070165ac2354fa6497afdf5a5b45da5c2ba45921840f1701337e81
- MD5 9ee018267aafa349f0cfdd371409b873
- SHA1 049a8d352c0d4c876f59b62d6c1bd2c3aee0a332
- SHA512 975d56fd60347c885115e6ee43116fa7a94a74ae508a01fd2ce430b7d5e4d66b597dc854a4ac21f48625bf11ff23137f3d6a23b172db8ea53e59656a03b937c7
- SSDEEP 24576:JTMdOz0FFS+bmSLlsqjnhMgeiCl7G0nehbGZpbD:D0K+bmSLZDmg27RnWGj
- TLSH T16975E17EA36D14E5E47BC17CC653D90AE9733866032166DB0690C0B93FA7EE47A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 bb1f711b92098f6d0bbbdd40d402f841d2b6b7cebbf068fbfc09eec8a7bd6e34
- MD5 1863be958bfe76da0fbee8e4e57f61bc
- SHA1 1f8a04d3d11e21cacc6d8e1be94dc88407d2c00a
- SHA512 d039043054b53f3b942c0265883e0f2b2cb1c8b4d77b9cfe3979fe9caa58e305e05546cafb035115b6e1da31b5d9594f209e8ab9c850d8af9ed18dd2f1000e87
- SSDEEP 12288:Z47YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sYsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12355126E63DC30C9E4329578C2B6D1099432BC36672015FF39E1D9BE9F729D48A38B12
- MD5 SHA1 SHA512 SSDEEP TLSH