Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 07:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe
- Size 676KB
- Sample260804-jp8wtsam4x
- SHA256 6b91e2e119c4b6ebbfdd2cf27d011067ac04a3f2c34783207cf03cfec320aff8
- MD5 2f5147f481e82f8714261ea5b4a476d5
- SHA1 47071bd6cd96af458ff6c86049a5ddfcf050d2d6
- SHA512 fbab8d1729c43f61e6e71c957b7cae5b93f91b95add7864dc5e2e5d322037d0775b6d2da3160f849a40b5a39c792a3f2ec2971c8b606b68afff8bb8b41558260
- SSDEEP 12288:r2VHVF+SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:aVSSLexL2gyX6WH1Mr3nQzh
- TLSH T10EE4125B72B034EFC43793788891453CA722FDA679228B4F965871862E3A3854D3DFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1264 alg.exe 4644 DiagnosticsHub.StandardCollector.Service.exe 4440 fxssvc.exe 1512 elevation_service.exe 612 elevation_service.exe 964 maintenanceservice.exe 808 msdtc.exe 5032 OSE.EXE 4620 PerceptionSimulationService.exe 1724 perfhost.exe 4224 locator.exe 320 SensorDataService.exe 4560 snmptrap.exe 1764 spectrum.exe 556 ssh-agent.exe 4908 TieringEngineService.exe 4536 AgentService.exe 4640 vds.exe 928 vssvc.exe 1932 wbengine.exe 2684 WmiApSrv.exe 3848 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\513f07ff79c0b0e8.bin alg.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\SkipBlock.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007df78226e623dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3976126e623dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e20c524e623dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d799c927e623dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f354026e623dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000011ea926e623dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4644 DiagnosticsHub.StandardCollector.Service.exe 4644 DiagnosticsHub.StandardCollector.Service.exe 4644 DiagnosticsHub.StandardCollector.Service.exe 4644 DiagnosticsHub.StandardCollector.Service.exe 4644 DiagnosticsHub.StandardCollector.Service.exe 4644 DiagnosticsHub.StandardCollector.Service.exe 4644 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1236 2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe Token: SeAuditPrivilege 4440 fxssvc.exe Token: SeRestorePrivilege 4908 TieringEngineService.exe Token: SeManageVolumePrivilege 4908 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4536 AgentService.exe Token: SeBackupPrivilege 928 vssvc.exe Token: SeRestorePrivilege 928 vssvc.exe Token: SeAuditPrivilege 928 vssvc.exe Token: SeBackupPrivilege 1932 wbengine.exe Token: SeRestorePrivilege 1932 wbengine.exe Token: SeSecurityPrivilege 1932 wbengine.exe Token: 33 3848 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3848 SearchIndexer.exe Token: SeDebugPrivilege 1264 alg.exe Token: SeDebugPrivilege 1264 alg.exe Token: SeDebugPrivilege 1264 alg.exe Token: SeDebugPrivilege 4644 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3848 wrote to memory of 740 3848 SearchIndexer.exe 110 PID 3848 wrote to memory of 4808 3848 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2f5147f481e82f8714261ea5b4a476d5_cobalt-strike_icedid_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2080
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1512
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:612
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:964
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:808
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5032
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4620
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4224
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:320
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4560
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1764
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:556
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4544
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4640
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:928
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2684
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:740
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4808
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 a55628cdeef13518c0800db924f041652e481821ceba0715c3be77dd7b428902
- MD5 2ad621a621c428b08630fb6e371d2358
- SHA1 9b4765a914afefab5a7fc9dd162415f99678a03b
- SHA512 c8873bff828b59bf8153c66c6cd2304eeec1ab9063ce342c19f1f847f799d9fadd660ca2ff4b97532fbfa3673a881e86602ff5072abdb8d1780eaa52607b8f99
- SSDEEP 49152:Jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnaSsLUX6WH1aUh:f3q6sjBWsgKWH
- TLSH T190D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 1dd07974d9556f726c13d660aa841369161245e837da584187957a005fe22d6a
- MD5 2865f6c46804d54ffcad842d3d75f3b1
- SHA1 2cf536adb8419bf4a54e53c5246a68d9d29d5ce6
- SHA512 7fdcbba6e9d7f2327bd0deb4e09d290663618a363d5f9d440af6d0c2ac722becd28f4e43ec625650a9e469d4a2c0fa3f0e8282857b0e07ffc594536e1627f608
- SSDEEP 12288:v1XLsswWkxy2lRq2czAfSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:NXYfDtczAfSLexL2gyX6WH1Mr3nQzh
- TLSH T17505F12977E408FADD67817CC8A28515EA33BC8647A0E7CB03A495691F333D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 0dfcec48985f1ec8f7c86a7f7d80a41f975ebd6dd4d42b57363665cb9ffa94d9
- MD5 b25aca33d1936e2d7d1f1490cd7627d4
- SHA1 c9d87ea20c83a0e470edd746fd04897cb03583bb
- SHA512 a849ce54ae953e26e9c33e01e1deb1faf597c8906ceccc8f789bb08456c6b4f918320fc7cda66240a0f328b2657e33414ad111631eaa81eb0b464f92b5991e12
- SSDEEP 24576:U0Le5ji0hmxxrMiSLexL2gyX6WH1Mr3nQzh:UPji0AjJSsLUX6WH1aUh
- TLSH T1BA359E16F6748335D073C0B9C5D2A69EED7230865B308ACB4286D77C3E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 128cf537fad2d19b1e003540e9412892ec04f0194fdfe352c0de9431bcd7a6f7
- MD5 355aa33bd1580b51791561df541d185a
- SHA1 cb2a705000429aef2f60888fc70e93620c5ba5ec
- SHA512 bb9c2302387032e92b39dc9f83aeadf8d29faf432d54b36a5af774b31f224f6b960427e3dd27176ef1ab815faea7809a694402d03af4cab11056a82ea69a5a49
- SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyu4SLexL2gyX6WH1Mr3nQzh:U/ezSC6vUzPveHjy1SsLUX6WH1aUh
- TLSH T16A755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 c91ed0392265318083643ba4b598553cd417c4ece2bd796f41e1bc9acd27e41f
- MD5 f0f0307b7180d6164cc3edd91120c139
- SHA1 1d9f18973fe5820abd1e42f130cab31f341adbec
- SHA512 067c13376a9a3df214827e2bcd20ace7b1ba13b20ac43f2cb9be29558eac3b29f6eb46b4200e533dfb161e5236793a49150cb44ff282d6bc9a2329c5894316ac
- SSDEEP 24576:XVbqPb88hv/l+YDSLexL2gyX6WH1Mr3nQzh:XVO88hXl+wSsLUX6WH1aUh
- TLSH T1FF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 e80807f3e0bf9d7d5f21a0587c7304549888827edb6d8a60a94e38c1c1cab14a
- MD5 d8a326550586ec0ff3d45d84eb648ee9
- SHA1 de0929e9973c2b162f8b590498f14b860cbfee46
- SHA512 131678956ebe4fa7d385c46f0051ee157df054e41ed14578939a9b65a4a4ad1cb7d8a7d2e85aa52e083de88247b58ed6851a40bc6315cd3393335f28033b2b4a
- SSDEEP 12288:0LGSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:0LGSLexL2gyX6WH1Mr3nQzh
- TLSH T1C6C423AB6AB434EBDBEB80F859EB04987E02FFC718914687E514F09D243C24BD92D547
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 21647f8e53d28780c8bc8c1e6d7726afe51ecd343a56113588c2158406610241
- MD5 7b0870c339e08e0b257cbf15e400533b
- SHA1 c697a985c5433be45205254b187fc7c39557ae3b
- SHA512 4f05b0088d04954aa6e3d4d36f74e504c96aa221f860dc78c19a5387bfbe7bec2b02fef6bbfd8a8a328d8db58827a4ebc8f86b377d17fd6fdfe4d8ba153edb48
- SSDEEP 12288:zeBNUbTVO86UrSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:zJIUrSLexL2gyX6WH1Mr3nQzh
- TLSH T19505CF7BEE38FCE2C27A8CB85A918240E76278714F6293CBD165C20EDE235D15E79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 7386dc9fe6d717572e9f4a86e95ae2bfbc56f11938a6ab941d5c7d10e03ea45d
- MD5 c56957eb87f82c585fbc9e0575a30379
- SHA1 7264bbddca38dd7e6d974ce463e08c4636743af2
- SHA512 2e4874a10a244aa8b73d7efbfa00767130a26addaa51ebc61ead3cc08cb722df385421f1d98d89d2eda112db2dd352619e6ada8b22008c3386a97e54c25ed31b
- SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:mQvGAdlCEL8c/DRNw5CVsgKWH
- TLSH T1A6266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 ab573a65821538d2ab438d52d34f579514d3e2658d45532bec280b01ccabdd0b
- MD5 3cb65ade604f3dada2d9bb262133de35
- SHA1 c79aa6ffb2a77337ac3abc25bc6d4577c7becda8
- SHA512 c90f05a36b8596b38c8267143a3519e62b82c775404da227bb37691eb51477091d329a228860e7ecfd4c61db73d42f6b856c6c158e8a559cc2c71aadabfb95dd
- SSDEEP 12288:hAwSfxL/2Dc3RDLLmt0LDQewsAj5SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7un:C0ewsAj5SLexL2gyX6WH1Mr3nQzh
- TLSH T12015E031FE74E036C7BF0CB61B76C716182DBA604F511AC3E3A8999D59342D2273AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 932314993391f95fbea916e7e1e6451469d93d7de2d89c1d33993286d1cc06d0
- MD5 4e690e1d0cd5fcfd9693bcff58b67170
- SHA1 9b8149212e97b02b5ccfe94f49d36c770f7d7795
- SHA512 9d8880f908285c9701486b101bd41566c035a171640cfb9d3fc23fd37511fa05148948ab58af22c5aa407e8d6b7815b9184d747f4b563d73bfe7d9d29b0676ac
- SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmK:jUEtQevvqc2W1cpV2tI325
- TLSH T14D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 fc7bfab88fbf349a11847602f2f11b0c52f371d3087c8408e20fee5aac45af9c
- MD5 03a62d998a9cacde2aae6c98090e1e06
- SHA1 85bd0eb2f224c48759b75cf8a1851c844f6f4fdf
- SHA512 d04600d0a85aa6e123efa2aaffa2277495c5ee9975b870efd09d09ef608db024e7a48f385492d47191977d483ab4a0e5bc66a6bb19a7c75bc53d2da9b7fd7758
- SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/zZSsLUX6WH1aUh:foqHVjnmpsgKWH
- TLSH T1ECD58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 779ba2e56d2f06061e85bee5f2478549ea15bb1c9917f1675a61f4a460dcaf76
- MD5 a1edf4659e426ffd9aef78e6c7bf99d5
- SHA1 b709aaf78e368fcdc6d124f9a222188970158725
- SHA512 d5bd2a2e2d0be7fa405e3b7e2f7e7d8a7f3887932baeac4f7bcbc1ad9d883917b16ee91f961fa064294b733e6b3ec3805e15a8365201575f7bfd83d8fc963b6a
- SSDEEP 24576:JAhGL3IFoiwtA5l7S53ESLexL2gyX6WH1Mr3nQzh:JAMUFoiq5USsLUX6WH1aUh
- TLSH T1BA359D81EBF955D4F5F3AAB899B68170EA72BCA65E31C20F2150D11F1E37A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 edfefa3f7a886d203dc1715e13363ef74b2399f396bdd203e92009bf10919cc6
- MD5 dad24bbedfefc3db84fcae5af9e5e0f5
- SHA1 fa4d23b14b91eb6b690cb0a52596a6c371836c83
- SHA512 b9ce160f4520ca728dbeeb31dd832a316619d2225ce717d6ee4ed1cc316160ee8f7db234956fbdfd169b428f29375837a6b2a93602b6168927e38cc39d2593c3
- SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CYSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:9wu4OWVSLexL2gyX6WH1Mr3nQzh
- TLSH T1A805F14A76A41CFAEAA78138C5978135F7B3BC022A21C71F5760C65B6F37351AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 c76ba1b32685e98cc90a5ff8c3181da8fa7ebaa96a11b990cc152516e7d9e6a2
- MD5 e6b6cd74b24b828e266053bf115bfd67
- SHA1 a6900cdc6ae135d0f0cd3dfb9add25f124c6946e
- SHA512 f89209f5b69827e1487d0aee924a4a9e794e51ac256bd48ef325fdf7c9e146b8402ec0f09879cad0a9e649b7cb20edce7572d68b11c1595483b8848ac499062e
- SSDEEP 12288:meZ1IypSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:7ZuKSLexL2gyX6WH1Mr3nQzh
- TLSH T10FE4129A36E430FBD6A381BCCCE60548E762BC83177243CF552491992F36AC65E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 6feb267f53caac39d24d5124a4f05664fadb535a9e722fd777a8942e667d649d
- MD5 e61dd58f24549e04de22baba48a781cc
- SHA1 8a35a52ef2ebce330a8a81c2b7dabc54bb357c7f
- SHA512 c4167540cbef42a13fe904b57cce04e17ffe1f7d44b177b6b195351f8e0c7a43816ea880d06b2c4378fa19c8111a441d0a836a0aae3220af60556dfbc52012b9
- SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:2QRQyi36YOcPbLvw2gAf+PN3ysgKWH
- TLSH T1E6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 15b5ee6c58107833fc877583291fe98186e77a9e5fc8010487a12f0107aedad3
- MD5 800d6a922189ddd95b89000f27d038ad
- SHA1 15a052095b0ce963491ef71e76bb7f3d0e960ab7
- SHA512 b48d630973be306f37ad0ae977829104192b501d42912e57d0cefdef48c0d2c7116c02acdd47e7f15f13fee3bea50f9e8c0db140193452b298090a9c383a4fc7
- SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:QQRQyi36YOcPbLvw2gAf+PN3ysgKWH
- TLSH T161667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 67149f412eb3efd9a62ab9824547833a45706a42f210db72c97df2223e9aa680
- MD5 c2ba61548bbc66cb1ddcd2c745f372ee
- SHA1 fb1799edf6979b2631c69984bf730e97dd069d0a
- SHA512 2a8a326624ff9d6ef20b16f92235019ba5fe8d4247a8ad12f67240e3397bb7d41fef7dd6e6cf6762bd5322a40cf78fdef4acfa63a367d4c52436839c86731003
- SSDEEP 49152:u68Qg55nhceWu7PNU3/JSsLUX6WH1aUh:8thLRc/IsgKWH
- TLSH T157B55A33B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 a16956c440e9d83c7a1547898559df6253860f46163349669ad54127e60c2211
- MD5 f6b837f079cd37e29bc70d4c32ec0d6d
- SHA1 2c205731fe6d281a146c90038705ce786865752c
- SHA512 d7ab8898f1a93f6ec313f9d91c09f90a44decd02c3ffbd8a3462773f1cbb246f230fb03fd464f5cd8bbd19fb030cc2adce80ac2713f36e5e09d9f9f687b38162
- SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99s:wy5112gYy5azzVvt69nLKnhZXsgKWH
- TLSH T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 8e6a6e8bc732a149517b4a48abf8351609376d4292f3a6f13806ab3c7ae1cd73
- MD5 3a4d630f3bfcad8c8c5f80e836a3aa24
- SHA1 7964ce88ef3e01dde306535e593e5a32761e1228
- SHA512 17dd0d55995debb1367113d8f969cf8624bb86a1ad364e092bc6d441f3f9de04ba170ac923852de26556d2f1be7e85cbe0b23561127b40b41db5ee18ee78c203
- SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvSsLUX6WH1aUh:Ru6Jmdxd2dKsgKWH
- TLSH T196D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 580736952844c3e4f2fd727a32a0c4df1bc4d1991fd1d7f672b0cbfedf97b676
- MD5 ae2f1de5dc4956434bb878226a2ffb01
- SHA1 f2657913e0bb7566a03ccd958d47451a5fa533d0
- SHA512 3ceaa018f2ddd9620991e399968a42357e8572274fb26fcc6b7a562608df25571a5223d44e8837e7ddbbea84194c7699d4efeefbfbf151cd6c02f7f9a42bfba7
- SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4xLSsLUX6WH1aUh:MmifPWRpsgKWH
- TLSH T165B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 fc2c6d5d53d554506791e8434fb95082a4b7a234e25060cdd00e9d1d65812392
- MD5 0b3e2f87a83f1070cdb172d5de696fa3
- SHA1 93f1b82009c8c886a660f5819a28a768124d0a08
- SHA512 255c86609b570775a504db39f6eb988b8e32062326e01746d9efe092a97363f40555de392b39eb80c8e428fa97b6914640f6134f6c03a86cf4dac2abc47dd016
- SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqKSsLUX6WH1aUh:D5dKii61DsgKWH
- TLSH T1ECC5BF13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 7e3bf996ad962b23961769bb0e999b0fa7bd36fcdff2ed0ef0d0aff9c5627daf
- MD5 137cbfdc9c29c3f4738e2ff8f3167c7a
- SHA1 736bd4c8e5773f6e096df9c44e4cafd341908223
- SHA512 78d1c9158fc25ff5def77c391d2bd782845708aa9f8c61ec769f2c4977cab468372ad3782d1a1eca73466b63c2ceaaff5618d98676e50bdc21351ffccb22bd73
- SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wfSsLUX6WH1aUh:4X2imphdsgKWH
- TLSH T14795BE13F2D900E8D05ED178C7568632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 cfc755d292fc823a59e3bdb67eca5b10c4f547cf33190a297be3d078441588f6
- MD5 564847d7094ee9203e3d329522d7d5be
- SHA1 70d6635faa23d58d7b5e55107d35f1dfd6fe928d
- SHA512 7ce66d991241cf5c8b46be3fc1d744fa7aa032ade591d01248e97aca538b4277d36e2ab49c2edbbc7e8b4de4ab643bd09e0b7ff531c1725bf60df242353906eb
- SSDEEP 12288:NOSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:NOSLexL2gyX6WH1Mr3nQzh
- TLSH T1EAC4239B7DB524EFDBA680F889D7019CBD02BFCB6D924287F509F04D253C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 a7dca7c6582feebe9f22f03464b946694ce1b7839138eaa787c6284993a0d7ab
- MD5 ab37b1687ceea0e123f0d37b92fe17b8
- SHA1 459ff93cee96d1b728fd8a1e355e857aa14aeb50
- SHA512 1f9b04d04f97e0821e233929233f678abfd185a7387e296c6858c332ee26669a02ae67dcc9273d8fad70c8088da45055f84a629c1eb9795775c0df2a1dbf0bc4
- SSDEEP 12288:8tSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:8tSLexL2gyX6WH1Mr3nQzh
- TLSH T1D0C423AF7DB524EFC79680F889D7019CBD02BFCB6D924287F519F049253C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 59b3f8935e79e0e72d5fd0a02f417c3e9cb7e336d39fc9ec002c4ef3210508e8
- MD5 58a498d6daa15596f03e821383dc26dd
- SHA1 800230daeb9d27eb0753b6ce66b6137a248d4205
- SHA512 5a828551eac5f3157e2df16c45c189442fee384739644b2bffa758003ab017bc7eefcd4d02220186f20d8a63374ee2e4fb10222d525635192efaf8acb0a97692
- SSDEEP 12288:ATSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:ATSLexL2gyX6WH1Mr3nQzh
- TLSH T15CC423AB7DB524EFC7A680F899D7019CBD02BFCB6D924287F509F04D253C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 82a47648165e4465343b22999cafdebe744efb0ec12f993174e8af3f7a50b4a2
- MD5 b8b599d553af5ad045d54269030fb079
- SHA1 37e6226ccc39af659f69c1cc273312054f983a3b
- SHA512 6d9a042655dde2136e7ad1345709fe905ad4648dc55f41f8ed8a543c2b057c9e0d97d7e5223045ff246bf96d25d7c4e4e85d04596021d21e9ccd5b764dbdaf99
- SSDEEP 12288:iVkSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:lSLexL2gyX6WH1Mr3nQzh
- TLSH T19BD4235A3AB520DBDAA7C0F8C9A70158FA52FFC75A7253CFE600608D1D783865D3CA46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 6995b8b8a25d9c001f3a957f46e7f04e49e32fbd05d4e9ff2b7a13108264ebac
- MD5 ba18e13db38a05c84f0a8f0d341d4877
- SHA1 f17a2ff33e16521f61292cf6a6e0217e28d3a22f
- SHA512 679f82638da9c7b55c45b0be0d4fa30a7455ece895e0340b640aac2ba3b497f1ef55bb1cf3e76581af3b40aaf55c77d756f9c4d9286f5dc8a5f811c7e7cee748
- SSDEEP 12288:/cSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:/cSLexL2gyX6WH1Mr3nQzh
- TLSH T152C4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F509F04D293C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 e977ec12dc869a54c63bd040f9a539db538775cc9669cbf3fd8975cee93bb77d
- MD5 22ede03587c78a323297636ab0f586c4
- SHA1 69b781b4bda6ba78ad5811bd56edee8aa33c98e7
- SHA512 97ba2ee641d17f3b0aaa4f47f1751ae0bb1bb6a79576b29d9d7d0bcc52dbb55bcbfcd0becaa758939e23f6026b4d8e8e99ad2fda3313bb3c7dd2e8770fd91651
- SSDEEP 12288:UhSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:UhSLexL2gyX6WH1Mr3nQzh
- TLSH T15FC4239B7DB524EFC7A780F889D7019CBD02BFCB6D924287F519F089253C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 20d4e5c7c3ff1c38c69ec280549a7538417269b667b93136c8a43bf74302ff1d
- MD5 1cd413b1fbc38a5f3399bcbb388863e3
- SHA1 af52cb18c1482cbf572759847955bba8c3c2743e
- SHA512 5902ba9e554ad4a38beed16c47b87636adbc9bbf5c5e379a55e225067bb081082e1489dc292ae9c325f73065920ea1165e02255e136420a8a3410ae761bad3be
- SSDEEP 12288:qlSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:qlSLexL2gyX6WH1Mr3nQzh
- TLSH T1FCC423AB7DB524EFC7A780F889D7019CAD02BFCB6D924287F519F089353C24B591C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 b87a336cfcfbd76fd61744c92673dd7123425bae0c04187538edbd8a704f1ebe
- MD5 51cac9493ae15c8688ff1a87a696cc69
- SHA1 8c3cc3740e47739a52f50d864d8d0c97546237fa
- SHA512 ebbfea3d0c47a4aca1c36e265e57b0c939278beca4949bc86bdfd396a5d5cdc3cb54e3248515fc887dd154f9e216085045fc6a2d24cea2e3793a52923ddf12c7
- SSDEEP 12288:MiZwbVzzFEoS2cPvyNSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:vZMRzFVSONSLexL2gyX6WH1Mr3nQzh
- TLSH T135050299B3A018F9DDA7817DCD564905E6B2BC5A0BB0C60F13A4326B1F373911C3DB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 d2f928f7ace046c382fd72d51680e8ff2776bf008b30115302730c6a80a7b41a
- MD5 d1153c223cc4314cbbfe2afddff6e8d5
- SHA1 3e47265c34c076eb67882a37d86f469999d8e330
- SHA512 bf3307f56ab819a25690722644e514156e399228faa647e5d87e0a70cb26cff3d88f0cd3ee8122555f852c0294f9e3ac26b79a299c5d597c1f8bf9b43e836bf0
- SSDEEP 12288:u6SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:u6SLexL2gyX6WH1Mr3nQzh
- TLSH T1AEC4239F7DB524EFD7A680F889D7019CAD02BFCB69924287F509F04D393C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 32a373ccd35c09d6c071b64dbf197505ee63cde96a9bbfa37c6880d80558d7e6
- MD5 952984ee59b16561f0fbb39291fce0db
- SHA1 2076f8ff7fdf612fe2a46a47dad6a79e10ae2b7d
- SHA512 e94b5b32708cdecac5bf699d8372240fe17ff34541ab5d09623974b425c622958191cdaee49b4f94f25d2ab857f22fd57514beecc2861da8faecdbccefed236c
- SSDEEP 12288:B2SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:B2SLexL2gyX6WH1Mr3nQzh
- TLSH T191C423AF7DB524EFC7A680F889D7019CAD02BFCB69924287F509F08D353C24B591C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 3581487a353db48e851ac43c13fe33c5f6c500a52c864b205122021abbc535c1
- MD5 b69f506677c4bc8137b97e6f632af4af
- SHA1 53e92aa2b8ed385e06ebd7833f49eaa2597e8f3a
- SHA512 a4d223e28a55aad6533803e10fc557bae3fd131b6cd837bb4ef351ca7c50c3ce49c63ed739216e86ecc0e9740a44415623769f2b4861f0c4d650e0917e38079d
- SSDEEP 12288:uyPz5L8pSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:zzypSLexL2gyX6WH1Mr3nQzh
- TLSH T120F4125B77A130FED1778178C8A20A05F772BC730B608A9F5364527A2E372915E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 d46fe04153ac3506fe9f39f21e54ad9fb3ccf731d99741fee69d7e86b7a6a857
- MD5 4e45a5153ab45767222345c16f35d1b1
- SHA1 7302ab699d9319c7b221a10ccfb614f466cc98d8
- SHA512 d313ed44e6877fc7973353d4142e1534262eedd2196d8896c2fe9d8429c3e2e760983523bf1e4126965e41e9b0694ddd1ffeb103792f31a46c49743f4b42a33b
- SSDEEP 12288:z6SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:z6SLexL2gyX6WH1Mr3nQzh
- TLSH T1C6C4239F7DB524EFD7A680F889D7019CAD02BFCB69924287F509F08D253C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 7e4cbc03cf2fbc983a701746014becb44f2ed45999460932f244f51dcb5b3dd3
- MD5 4919f76333d048517a8a2cc761616f80
- SHA1 2fa1affd7aa12031868ed0da9a8277c7886df418
- SHA512 60293bc5c74365764c2e9fae33fdd6df6983faf708ceb22bc676359c6796e23cdc78c4ac5e742259bbedb66945dc6587a9b89246d64e860cb592e968970aa884
- SSDEEP 12288:n6SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:n6SLexL2gyX6WH1Mr3nQzh
- TLSH T1BEC4239F7DB524EFD7A680F899D7019CAD02BFCB69924287F509F04C353C24B592C58A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 29a07d22575184236ec7e2d9cf0e21f0c6e1a32d95b0e14b5c83d02afb296391
- MD5 7fc2bcb44f09c49a6e085ad0a8a818f8
- SHA1 5717701d4df6efb72c787b98289c27edfb8009b5
- SHA512 918a884176c94143414852e57bed651500bb88dc6f6cd8724701f959c3cb2525bbeaf1ac11d6db979728d44440189206134fa805d66b124e87c07e02f1a34e9c
- SSDEEP 12288:SyPz5L8pSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:PzypSLexL2gyX6WH1Mr3nQzh
- TLSH T12BF4125B77A130FED1778178C8A20A05F772BC730B608A9F5364527A2E372915E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 0028204ac848ccb880562c490dce91705dcaf3b81d2f3f2fa20a0ffcbe0ef086
- MD5 67b129ab11410ba860208a8d054a401d
- SHA1 2a6f03894bbab09c2f4f5a6d2ff27423ecbf9d2e
- SHA512 7bf94f53b037aa506ca31eda23b94b922af8753bb1799124b05406e72f69adb15e8d2c5a0085396615193d5f63d0c328fc3b6d279eca3b74970bd446b6bb1011
- SSDEEP 24576:jcP4mcvIjkGOxhKP2l71SNKbrh/8KBySLexL2gyX6WH1Mr3nQzh:YP4m4IpOO67N8KoSsLUX6WH1aUh
- TLSH T1DD65AE2DABDC0096D0BB917885668A49FAB1742A1F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 3a38d4242dd6478f88e6c634e3ca488e07035c87ecf245323bd96be2cc9a6532
- MD5 bcf76a4fa7eb412c5bd67d81e505f922
- SHA1 b570099bb34fcaebb607980b8b7e9aa535166278
- SHA512 9a6dbc69e888890fc6bb9753f0f37e19fe328f3dee4a5094410808e5511604a8753c32d846e4302684947c9c5ae6f880b9f12cc312471eedd71a1bb779dadeec
- SSDEEP 12288:NbsfKSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:oKSLexL2gyX6WH1Mr3nQzh
- TLSH T122E4015AD2A811EAC1AE51B8CB960644F7237D5687E1D3CBA2C0F07E1F392855DEDB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 4323c57301a05892515a967f3aac0ca0a66bc503e684b126743f5a2226243b96
- MD5 96c2ac5599c84659f543cf64c60293fa
- SHA1 a1278801eeab47bea6bea1da9547ebe914d39345
- SHA512 d21dfadf336cb282328c5d4971bbbf8d5318a5465f8b30c683f2e91e655e0fbd67da362f7d3e82a8705ada306ac559371a0b0048d56b5dd209f7d97474f844f9
- SSDEEP 12288:uqSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:uqSLexL2gyX6WH1Mr3nQzh
- TLSH T16FD4236BAAB8349FD7F790F4599701687A03BF8B5E918187F504B09D243C68B9D3C60B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 0bb9751d8b464777aeea17dd3379f1364e6a26487bc41034637da516a9f5ef81
- MD5 c7ef497d207075d63d5b2c0f13f9ccc8
- SHA1 a0f1604a49e58eb6fa93cec27b077d96450aba95
- SHA512 7edf3e5f715d04315a9b72a5395f8d594a8523eb543b9b7f2545512d4670426776f1a6c633a38d13734b1c1b9838e833f3218ab9756a7b43170b5c150036c7c8
- SSDEEP 49152:ga0h2GEkuAe73q3pp46zwwQcSsLUX6WH1aUh:ga0hNYG4JwAsgKWH
- TLSH T11A85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 c13ef7c7d6fe873b5d916a5b2ac6bae7444979f5685475fc5de23f4720febd22
- MD5 10441b75b5b2a68c39442c9e7d531350
- SHA1 7c05126fc81dc6446ba34e6ec3cd14b824a52d73
- SHA512 1bd3d8f09ecce5ffaad365c2dad51261e6ea3043818891042a1586ae1c4b05b9d61c8f23d923437556744902ca53ca40626f7091c138565eca04dfd8f270b463
- SSDEEP 12288:6hbHjfX9SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:6hbHjP9SLexL2gyX6WH1Mr3nQzh
- TLSH T14BE412BE26BC20DAE6B2D0BC89924149D731BD561B2193DF6281D17D1F3BAD90C38F42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 cfabf02ff84e578c8cb7e3693c4f84e29054b9c28a6bbecd409bd84a5016e2a7
- MD5 69932b6dd1abf8d9862977fb8027a7fe
- SHA1 92e0076b210b5dbfbc1696748c6f341f68e1a968
- SHA512 aac03a8971193ab4a3f2f1bb340da03b7158651fd538ed511724bfae0665e605e067d82b82ac87d08bfbe393f221e69cd17ec8eecece8721e7a4f80612de62eb
- SSDEEP 24576:F3YgnJcRTk4yti+R5dpR/VSLexL2gyX6WH1Mr3nQzh:FIgnaTk46ppR/VSsLUX6WH1aUh
- TLSH T1F045BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AED85E39F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 d40e68fd9006b8728a9e5c403f9eee1fa1cfacd5a46b00a4c792b9683f3d09d1
- MD5 cc2bba4b75c3a6f1de89de34a2cb74eb
- SHA1 53f91304cd3f62f7a6db6b528f528f6f26421d53
- SHA512 ec3b4a3c997404ba137a1415ec87b62be418cb902b4b20c5ab1c6026349bb66c43ed8e0181dd7a88be63e54f05281f511004530990552e25451baa6c43d55217
- SSDEEP 12288:0mSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:0mSLexL2gyX6WH1Mr3nQzh
- TLSH T131C4239A69B534EFCBA680F849D7019C7A02BF871BA242C7F419F09D253C6CB5D3C546
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 bc8c31bb66d71f641ead594b711cca59983db5dc4bc8e6dd53e4748c92ac7a20
- MD5 09501566a623bd7dae7caef4c3808691
- SHA1 89b5d8a462b68d6e1a08ee7abf0cac14df1dd1b0
- SHA512 f0198e68a00a860f4676f1de7b606617ed1fb89c89fbda178419379461d098001a7113ed0fa691be9f450a8245a58842c98fe73bdf4e6cae7133d6cc85471657
- SSDEEP 12288:GObfA4LWOsvAYFTfSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:vbL3UTfSLexL2gyX6WH1Mr3nQzh
- TLSH T11625F155F7A400FAE977C17CC9A38516E672B89E0760E7DF03688A651E233E24E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 5e33ec5d847568cb9b70055610f9060b3367069495d142092bd645ece09425a1
- MD5 ded82a7af6a857f1eb16653b76285d80
- SHA1 b1a88842cf16151372d12a194340bd7bba5431e4
- SHA512 faf79d6eaf1866375041b4f3e29461f893736ed73a30400875360e5e0511e39792d832f1cfd26bfa94c1871ec0856c3f28f06d65cdca3181b4c07b0d9804cb25
- SSDEEP 12288:EpFtIOLSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:fOLSLexL2gyX6WH1Mr3nQzh
- TLSH T1DDE4026A36EC20EAD576907C8993424CE772BD570B2253DF429080BE1F77BE85C3DA52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 189f1f546b09cf72cbb5d85b6ac21177fd4d6ebfa9dc7dd38cbd888878f49c6c
- MD5 85fd017b910296570757677734c2e0df
- SHA1 bff4f9c16287120a00a09902f895e45866d59260
- SHA512 3484ba1d109e7cb9c49a51ee5e6ac51d87c528a4652b4f42f1c83c31856c3389c0f9a1bbe9e27f675a7e201eb20dc5b099e2bcd69c18a4c46e6f329eb2ce1c61
- SSDEEP 24576:37NM9YmZqmWMUkPjZM48Mv6bEhs6SLexL2gyX6WH1Mr3nQzh:37cBWMpPjN8DbEhdSsLUX6WH1aUh
- TLSH T15B65AE2E6BEC81E5D577C13DC9E28205F6B2B4611B318ACB5152833E6F37AE44E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f651420db84f0fc58f8670aec9a3095b81898de56d47d320c6c6d9cb30a99ae0
- MD5 62eca25c605a6a1d2550a7f623e84105
- SHA1 35627a11fd9a63a2e9c2d8efb29d68f6e81ce4f7
- SHA512 a1ad21d0c209786ef0c06d1b08a13f95d9d63422efdfbcec6c03aeba64e8e471116c831598585a9365120d3811d9b0d62a0d8e939286680cc2174ecacc33bead
- SSDEEP 49152:TF2YuHNETovcvNYf8kmaSsLUX6WH1aUh:C6tCf8k+sgKWH
- TLSH T11A858E2A27ED80A4E0BBD27D45B7D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 62a4d43d9437b815cb44a5331265b910e627a3cfd58b84fc0f0b0f4ee1807ef3
- MD5 30baeebfdebf6b3571f7810967ec8e45
- SHA1 cd2cb4f13d65f7f978e092e871e44a7af2cf3169
- SHA512 83693eda454e180ff1aac25b38be000afaa54c451a1448eed3e86e8bb05c7bae19af9a8bf01b813113bc4ab5fd800e00b9f5f8a49ccdd49137e5825312326081
- SSDEEP 24576:mAFs06+OmlfkNXEbTonSLexL2gyX6WH1Mr3nQzh:PFs060lwXu8SsLUX6WH1aUh
- TLSH T17E65AE2F66AC00D5D07ED17D8A97C91AF6B1746307215ACB0260C67E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 b9aa1102b59305fd00698844ee5dfa7dfa85e64be05f99f3995f6a51c4efda37
- MD5 d1b4a5e4a742990eded94862a2a11491
- SHA1 61fd2e644cb0720223ad1cdf1cba2098bdc68b87
- SHA512 0e15a4e728673afbd717e2d266a39085173e15760e46159b4b76800e8863c8e6996c1621a09c28cedc354a8c8c6fe22f1463f0e427805ea5d210f8101d05c8f9
- SSDEEP 12288:PCJnJ5D3VkrlzxaSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:KJnJ5D3Wt8SLexL2gyX6WH1Mr3nQzh
- TLSH T11815D02DD2A810E9D4B7C2B4819A1755FF72386E2F226AC76874D4353F22FE09979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 204fa798e1579ed19edd57cb32350a5551d8c19d03355bd29bdcec83138eaebf
- MD5 3f4a74d94a11e8d05fb3965b681db670
- SHA1 77abc19d51eca799193d4986437862c8fab4448f
- SHA512 cfc09e5cd4db1cfb4f23706cf0e952bade4c97d170f2dedfea30d0f6f74b6cea17665f3c5101fbe0e1f8c73cd4a01a453bb01b8cc031ed75c4eb25af3e0b7d5c
- SSDEEP 49152:Oo06DIKdwc+eQnSt65aVOSsLUX6WH1aUh:nNsgKWH
- TLSH T194955C16BBEA5295E8B3CAB1C96291159B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 9f87b5cdaea725a9b5fc1cb0248edf9c3c13d354cb3e80133e3946e846ba7341
- MD5 ce15c772f2c354ec61c7a65ab78d8992
- SHA1 146dfe2b06f8f7a5acaea97b8080b7e5b7fa4313
- SHA512 41919be989228d1392e6dd78883ec67f3f3f133fee3934f3dc0ebab825cd5fb44a7f5fb005e89c7ec5315c2c5d287587189653d9973dd41e7877cb80a592a1d0
- SSDEEP 12288:tEP3RrYSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:OrYSLexL2gyX6WH1Mr3nQzh
- TLSH T1F4E412AE3BAC30EBD176907C85924148E372F5A22B5227DF5591D17D0E3BAEA1D3CB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 873cca5a0d99ed57d2c62061e75143acde3babb3f6617242f1489abbc535e25f
- MD5 67dcfa1a01c4c61f5d0988d84716eb8e
- SHA1 8db934800b50883f8a7a46b8eb2f2b1076a3e54e
- SHA512 930cbf73471671c71d23c84f8811407a4e2e27577dbea7dc14dd8e0bbd5daeb7355fdff49a2b82d71fb1ec2059ecaeb9b7298c7549523972f9d4b1b8e53ec959
- SSDEEP 12288:pjkytSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:pIytSLexL2gyX6WH1Mr3nQzh
- TLSH T1DAF4124963A430DADAB641BCD9A34194AE31FD525F2153DFA080F13E2F3A7D5AD38B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 42cee01f55deace406ac50607f03a53627f2c17146e4248a4c51f873b093a23b
- MD5 ded41e7dac7105267ffaf2e0abf7d3ef
- SHA1 a7eadecef7853b97670cfdfb3d7ba59b525e5b57
- SHA512 04b9255de74cec06fd9befee59dc0fd2826e0edde616a31458d971dfd057fa74bd0050f35eb09dd73276824d562e731d099580a48396a43d94fafeac27304cd2
- SSDEEP 12288:QF7SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:+7SLexL2gyX6WH1Mr3nQzh
- TLSH T1D9D4239E297530EFDBA380F849A70198AA02BF871F9111DBB454F0BD5A3C2CB593CD46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 2356d1308d7b8033e7116aa958d76366d4ec7917bf240657a622f2abbd2d0982
- MD5 5f63c1d4b286b4baec7e34f3fb420df9
- SHA1 fc60476f1f3f695d33f06170cc78e429d3bacc90
- SHA512 c59d81a70b36e14b5d4ddb05dc21635c7244eb6b2bf40a47af9e01024fecc36084e39dc5db9d44ef2f01b2e8895d9d909ca2a4963bc1ae20a28bf505311ebd7b
- SSDEEP 24576:KQ9MxZKdcz97w3CSLexL2gyX6WH1Mr3nQzh:KVKXCSsLUX6WH1aUh
- TLSH T1F6558D2DABF9059AE177D27595A240C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 110241c4a171d55399436e673e721ad25eaa2d170842519dd7b1de21af277f1e
- MD5 989e5e5745997638ad930f33b5d8c862
- SHA1 43cfce966189ffc3b61f1b9091f926abf49b4c4f
- SHA512 6995500294ab0c6e27c280db5f0469c328383af05b69451955aab0a6943468f94209c1e52f9ef7a19f282b1da7bd3e02c50430a25e3ff8fae3869b134e0820d0
- SSDEEP 12288:5yoKo2HRple9p5SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:5yocxAp5SLexL2gyX6WH1Mr3nQzh
- TLSH T106F4E05FBB6900E2E176813C89868345E773B4711B6253CBA591C33D4E37AE9BD38B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 5de8152798a0f6a8121e6545b00b86c98babd30bbd87766f73ccc2b16b7f93df
- MD5 470577fb9ff33770280795318a4ce069
- SHA1 12f0df0ad7026226d4fcc0ebaa1e317ccf6d2018
- SHA512 76e2d3fdb6714dd9b9c30a6fba215a20a63b3ea6fdc3a900f08717454d73968bd14a307d25a5a4e0bc9806f79a480e7a891e2127259a2bc0b63be0ffac1e373e
- SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK5SsLUX6WH1aUh:d0zuNIssgKWH
- TLSH T1B0A57B3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7b5b49bd8b259d66de358c1a7468d4bc38b3d55a5d5a943c26033bcf553ed5e8
- MD5 02ab969f94f316c1a7b43491b9f4a5d1
- SHA1 eefffce8f9e8f45e3e8cb1852e3777cd2d8b1756
- SHA512 e4f81a5cdd708ef61321b906eed707f4e00003a1350389857e13edae20a2570b1630303228ea5b95609d536f6ec1ee1774e1e680e5af85b2b3b502c7cf4a421f
- SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYujMqbYSLexL2gyX6WH1Mr3nQzh:pTDxR+N5YzT4jMrSsLUX6WH1aUh
- TLSH T14255B02EA7F815E9D1BEC5789A238512FB727851033193CB42A0C17E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 b277affc5df667fca6baa5027677be56c03850ba3ccb177186d697ba85e4aea7
- MD5 672a85a7c7f28d620c7efa7401cbb0cc
- SHA1 53f06760dc05962cae3158712b26d7f2e630fb42
- SHA512 2711e7caed91ad16e07523f3ec06031c9b63bccbae7063154043f1963a3a968fce89fbf8cf7a974a99eb7df00082ea558cc198109f384070c412f2446aec31f2
- SSDEEP 24576:YTMdOz0FFS+bmSLkSLexL2gyX6WH1Mr3nQzh:w0K+bmSLkSsLUX6WH1aUh
- TLSH T10D15E17EA3AD14E9E57BC17C9A438906F6727862032266DB0690C0793F6BFD4393DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 48165da8b88704589fb62f3396cbb8cab622c4f072f1c6277fee5e08842d136f
- MD5 5e6cc6a3f5014890989653fd29db387b
- SHA1 3aefbed20f655910ca580c1a8fd4a25d4265153a
- SHA512 3852f2e7e88d6be1f4bfcbde7182a6c673cf1fef43e2ef6a10bdce4a2c2507a0b53f664c7b04582aedf9a3ba0247428fce8db0b2fc70b69eaa06a5df373d8f0e
- SSDEEP 12288:F47fSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:AfSLexL2gyX6WH1Mr3nQzh
- TLSH T129D4125E27F830EAE5B390B88A6701489621FD67176156FF74D0E0BE1F3A6C5993CB02
- MD5 SHA1 SHA512 SSDEEP TLSH