Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 23:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
- Size 13.3MB
- Sample260810-3m18rabc35
- SHA256 02225e265693ff0d95e75b5433ae8139ba0677b5731e302d417865cb3fad2289
- MD5 a28c1e39ef47f57176dd61a02d078392
- SHA1 751e114761d220dd6a35be9f925daebce58ebc37
- SHA512 778300873579eb00a0f3b82d1fd53ce5abc1e35d55b82f777ec9146befd21b21843cbbcbab4211f93aa1cb5b7e94f28efc710d8598b783075bcead696f55824b
- SSDEEP 196608:7Tun686Yu0ywoPnG0MFbGGLsXPV9WzZ4F9:7S6JYu0ywoPnFsGwsX7Y69
- TLSH T194E65B1A22A802D8E1B7D27CCA96DA07D6F27D154F21C7CF06A46B5A0F33AD44D7A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5536 alg.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 3552 fxssvc.exe 5452 elevation_service.exe 6088 elevation_service.exe 2188 maintenanceservice.exe 1636 msdtc.exe 5960 OSE.EXE 2656 PerceptionSimulationService.exe 4468 perfhost.exe 2464 locator.exe 5292 SensorDataService.exe 3284 snmptrap.exe 5528 spectrum.exe 1184 ssh-agent.exe 1884 TieringEngineService.exe 4884 AgentService.exe 3560 vds.exe 1336 vssvc.exe 3400 wbengine.exe 1376 WmiApSrv.exe 2728 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d47e6445a3b5d25.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b4a556f2129dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000443a046f2129dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b828e6f2129dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb6573702129dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e226d6f2129dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000046392702129dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5a9b46f2129dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b76ff6e2129dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 5668 DiagnosticsHub.StandardCollector.Service.exe 5668 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeAuditPrivilege 3552 fxssvc.exe Token: SeRestorePrivilege 1884 TieringEngineService.exe Token: SeManageVolumePrivilege 1884 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4884 AgentService.exe Token: SeBackupPrivilege 1336 vssvc.exe Token: SeRestorePrivilege 1336 vssvc.exe Token: SeAuditPrivilege 1336 vssvc.exe Token: SeBackupPrivilege 3400 wbengine.exe Token: SeRestorePrivilege 3400 wbengine.exe Token: SeSecurityPrivilege 3400 wbengine.exe Token: 33 2728 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2728 SearchIndexer.exe Token: SeDebugPrivilege 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4800 2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5668 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2728 wrote to memory of 1656 2728 SearchIndexer.exe 113 PID 2728 wrote to memory of 4428 2728 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a28c1e39ef47f57176dd61a02d078392_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:5536
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2084
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5452
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6088
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2188
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1636
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5960
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2656
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4468
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2464
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5292
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3284
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5528
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:896
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3560
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1376
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1656
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4428
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8c686a4d395b3b47ce0846f8e08d653024fc3348cb61580353896fa196a4063d
- MD5 3cced4f6869e376f2217b6042e5b1396
- SHA1 8dc7cf0e15c6c7f4662f610fde7478a0b309b0aa
- SHA512 6e78a266011216511e128f9344736f79d851899f1bc8eda236fc1b6e8bf4a583889338f2c337744a6ed3d5608795789244599e426d8f1149dbb3d0aa37bd64a4
- SSDEEP 49152:8b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnzLNiXicJFFRGNzj3:m3q6mjBw7wRGpj3
- TLSH T1F8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 28734c29457a9ef45a7c202af9f5b8aa44e1c6d996052efb43c882b4ff74721b
- MD5 c99810714692d51b3df703b49414b998
- SHA1 c1b6fd9973e0159feac1c6acbe5fd89c971a7617
- SHA512 479ab0834ac1b744092c27f64b32c92d03a6808227ec87aee52567d03f5a0a6b90b0f03af7cef5bab51c5bfc30d909f6db11c9853e2b5611a9f6089c00142c98
- SSDEEP 24576:wXYfDtczAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Htc1LNiXicJFFRGNzj3
- TLSH T16C75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 41d2276079a2c881b6c0955cd4b95a91f72d297b07018219d5b4475e36c80c15
- MD5 db95087fdf154b2acfe923069ad2a023
- SHA1 10bb6c0b7ec87dc8d439c78524d4a761d8338958
- SHA512 6e2ef6f30746c69809d32154aaf00e267a76989609e94b686bab0c924d4b38ca16db4c58ffd097384c17f22155e5576976960276eaec7d627f960aecaafe911a
- SSDEEP 24576:f0Le5ji0hmxhrML/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fPji0AzCLNiXicJFFRGNzj3
- TLSH T17085AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 06e5cba6afb84dd34b84d1b315b8700c68430869bda6403351dacb4bb4dfa07b
- MD5 038056fb5af5cff78b7b0d6d73c23bf3
- SHA1 ebd024dcfc9c626261c47d29f88aec53738196bf
- SHA512 f75cbf0e7db25a85e55b3bff5f23ada1b53c3f2ba84be247ab532b7c37bf003e6590e482cb1c69deb554f269f68e7c4828197e99a47a8428b1e934a45f24a9bc
- SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyul/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1/ezSC6vUzPv+HjymLNiXicJFFRGNzj3
- TLSH T1BF756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 f181915972e19c5f77ad8a572d7bedbb3a1c47b5d41d9b7b377cd450788293dc
- MD5 64ad42d09629f2c40d752fef29d51c87
- SHA1 29f1c7438d7ef11c630e7573d9f32fb6789ab5ec
- SHA512 b73f18d1830393aff257af17dafb00784bcc90535026cc1c99fd4489502697856dc4b77e1dfa0e8e01061a37040611b0be9871b03dfd39ba4983cbc93562b8a3
- SSDEEP 24576:AVbqPb88hv/l+Bg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AVO88hXl+iLNiXicJFFRGNzj3
- TLSH T113559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 60a3a08e8e46e5e4d71a14d5dca55963e17a3cdfc25fd4631059664c59c88c4e
- MD5 d4b774a106b5cf1bdba6b10a1d35d01e
- SHA1 e2b2ff7bd01dd0aa1fcd5e005576dd7b8b36dd49
- SHA512 41970e2eb3574795f12019677317b91c517567def38a1232109ddf61c0504ec344b8182112c8b4ed3d3821a7d6b674b2ae6a79206b6323687b5676235fd471f8
- SSDEEP 24576:LG3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
- TLSH T1275523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 911002c79f472b32bc02cec50fcd33171d1dc0d4596db6e2775dd6428fb6d8d6
- MD5 0c8ed58e45055ad0ad85a4c3d8257516
- SHA1 2c082a3f89ca6ab0e33fe23d0b55e5692f315f2d
- SHA512 ea7fb450961eca07101b9ea7db66259b1f869e630f548b1f4961d57a746856e960dc403468a27e7394c4385620ba8038a5ae662b1d56738f88e561642e253ced
- SSDEEP 24576:FJIU4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJIU4LNiXicJFFRGNzj3
- TLSH T1B175CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a6d919dc2ae2b9ec61afe027fafcd0a1e8bde38789530394ba2ebe015a66a403
- MD5 528e2343f2261d854b7e31be1e3a5ab3
- SHA1 20b81909ba341c81bdb6dcd15187e57d46c97a6d
- SHA512 62ec7bb9a96bfe0848ef9ca63b31b515c54014a85ebddbade8aed15bc2e9a2aa9acea210c2342ce0f607ccef509424dac10ff25a6bd69f185ed1115347991bff
- SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:NQvGAdlCEL8c/WRNw5CV7wRGpj3
- TLSH T1D9266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 d25e33e7dd0cf331db2f662abbf2d3a11dfee31cc7a87c8d0f8ab923697d9774
- MD5 04227101411bcb58693d5486b6427bf5
- SHA1 eb243360cd695dbb4f0282676c15c29a7b4f342c
- SHA512 a0db582397f78649ebb7e60ec6602c94569660a834bde06dba0dcd212ca90efab674fc29dcdd6da521c4bb2e330f22860f855bb74918792266f00996f90d22a7
- SSDEEP 24576:BfewsAjy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9ljyLNiXicJFFRGNzj3
- TLSH T14D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 209c1ed8ecc7f0933a9a49e5a228bd9d17fcbc4d15ad336ad21773315a965dca
- MD5 4189343b5a28801d29fa32acd8c64eb9
- SHA1 258a6199c1f80bbb90e038fb5b022195d46ac8f8
- SHA512 df993bd7817d8fb6f9fbbf9eba19ed061b8b03a44ab46fb654d2f81227a76a46d6e64c6750a2984df77de66f72de96fd18633179e727d03809b7294356a639d6
- SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHOF9:NUEtQevvqc2W1cpV20I32i9
- TLSH T10E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 556686415bbd5f552506ebab7cc38f1c014f18bf66cfe7d94becc1e511456e11
- MD5 a065c4101df0bc5d15edea53207dd17f
- SHA1 205cc8e17c0ffcca0c1337e55747dc8db1175d68
- SHA512 b5fb10ec19d93c5f787409db9701a7a2cd008b296647dfbcd18ade88079f993b5ac8a06c0e26da092e46c1351a599d4d139bc7608348ee2669f36812a379ad92
- SSDEEP 49152:lCbRquA/m2yL5zLfFiV+XenmE3/zSLNiXicJFFRGNzj3:yoq2VjnmJ7wRGpj3
- TLSH T1F1D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 46423e01950271c77ff1ef0e5a403a7aef29dd7959e777290d0c028785129a6e
- MD5 4561f599d0998f3dba2d548a675291a1
- SHA1 ea396c8453ed91436428dcc5f95986fe030816db
- SHA512 92bde8b953adcc8fff8e7cd0c00890bf9f2251cf88db4acea2d024d0da369f11401be1259a5abd37038bfcc1ab99097a67df002f106410465e778da0e8909298
- SSDEEP 24576:8AhGL6IFoiwtA5l7S53p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AM5Foiq55LNiXicJFFRGNzj3
- TLSH T128359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 8397f7150a5b80f8fc88de26b831ef48c33123526823ac104f01b9e30b7150ac
- MD5 f3ddaa1cd6681725e5e0749961cf169b
- SHA1 741cee42aa2ce39675501605365104a57509f7e2
- SHA512 b90bfd7dadd4d43b1409f22cbf6679425cc464d93224ed5e70e15369bb143958c992490766a4626922438a9e0d8ddd4e4a2ae4f3dce4b9bb37b94ef31012aa4b
- SSDEEP 24576:XwuROWG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XwSO9LNiXicJFFRGNzj3
- TLSH T12D65F18632980CF9E9BB413986578035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 6b9bc28928d4a1586d7376a7430f76c8437543f3405669c08887e42debf11f91
- MD5 0a494cd8cbbedcff2fc506c55fa11ca6
- SHA1 698491aff5430003c124900efd2243b411c96bac
- SHA512 6b8c5e9a8cf8ad96bbc36c1ccb6b5efeea3d1f7ebc803950129f096978b0fe851872fee0c75112f3f4aa1fdfd2d2beb3509f77a013c8a7ae45eba6909df4ce43
- SSDEEP 24576:6Zuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rLNiXicJFFRGNzj3
- TLSH T14555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 c17c3244ad264ff34e5d648d9f483d02a02d30d089be47064230e1b02af7e5fa
- MD5 0b3bc598c58f6d61d4561f881bb52e2c
- SHA1 90f4beb2658a2935a5ad98f39e2118b4578fdae7
- SHA512 1f96b0f033d48548f806a4748a8f86cbdeb9e149919ccf816e6fafc151c046aa051094a0b84717b588bbe895e3ad4d9d2ad1a0b2a85011fcd52bde59a6317560
- SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3s7wRGpj3:YQyiKanX+PNYF9
- TLSH T14B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 38a45bbab6fc7b0ec0262850d18a2798e72fee2da4cfe7f3ea5f36df7f21d20e
- MD5 956fc8dd9bbc42b02f811c9b9c2489ec
- SHA1 1b509e257ec5679e64ee570381a8972757eef3fa
- SHA512 0c1365d32389fa315f5f9c7b828bc4b6b26aac41666648f58ce1009bd1b4c84a98274c1b2a4ff00550635e3dd5ac30f60ad0a8ab39318093abf7d28208b3e501
- SSDEEP 98304:gQRQyi36YOcPDLvw2gAf+PN3s7wRGpj3:3QyiKanX+PNYF9
- TLSH T1F3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a443c34f2db52f714c4ac929125d522eda13df659b7bbcacaab618866d5eb0ad
- MD5 fe8ac6cd730e46196d9b8972c72b620b
- SHA1 ee8c07038d01c75a41297d54d905e162f367fe04
- SHA512 fd90947df45fee9065d70b022bddb34a8464101be9dd777424eabf91c53fd28ae4497536e0170eaa061fb07323c5aba82ec7a7d670322d3e9380b02087c14223
- SSDEEP 49152:068Qg55nhkeWu7PNU3/CLNiXicJFFRGNzj3:ethTRc/C7wRGpj3
- TLSH T1FFB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 c2900f9b39470ff3d79f102271e86c861249d6422890afc24d87b8129c0fec90
- MD5 31f2db0075d098c5d406708224c8fd39
- SHA1 ced15f1d55792c40833469d49b3c462d5efb7dbe
- SHA512 d9299f2d33d7ae61a7668e6b52e87bcb46a4e10938c4c834992e00a557a8ae5505bfc7cd20a947828f56845dc091f25e24d99f41039dd4173d27ff1c871ea61d
- SSDEEP 98304:6y5112gYy5azzVvU69nLKnhZ37wRGpj3:jLIHRWh1F9
- TLSH T164167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9b0348ecc15830f0359eeb68118dd424967e3d051c4a3955acfb0ce076f57974
- MD5 5aa1784fe0186fa20f0b10e92e2b6942
- SHA1 a847d1cb764a99fd83902620a41999b72b6e678a
- SHA512 9f8de46bec38787b83aa597b635429f64798e62f04f6c33d1f3b3ba795e02cc7abe5e73fe1458e59537bbb1f172233c9e5eec8f45288c1bcf7abddf4b4397518
- SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:7u6JmIxd2dk7wRGpj3
- TLSH T1DED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 44bfc6eee1aaa797a98feb26a3aa6789877bdd0f38f90584771997da96db1451
- MD5 0c6fefa70c0550df2bbb458224398ecc
- SHA1 0bbac98ec6fa0539b8bdcd4da4ebdf52ac2c8992
- SHA512 6a8c617c8a3e423ed95a887814b016495ae6882a5d375c9cc9fcd11cf34bc006fd6e5a91054369290495f81c1678e510fbf2417b57ce5931ca4282b06c95a01a
- SSDEEP 49152:I1hpsNoJpF1A67U44CwH7R4xYLNiXicJFFRGNzj3:ImifPqRJ7wRGpj3
- TLSH T186B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 0839538ecc5338472156b8a28de61dd66894c0b3ad3ddad007099c1f5db66cd1
- MD5 7727b9dd4e94fb48ae69f04831d4ca02
- SHA1 7e518d8e26e84f82b523e1137e8244c22e6e76ec
- SHA512 594eb6b42f14e9bd056a7c52d944c35e1ef2b9cc00b02369f07ac4893e48f783ab1e2671f2cc8f5aaa96a0c4a6c7333bcb6cbc74b0de8f05426f46e747c656ad
- SSDEEP 49152:0SuZQIY0Be2KkRVtOnks6NMHqjLNiXicJFFRGNzj3:m5dKqi61j7wRGpj3
- TLSH T18CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 a8e29c26fb8a5d3a84414536eaabbefceb9810ff7b7610c0de8a9ab8b3fb3865
- MD5 6e3b0bf563e4a4b9b2d419a06036b1a0
- SHA1 11e881542ee595868aaf2959cbe802c94b42c5b8
- SHA512 c16b59b7b5fb7efa6074118891c33e059d5d7cbe3c4a5e063b59bd1d5ab8c96965a38dbd9d6d3528ccfa6ba3270d0f0982cc560769e8b9e200828f0ca20fb7bc
- SSDEEP 49152:AhtSn8EApI0figjgiDn0AP5wULNiXicJFFRGNzj3:RX2iWphd7wRGpj3
- TLSH T11595BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 5d7a963c507fb4ff2233204e1f6bef2cc7f6af423a1b0c64d13697d40d4ac915
- MD5 8437d8f5319783bf21cc95fdace04ba7
- SHA1 9bd0e8cf64fff7d61bbb5f6f0bcb40c2add46ab4
- SHA512 f18a7e5a33c88d702e3a364f8b344f4f0ee7a7e232d6941a17217117a34db8be6baed3819cdc06c481579d171cbb7e0546cbe448ca6e381928238bfe6543b990
- SSDEEP 12288:c7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F05523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 89e30869533ebf0625e1b32057f1f77498fa00263f651d0a011e44067c99c206
- MD5 ad31747ab35ac9ea75de4495c07a68b3
- SHA1 85cdb495fb59090c074aa4a302a0b4d769f847c9
- SHA512 d07816afdacdc658ba55763e2a6c6b0a569bc0d6d6a93d342ca3acea6fa7e1abde17c9ac38c746c4ffcef6dc736d448e1ee013c3258115cf2f413066972f39eb
- SSDEEP 12288:ckiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1AB5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 6b6fc97391c488f12d054400a12989dfca3df061bf5bdc8d0af90d0536b33335
- MD5 ba7708761467580b8b3e79955314fe8c
- SHA1 f9a18004202804ca238247928fe870685fe62c03
- SHA512 24663601e29ddc65870c3cdbb3298cfa1f61066de41f1c0c61ac488e7dd67a1d6cfdb0b4606930da36b65cc8aa10429ab48106cf58ab7f4d30f5f694e9a07a50
- SSDEEP 12288:XGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1DB5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 75b3e4fb0c73680196b7e7d091d5c437781f513aef28681fdb379da7ac80841f
- MD5 2ebf8e7a14d058ff1a88ea345838e949
- SHA1 a10a4c919862f3af000faf225d88a362f7ce9a74
- SHA512 7a985417e3ddfedc2061d2d76c0b484849446ac736e6a06118479471296563f7b61898b25531a047831a9bd2b5c5290a8c186964a37c3d0bac332c653021d8f2
- SSDEEP 12288:jVFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B1552393168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 79665e3dbc57cc52f24c4d9ec40f8bcc3997b1eba6a2c3d23523832ea554c343
- MD5 ccfdae0ff12bf4aadc1bb937c4bc212e
- SHA1 09419bed24d6f1e4dfc385b379dd9dc5b9c5a3ae
- SHA512 049c27d67c889b432a9a1bce490104c4d37d2bd3875854255b88c6d20216f917deca4a4f44ec260a371a1f48481e0a5bdfe82a3650e58f6a99f769468739e76f
- SSDEEP 12288:itiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ix/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E05523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 5094b06e9c23c34f05f13f7eb94bb143d9dbf228ccd6b3fe6dcda99cd8d46392
- MD5 977af018db6c34cb9c66c9fcc7488d40
- SHA1 3f9e539d7db16eaf500a7ee966bb538e78ca0426
- SHA512 05656a4a6a2324ed0646c34fb304bd16fa6d60356a4b40baf34bd4386fda4ee5f4bd99955ba2b569d6d0082b3219e6c9d7a19eeabbd2f39d78c727cf7ab2d10c
- SSDEEP 12288:54iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1365523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 0e9dfa6c1c38a115a1dcc37a17d0debbbe1fc2b61fa0f6596fa5fb3a9818c6ab
- MD5 1523de9751e1d84fc489f4e25745c1b3
- SHA1 92b1795faa41aebcc761ba18d8a61cce5c133827
- SHA512 1d25fe515a19bb6492ae3c276aad6afea3e26ee350c57d3d98199e7e6999df66512d98d22e125805ecf345771ddd851e5e6cd132ab28f854a3266e188f889128
- SSDEEP 12288:QsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1155523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 fd97bc2bd7fd3479410097f06bfdefb26646ddbb576703e9f20ec2e6707b2eb1
- MD5 ee150353132b18a267dc6132ecc541ca
- SHA1 d53bd73828e5effcdb5211a8a31297349706e7a9
- SHA512 e49a13f4ec5790e2008dce864089a3e65314d42518f4973ec4edcca60fcafccd338fafc446b751e941dc56a9ae4b888818d5f066207933e7d06c28866dc07fa7
- SSDEEP 24576:gZM3zFVSOO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZM3zf6LNiXicJFFRGNzj3
- TLSH T1C6750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 afdaf53b6e8ea3eb3f8674a92656e1674c2b73764111af743a3313a58ccf8c80
- MD5 06a4584b9a8ca41cbb51c6bad3f49cd9
- SHA1 3bbda9e0d1e2c799741be3cec553822a36d1160d
- SHA512 f1a605cef1dcee615d9c637e2fccbb55896ee0c532d3f3e894748403ad6b420ea69a622eaf2f1bd3c7046f2acb29b9d4657659e8c30480079ffb72172b713c0f
- SSDEEP 12288:tniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1EC5523D3548955B1FABC0039C6754428F5881E2DEB5619E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 8418bd184ec906d4f36e9f1109d839bb1e6d3b3f480aba0574dfd3899ee13134
- MD5 70691b1b79c6c33b9427293a16ef2d9f
- SHA1 d9050a2b073780a835763b993fe6de373658d4c9
- SHA512 5b48f999f562584f6edd00fe9aff830b04221147abe792c1b65e2fd3a69b067d9ae2f51846da9fa489a9605c7f28a31d8903ce7a80265d2a9cf1d7b4a11add2f
- SSDEEP 12288:+TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D65523D3548955B1FABC0039C6754428F5886E2DEB5619E3E2083D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 9916d4706d3e827fa7422d49a18422242fdc7ec7e31f3d4ab2850d47dd305b5d
- MD5 9f7f171df158e635598944b5d48c1892
- SHA1 1442f2711d3e6f9ee9ece5ee1d24795db3714030
- SHA512 67157a6279f9d2821606f7e8675bbf629ac87abb811d72265cb198bdb83f4556a58949fb33dfdb3cd9f2414899cfa806ba9457334bd89a4af2c762154549b6e1
- SSDEEP 24576:Bzyi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BdLNiXicJFFRGNzj3
- TLSH T1DC650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 22c88cd27517116baad3977b85cf9a6fb85c1661b379ffe8bb2b33a62dcbf6d2
- MD5 540a7d7cfdde0eeb3f3a23eabbf6d751
- SHA1 a62581e52e0807ecdf0bc48c1437d9ce1240e11d
- SHA512 b9da448a19a307cd816884cc5e37082eb49e4872016c759983d0b96ee49fb8536e5eec92ea8cdb5fb60c49d0c9a5090376dd0765542aa752fa30b5adf8202046
- SSDEEP 12288:YniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19E5523D3548955B1FABC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 d5174ea374c8677e6933575efc80dcfd4ec9d6830737b3f14a33473562dca023
- MD5 1109dc79807cd2fec0017d29fb69bf69
- SHA1 5913acc44c6dc67f44fa4b5dd819d479cc6b3dd0
- SHA512 c1e2453980657bac8cde645e7ac809b957fa5b901d1948d5526681cbc68b94a5c06d30c64b74620b520eb8f020502845d255bfb407fe1ff33ca6c21240e9f279
- SSDEEP 12288:sniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14C5523D3548955B1FABC0039C6354428F5886E2DEB5619E3E2483D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 c203ba217fb11bd4763bbffb6920d399400451fc6176afac2bbbbc2d3c1a74ba
- MD5 e566862d39f733a2871feee074f14c0e
- SHA1 7eca0b72e0fe50a48ed6d1fe7628932aafd0f127
- SHA512 fb595b2e1f4075c6ee4c5f85b890ec9061c4b9271c1592bc6c75e0bb914de5ae513819aea782d9ce70cae93bae53b8f0512d69b3bb04d1a1058e44a444ae5b7e
- SSDEEP 24576:4zyi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4dLNiXicJFFRGNzj3
- TLSH T1F8650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 21d1860e60a6b0caa22ba5a71ae98768187f8a1f30802439decf9b695ae27856
- MD5 ee80ae25e1e18a4c1284c4325b278eab
- SHA1 0494478c10340d1ad4cd75619b454ac61397f6d7
- SHA512 0da6d8b64383b8e84871204c63ab8d161fc0ad5cab743a5cfaa4a46a4501c48067c4cd4b511b2b5fca64a5c398d39e4d6f4b6ad3e0b1179acbaff2ca9c15e58a
- SSDEEP 24576:ncP4mcvIjkGOxhKP2l71nNKbrh/8KBb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cP4m4IpOO67W8KVLNiXicJFFRGNzj3
- TLSH T1C165AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 5c0b73966fdede9729a0ba23b4fd7760a848c2e20c16be839d11e88f369af7b6
- MD5 d47433baadfde8eada572fd17fa796ad
- SHA1 b27c7327a4f45e4d4ba8f0263c324acf1996a77b
- SHA512 1354c0865177bd31d63e6d91797061fcd54cdda2fd42138df9fe239710e515a990502f28f8d83e12ebca32c47e08c09b4b06b37791cfbbcbb7ddc1481b11b954
- SSDEEP 12288:TpsfXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D565F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 c5b2f19be89f6a0ac148654886599049ba02a204fee13f8029bc2b3dbb7a3858
- MD5 e796c24096bb27baf376c6504e98a8da
- SHA1 59df6dfe5211c5e9fac1f74b8aacd4eeb900ef15
- SHA512 bc0a8311b5fa3495c33c2965cfb2064d72606626e73f991f2b07086dfc7bb557bf597804d6856385a61c19675b6b6617bc5730a3f5f5aa2dbb4014998d49a1a6
- SSDEEP 12288:03iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T153552393568C5572FAFD1039853A8438B5497E2C9F1599D3E2043A1EA238FEBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 49d85cb2b5332343ba863a25e26c61cbda16ca2be7c1ad66e3789d3761b7d37c
- MD5 a563b36853781baf32e971864c8d2932
- SHA1 63c3e7868c6ec305da566a69ab49819c0f8e47d6
- SHA512 4184e832d2dc921c461fd45ecabf8e8ac5edb0c56dd4319c33c68bf99920ca3041f236660f6be5ceb8d72ffc25620dc3e8d77c74b4e9b0d3201f13bf789cacb3
- SSDEEP 49152:7a0h2GEkuAe73q3pp46zwwQxLNiXicJFFRGNzj3:7a0hNYG4Jwa7wRGpj3
- TLSH T19B85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 50fa3d83f5039aae1e1273310d9b5bc20a1af32c1c306ef88d2486ef4b91d003
- MD5 00072a2b580fff712782fd869ed58f3f
- SHA1 385fe9525fd84af1662541ff6ad94ef0411eafdf
- SHA512 279b30d71141a4bafb2567d671c8438c52b0a2228b007c8d281def455e88742eba11e61942769cf12aea2807cf4ef624ea6b1c125faf56705db0ac21e42ad570
- SSDEEP 24576:ohbHjP+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ohbHjWLNiXicJFFRGNzj3
- TLSH T1375512BE169C20E5F6B5903D86668409D370BC29172193EF6381527E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 eb36607418b922ba9bdb6407bba2cee656eed1552d141fe4e938dfccf8711feb
- MD5 1cbc921ecebbbc9a88d1a4de1ce4c227
- SHA1 470de8469c592275606053f95dfdd5391638c8ad
- SHA512 21ba349543e97960d2582262e1b70a9915b06c590c883f3f3e16164a098e8450557d83441af2e32dad0e4a197343acead69ac5a074540ed29941d0e2c2950492
- SSDEEP 24576:x3YgnJcRTk4yti+R5dBR/G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xIgnaTk46pBR/GLNiXicJFFRGNzj3
- TLSH T11F45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 bd79fbc7218414b77acf6eac6324ea74639e6ac41a089703234637bc3b588989
- MD5 cf7a5bb3f19d23b3dbf4c37e0140b5f0
- SHA1 bfa4349718289910b6f806bdfab710ac4ac5170b
- SHA512 f1615f048c599b27bd2edcb429c2630942fe3156ca49064e6c4aec8e234ec0ead95bc8a45ce5dca7904ea570822ef9594fa18564245eca0a042fafaa3c678b3a
- SSDEEP 12288:/jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1305523D2518959B1EAFD003D867A4428B5846F2C9B2619E3E1543D1EE27CFEFCF38162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 d48e7957b57fec4220ea66a95b4be2de08f7a075d514b4d979433b469571e5dc
- MD5 3fe8da727b5598b43d8198bcb51f9983
- SHA1 4bfc4065bc1c994b464f2d14c14f8fc4743cce1a
- SHA512 df01d358de2c69620ce814082dd52ece44738667bd5b34dae7f94c83973c3b28050330ffd901cfc3d9e04c170e22c9cd521dd0377838612cd9cb914425debaef
- SSDEEP 24576:MAL3UTU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MAL3U4LNiXicJFFRGNzj3
- TLSH T17D750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 f797bc84dd834c8e4ff1407411f287042f79367f4b1dea605c4fb247dd4ba1d2
- MD5 e57ee4a2839bd8bcb470277d345e7e49
- SHA1 557d52d567d51ddb835b5a7fbcc4762ab1e5bf40
- SHA512 28e460a69c6aa6e2be8c314b72dee9a8804cadd526f5b6d2f92469147b0423566666bbee5e0319b3ebe874a4e7150f6620bf7b520e8c922b91d6c5f198d16b9b
- SSDEEP 24576:bOY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bOYLNiXicJFFRGNzj3
- TLSH T16255125A32DC10F4E579903D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c875804529fb9347bccbe57fb019e026028a00b8b7a06087a0a168d6d0b6d390
- MD5 e6a43ef73f8818d6d9a37bc4e361eb30
- SHA1 e14396218e5b6ee653f75152314be36daeb260f3
- SHA512 341fa5e35b9383c515072b8a0e8256a8dff39808ba5c8da85b62d3b1851230b487fd5391a61f6184fb395a26f83167d58c048741f45bc9e3e5edbe931e6562ac
- SSDEEP 24576:v7NM9YqZqmWMUkPjZM48Mv6bEhsT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v7cBWMpPjN8DbEheLNiXicJFFRGNzj3
- TLSH T1FD65AE2E6BEC81E5D477D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f5c7edab88f340a8fe650ee8c73a1f38c2df2bc1e7f51a87143eff85f79485db
- MD5 0b9d5afe1b4892a3a1c606b799788dac
- SHA1 daff17e7f19fa72ed427591b396271095c96b1e6
- SHA512 5faabf16747c6d07a0108e067baf2b2b8bcd3910bff13b13311c8be619f05b9bb785d62879b77b853ddb28d8e745d97e5de9c857238b6f291e45943dbff38822
- SSDEEP 49152:XF2YuHNETovAvNYf8kmzLNiXicJFFRGNzj3:u6BCf8kY7wRGpj3
- TLSH T1C5858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 c1974d91541ceb51653862afcd92213eda50938fb2a008a0000944782ad426e1
- MD5 57747892296568056f9d8ba53ad99679
- SHA1 fb06af73c8bfbe2c5a5516812c25042623113b76
- SHA512 4153bd777ad587dea41a4052ba976d23f862790c493352a975a28e3a044b59769e338e21eb808f5da792bba952cac99d510b883840ee1ca139c7e571c9ec6be4
- SSDEEP 24576:4AFs06+Omlf8NXEbToM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9Fs060loXuRLNiXicJFFRGNzj3
- TLSH T1E965BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 c2d1c8ce6ee234bdc3b2b4d7f787cc3281eeb56366a332b7f7c7e985c7c59682
- MD5 3bd3ea400ef7c825a2dc00b347ca3cda
- SHA1 d4cd2f2d1e2f640069660f46c869e7df32fda0a5
- SHA512 8f84aa745a13c78a31fdc6123d6faad4b404548f701f8c1f73462f4abd5722a19d771dd9b48b8c9f3655c5024a3dd257caa0b7905a22d3ad2f0a6f35d3c8d9b5
- SSDEEP 24576:AJnJ5D3WXR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJnJ5DGXRLNiXicJFFRGNzj3
- TLSH T1F175D02DD29810F8E4B7C274825A1A55FE72383D2F226AC724B4D5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 b757d0d9a479416a857aba5ed65e690dfa753c90789ff9b11acd38ce2dd0d014
- MD5 47a568dc5cb7ff388b728248569bd6df
- SHA1 2968fb1915234ef781916994f5b61dc2dacab748
- SHA512 49aac8871db0523b055ee42ff5cbde36889e3c9cc42c375abcfaeee9e6bf71d1ee3a1b52e0e533e04e229f792f81ce48535abc8296cfa1be076614f62f50aa43
- SSDEEP 49152:Sg06DIKdwc+eQnSt65aVvLNiXicJFFRGNzj3:LN7wRGpj3
- TLSH T1E3956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 d40c9ed7e72f4b68ed5c01e3a09603d535bcd32ee11fe6c167d729792919562e
- MD5 8817de804d65d0793f6df4f60dd1d3f8
- SHA1 ee88e7255e3fa49c278f4e1feaeb00daf7d2cda4
- SHA512 8b7236a5a2f584ff3b2ccaa802f8e5fab1e926c9771b8d025bddab33c694efa647c2562bdced787cf0c91a7a8a6a73ef550420a6798c3ffd1c2e4d213974deac
- SSDEEP 24576:inF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:inFLNiXicJFFRGNzj3
- TLSH T17E5512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 a03eecf4fce32d977aa42adcd2a47fe2821c20f7ba5630731989ab0ae210fdae
- MD5 e17045860f61f31093d539d51253f83c
- SHA1 692f803856bf668e74d843823695df19794325fd
- SHA512 20f706fb14d8d3d37e0b2c3f6ecde683d4749114c7ebc2fc2dc709be548c41b8e68fea56164b5e6dbbf84874e186949b972b3813ae93f2d230cc0cbe1691604d
- SSDEEP 24576:iIyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iIhLNiXicJFFRGNzj3
- TLSH T1F2651245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 29e55b0551d6dc38de237d642aae11c57c7b46898a97116bc4b9c6ce24742d61
- MD5 177e4ad5f286d82fc6df1f3b01221968
- SHA1 4d3e4433204ffb68696979b0e8e3ec185ce5e90d
- SHA512 4d41c171e50008e8ac797e0cde77e5b4a23a1700b4e99368b41429ea105034b3d2441ba8698e45190365cd3c53339d2f0354f8d1d02955136515ab2739bdd8cc
- SSDEEP 12288:Wy+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T10B5523D6118964B1FABD003D86364824F1943E3C9B2628F7A194793ED379FDB9F38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 86689b0ac520a6e94e65b47117f0f52cd977b5312f835c1ef1b1bccdbeca35b9
- MD5 e1c36b100fe304498a14b9b62753845f
- SHA1 0e5f842e0bb56d7e7f759559f5dafbd20e68ac15
- SHA512 e819c1c0be4a580d10dd7fd78596de7aca1a78699c43aa8e6e69054326c6d39d5254b4cbfb6acabea5a0146a9f9c52ba17fcb077cd9bcb7d4140fcabb9d1ae45
- SSDEEP 24576:hQ9MxZKdcz9dw3r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hVKZrLNiXicJFFRGNzj3
- TLSH T1D9558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 265712a1af604c3ad6123e0a0cf2eb08eefaa3168136145208f0481fcf6b3963
- MD5 99b21505230e172fd21dfbc533bf47e3
- SHA1 345654aae6f7012c91ef597b15265ed7747d8ba2
- SHA512 2bb9dd02d10cdb2a41fe4a6a810969287c2b00bde5041fdc8fb3ac397fc7ead8211ce5fa9b720d6566b3741936a163eb15d3ca7afd7cf6586da0fe7506d968fa
- SSDEEP 24576:MyocDApy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xocDApyLNiXicJFFRGNzj3
- TLSH T13465E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 9eaa6a9f0d59915746d8f1a8f36eeaeb7bba9a29e84b8653774859496eb3ef59
- MD5 d0f2af8d51cbf023c86ad6602af8bd19
- SHA1 84d2ad1a187c90542a96d66ba0e2e48a5423d2bb
- SHA512 d0479d39b9829d6bc9689d235ac6928650940da77f30244231fc3071de47a0f7950115965bf3c4fa075d85a3d1ed5cb78e879015754bbfbf3778573d5da44767
- SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKyLNiXicJFFRGNzj3:T0zuNIU7wRGpj3
- TLSH T171A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 958f48075df4b2054e5ba2dea38360701d8de62adefe6676106827d53ba9cfe3
- MD5 854c916e8d9d3a5a547b082b13421caf
- SHA1 d45bd53eafa49aa5c34d0cc41a54ba3e19cbae4e
- SHA512 72f10d036d8393ce651ea17d4d0058ddd841c28f8afed78924f00d2b65720e1363cce6159cb11786bd57f353eb59f60462c5c3e438edec819e39b5e3b548c570
- SSDEEP 24576:i1QT7EcpfxR+N5AWAz3ooiYzjMqbF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/TDxR+N5YzTBjM4LNiXicJFFRGNzj3
- TLSH T1EF55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 ffed013c995eb5144328e465974fa7056881fe0073f2ab20da730bbaeac73fc6
- MD5 65a46e703cc16f5daaff4e50ed94a654
- SHA1 43f892e2b29099b38d78cfe3ad88e6f82ac3484e
- SHA512 2b090269608a319c482e8497bfb5023f44ff25e4b3f4212c362b2f7cae05aafccd90fae02c50fe826d3fd774ea319102d00ef2b5935dad282d5232b70b7fafa9
- SSDEEP 24576:ZTMdOz0FFS+UmSLJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z0K+UmSLJLNiXicJFFRGNzj3
- TLSH T12D75E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 9a3eb2448ded640de9a3855af3ab51f99dab4138bbd3e7b4e06a97bea70957f9
- MD5 8f2863e91fd2545017575082a0c059ca
- SHA1 ca257011e25935135c518b8e8624a8d4b58f436a
- SHA512 d6031d858c4e7efc1b4f19ae256392009da072993497597bcdec613ee486d0d47e44f621280f3585a413300dfe73527a68e71eef533639dee4344943412666d2
- SSDEEP 12288:G4KyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15655125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH