Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 17:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe
- Size 4.3MB
- Sample260816-vjftmseq4s
- SHA256 a2ff86b6d1c92c7a547471d4010d2023cf05542f0de302584239498e4550e8c1
- MD5 bbd55fa258124bfdf72a9984022c9d9c
- SHA1 1b92582ad987b1abc6062106f5d734153bfce0ff
- SHA512 c0d130346dd89db1df1ec2159192257dc0a03610308a7d8cebff01b0bef4c3c9b3830008d9d77a021ca325483b38d2a19fa77a3448df09f31e85532567f174c3
- SSDEEP 49152:/adHo8AszjSsayj8+jctNfMWsSzjl7PYC5RuW7CaePVnBTMcR8/s+kobXHz/q/xo:/4Gl0vSzjlDX7C3B3jggqHPS1cnJuQ
- TLSH T1BC26CF4AA3A501E8D467907ACA86A70FD2757C0433905BDB26D45BA52F33BE0DEFB710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4632 alg.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 4028 fxssvc.exe 5000 elevation_service.exe 3748 elevation_service.exe 2484 maintenanceservice.exe 3320 msdtc.exe 552 OSE.EXE 2304 PerceptionSimulationService.exe 4236 perfhost.exe 4648 locator.exe 4512 SensorDataService.exe 3088 snmptrap.exe 3752 spectrum.exe 2392 ssh-agent.exe 4492 TieringEngineService.exe 4320 AgentService.exe 1864 vds.exe 2908 vssvc.exe 4220 wbengine.exe 4984 WmiApSrv.exe 4184 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\95baa9dbe52bf895.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae1632d9a02ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f445dd9a02ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b0932dfa02ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6e921d9a02ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049ae75d9a02ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e4695d9a02ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a36854e0a02ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b434bd9a02ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abb0bfd9a02ddd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d7cb6dfa02ddd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe Token: SeAuditPrivilege 4028 fxssvc.exe Token: SeRestorePrivilege 4492 TieringEngineService.exe Token: SeManageVolumePrivilege 4492 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4320 AgentService.exe Token: SeBackupPrivilege 2908 vssvc.exe Token: SeRestorePrivilege 2908 vssvc.exe Token: SeAuditPrivilege 2908 vssvc.exe Token: SeBackupPrivilege 4220 wbengine.exe Token: SeRestorePrivilege 4220 wbengine.exe Token: SeSecurityPrivilege 4220 wbengine.exe Token: 33 4184 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4184 SearchIndexer.exe Token: SeDebugPrivilege 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe Token: SeDebugPrivilege 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe Token: SeDebugPrivilege 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe Token: SeDebugPrivilege 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe Token: SeDebugPrivilege 1944 2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe Token: SeDebugPrivilege 2164 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4184 wrote to memory of 2760 4184 SearchIndexer.exe 112 PID 4184 wrote to memory of 3240 4184 SearchIndexer.exe 113 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_bbd55fa258124bfdf72a9984022c9d9c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4632
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4456
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3748
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2484
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3320
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:552
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2304
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4236
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4648
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4512
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3088
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3752
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2392
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3972
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1864
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4984
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2760
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3240
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ac7e97191462f548f83480a4d7a75eb3e7ba51251c905e0ee1d32b9e10e8372b
- MD5 1b8cbdc32c4141ab65073f4c06b8f088
- SHA1 ec34d2acde43b678e98c081ab776056834455938
- SHA512 174689e7f4fb0231a1c096ad802c4ee64ae8aa4e234d2ae350bab4e0596524c5e4315c845b18aba6cbb69b3fb8730627dd00460256bafe06edce8ec2d5d123ec
- SSDEEP 49152:0b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnX6c55DJu+tX:u3q6sjBLcnJuQ
- TLSH T152D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 0a145466a24a497a9302187fd8bd50d5f3d3609b8198c339b8c99a3da8a930bb
- MD5 caecb8ed2363151609d37b1379a08f20
- SHA1 0555e48a11b41197c13c5d0443d3e680ac017f9a
- SHA512 c236c1c3fd1f7f1a590b781aea6bffcc690a7ba962d1bb0ee34973c32324c3488ea4bba0fd917039ae53bbea97fbca30e86debd19f04391ba3cb21dd963e362f
- SSDEEP 24576:XXYfDtczAoHKozqcAdu3pDQo0d+oOblc5wv0:CtcB6c55DJu+tX
- TLSH T1A475F12977E408F9ED67827DC8A28511E633785143A0F7CB03A49A665F333D85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 4bbf4c841bf1321b13e43bfd2b5e1d96b279e465c272868eb495568f661ad4d6
- MD5 581613f3b88b06dd0446a450f1fd62eb
- SHA1 612fe7d39e953dd1ef5744018b36154efc150c85
- SHA512 495bf1d8986d408bb527071da4524807e26a87312824a7c0765a5b840938e2e7e11f949b041d856f015c0b6be711b4ce77126e37cca314d30b4448e2334b85f4
- SSDEEP 24576:40Le5ji0hmxxrMPHKozqcAdu3pDQo0d+oOblc5wv0:4Pji0Aj+6c55DJu+tX
- TLSH T18685AE56F6748331D073C0B9C5D2A69AE972308257308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 181317340e530b3d8753105be46bd171d867629c7fd12dc360cfcd912b18c89a
- MD5 3ac9cde1c8b74a0eb58d312e1faade60
- SHA1 b1756225a636b7e951bbe20b92fa5871178fd3ba
- SHA512 199a11454cba4817d41372a4f052bd0811d44523abc72af44921f835756ba9c0edb33d24f12689e8f581d0c7a91ba17bea1d35b98b2e13ecd6ab2cec524914b1
- SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWn6q8wyuRHKozqcAdu3pDQo0d+oOblc5wv0:G/ezSC6vUzPveHjyy6c55DJu+tX
- TLSH T186755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 64c0fdf0357cde95d03f32b949a9d27b58d00b179d2f0ec0663aff425062c8d6
- MD5 096bfab9ee9c7bf6b90859e360c99f5c
- SHA1 c1171b4a65ae50f94a810aa2d2d8da7e869170f4
- SHA512 a20172267d892b7bc94562ae1b6aa890ee7f308bf0d0694838d8a94828a8d8b2a2732c271be925aea509c116b14c1be20b8f75d4e85d47232f0e55e0287fbf72
- SSDEEP 24576:SVbqPb88hv/l+YEHKozqcAdu3pDQo0d+oOblc5wv0:SVO88hXl+56c55DJu+tX
- TLSH T125558E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 7310d0d94946cb3efaa623c5f5c2334142a3271d693acfc7407ca491a76ac3ff
- MD5 3dc49c51af3db2fbd8297ce898ec81fa
- SHA1 7a5fd7101bc695e1b8363fc181fd49cbdef4a40e
- SHA512 2029ca547f1024fe920d963ac0be629f264c6e0e1bba51412b2bc7f12c7050c509cb4e1ad53542774381d63ca5bf80aa7fd12024e5a99e1eb114a25837063dfe
- SSDEEP 12288:0Lr0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:0LrHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1E75523C69F8D1166FF28757348F716E1606E0C0284D17A89265037E3FDB8635E06EEAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 a8216118ad314d94d23d55597953f45945770e3c6cd2760a87dda013c65ce83a
- MD5 f7921355613ff8316535008c1da68870
- SHA1 4464fa9dfd9e8f1a6342fa78a37dca6aef57338e
- SHA512 016aa072b89a4abd9073e243ff7c171fa0f0dd8b1932cd2adb996c6e4039d7958c206e36c431cc3c3ad182bb7b8acc1dd3d32096bef46520bbc4e52a6c46cdc5
- SSDEEP 12288:ieBNUbTVO86Uc0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:iJIUcHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1BC75DF7BEE28FCE2C27E9DB95A918240D77278304B52A3CBD164834EDE235E05D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 9faf041a9dbc57a9ff5cc58901ad87ba4848fc8b5f4a5ea70d09cb20233f15c5
- MD5 5c6617a1250593c994a731c74d33bbb6
- SHA1 1ac0891f4fb3c493f8ec0c6780869258d7e92d95
- SHA512 75ad0b85165dd95423e6a07d10b0e0f6ab2e008823a92d8a0414cd66a2c3a69d979014f946d437c81ae5f08358b8bd6b7167c8951225858aaea8b7dd99157f02
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:kQvGAdlCEL8c/DRNw5CscnJuQ
- TLSH T1CB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 b0e61e87f749342c6f9dd4743b62933607efe9c432073275d9beb334cb913e8d
- MD5 562aceee9dd6368e5ad7edc396e84992
- SHA1 754bd0d2ad777d569c9c5e26c280d8eb308cb31e
- SHA512 0589dc90801828355b34a2c538f1a41de1614c5c1a10a01e22b62eb18180ace3ddbe1d84b3fa6257db8e9d6425154ddf2b01c15a2f86ddeda85ea4f50c1a16f1
- SSDEEP 24576:k0ewsAjOHKozqcAdu3pDQo0d+oOblc5wv0:5ljO6c55DJu+tX
- TLSH T19875E031FE74E036C77F0DB21B76C716142D69204B912AC3E3A85E9E99742D22376E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 63e63bf0f43c95b7ecaea70b32c861caf3fbb2924f5894d4f39e19f9031432a5
- MD5 1754e66d9a47959e8f668ce989743953
- SHA1 aa04c51cedb75e2007c807bf4cb09688d28c790e
- SHA512 8676692a8727e42f2fbc23be2f714eeda861ecec232dccbb231bddc6df270ba56ebc5347f254dc9ef3c71297749fbfb6aa04a7fda20a9485a8512efd1622840c
- SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH2J:4UEtQevvqc2W1cpV2tI32o
- TLSH T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 cdefbcf6a6f2340ec41bfa37b4eb89669d64f4685ae3bf80b7265aeb91e8f420
- MD5 0e8e66cebccca3320770ffe9c1da4579
- SHA1 d88101caea7dedbb8a511a6ebefb45b4847ec999
- SHA512 b986f564b0db2e73390b62d0b85928898ec3daa2c92c4823316eb8b33f5e0e4a1f58588f4e8964d600bdccc24414498891ee53eec26dd146671228e30fa0dc1b
- SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/zu6c55DJu+tX:xoq2VjnmIcnJuQ
- TLSH T122D58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 be3bec5e4f31119571c9881457c7f6c60251495a61341119949751a1089aaa49
- MD5 71ce8f23a0eae72aad21167642f15444
- SHA1 68bfe1fafc9e8522187b73fc783a13985b4531b8
- SHA512 626c9b30691494103bddf324f109ff5c7692c50ec56516eca661b859966d8b7e32ce98f37327d4720080c4063e2e5dfc89cba3a54785791ade872669befa3b20
- SSDEEP 24576:qAhGL3IFoiwtA5l7S53FHKozqcAdu3pDQo0d+oOblc5wv0:qAMUFoiq516c55DJu+tX
- TLSH T18235AD81EBF945D4F5B3AAB899B68170E976BCA65E31D20F2150D21F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 6ba9dba07b5e9f42efff550715efa0d00fd7d1f438497a249fd60217fdfcb0cc
- MD5 df27446bce8fba55e115a89de5345a5c
- SHA1 ca9b0d51f588eca53f950452c9efef65c314d02d
- SHA512 2b26705fc1825f486aec11bcdd41deec0715c22fdfe32c417983a65cce1e667083d9e59d05c56b156313a902a7348a789fde2f069f93060102344be9faef3580
- SSDEEP 24576:Nwu4OWSHKozqcAdu3pDQo0d+oOblc5wv0:NwvOp6c55DJu+tX
- TLSH T10D65F18677A40CF9E966913985978132F7F2B8022A61DB1F1760C757AF37321AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 74ddbfe880f6151e873b499ac12a50c714e9f4f8840a17a63403ca2da41fb92e
- MD5 3feaf82f41c6ae2d9a55694655baedeb
- SHA1 366ca5b10d7e652a03b8553c8db489460901d784
- SHA512 48682701047cebac65f9af96a6e75aa222635bda99e347e3be07cf80f66f6521a9bf7b27ad67feda9b2424dd1aaac4478cf388965470cd586a97edc07634fedb
- SSDEEP 12288:EeZ1Iye0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:9ZunHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1F155128A37E820F9E666527988F24681E376341243B263CF125053E7AF72BD55D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 bfe0fe994c8d74f20b5fbbbc155f3984c2c24dd96e65cd144a4ecf893791c723
- MD5 dbd8e8cf289482cc86fa66e6a9ee8698
- SHA1 83f0cd75b8c823b2869de4f2f351bfe7bea098b2
- SHA512 89bb77eb77ac966c3085f704dbca9ceb563c93556210689bf9543445b4c9904ba57f54cf1472281ae911fed9e41c64d94e52b61e9fdd405ed950fb77388bf769
- SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:YQRQyi36YOcPbLvw2gAf+PN3PcnJuQ
- TLSH T11F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c3f24611beef707881770199b26e50d8a9162581ddcb66a111d3421cb21b9372
- MD5 bdb106f8803ac7f7c27a17e73d501d21
- SHA1 6fea50c0b7e071b00a0af73e78cc9eb64323277f
- SHA512 aa795119e79685cf6c289f5d168c3056e22347674a8a5eb02c8c9b365efb1ec866bb56a0aefd1fc48956a805964d32cc37f9bfdbb2a802358a5bc973ca8d94f4
- SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:SQRQyi36YOcPbLvw2gAf+PN3PcnJuQ
- TLSH T1AE667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 704febf421688345678ab0079d4f9887ea732bf2743edfc09a3ef1dba08e4353
- MD5 61eaa72b52b4c1861d716e548b3c1319
- SHA1 f25e0eb34f1adb5d11718ff612e9c227ea46da73
- SHA512 83dcf44544567988d3d50df32c97a5be5d09224f2119b8d2bb28673468f49105419c0f9a031d28bf918071298521b95d46e52c146b1f5858706ab984ff1a71af
- SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0XHKozqcAdu3pDQp:u68Qg55nhceWu7PNU3/+6c55DJu+tX
- TLSH T172B54933B2F600A9C44DE1769F4A872196D27C718FE1E3DB850172561FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 84e99bf2b05c75120fa61db4427a38abc935d9fd86f820eab41004912bc2beb7
- MD5 2b8b1d7c24f26949aedf814cab7a9bbb
- SHA1 0d3d5b867d1526e6b82d2e5ba076eb2b6e7c22c3
- SHA512 ff5a3b49ce37a11f55fe2efc87499166d04daef0dcd32b53f76042c0ac7f50ec5cbe1f62132c5fd69c05f1fc824e0be94e18c7ab67bd18c193fa38dd08b465ad
- SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99O:3y5112gYy5azzVvt69nLKnhZmcnJuQ
- TLSH T120167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 94fb5c8e1a8e0de0965ad0a454b0c834e84e3e07d67f09f9c51417b8ccf5ffdb
- MD5 e9d20b391194b83299e7f0e0a41c70c5
- SHA1 439690e29b1b3d67c85a667d69b6e0d8340b6ec6
- SHA512 1eda09470861113f7521a983bf67d51440a9d8606d31196dbf16d552c6d5b14c8e0f4327b92a575dca9b53c1727689d7cf987ecfd373d1755f9021be2684f81b
- SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glY6c55DJu+tX:pu6Jmdxd2dHcnJuQ
- TLSH T1B0D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 970f00a664ccdc7d847bd8d0f093d6b81e54b209f929404be4619095445dbdc0
- MD5 07a5874058869b666921f44f47ffeb8f
- SHA1 11ce5a7510708cb2eab4150444cf5b6eb776ab15
- SHA512 78f6dfe8bb8d97c8efc017e4dbfa81164398bb038e8232df88f3df484b3698cf7da4ed6cbda7edd0d3ad81a3c1823e22847e406c44df06675d626fbbc4321cd3
- SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4x86c55DJu+tX:zmifPWRIcnJuQ
- TLSH T180B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 80c72638db4048780d6ce9e6e1fa696c134eeb2ddd2ea4864ec8f4006e069538
- MD5 3e98c740608fe6759b14ad11ca789624
- SHA1 656bd04fd78eab41742d77b491ae6c95859323c1
- SHA512 9ce2476a30983f6bbf2a325e26f04c6373af49de8d7a8b9d6a5675c31fcd9857361231c15f5056ebc132716fb4c8292f0b634bd037f1ba6ce0fe047ea48714a7
- SSDEEP 49152:TSuZQIY0Be2KcRVtOnks6NMHqn6c55DJu+tX:R5dKii616cnJuQ
- TLSH T1DBC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 ad24854c808418b15901dee38711bd5778e64784897a38e74fae53ab7e55f4fe
- MD5 5310ad3f019581229743e3af739dee0b
- SHA1 05f5e0ff8ae6076c69bf8f2815343987bd8d4663
- SHA512 ee05274897572e54bb6b894e62a50f13098c95b5f5911dc2c64bdceaa57e4312b20bb9f8bcfbd1ac2f067b773f4d01dcd5a45f11b6bfe938a9c494e6d84ff2ca
- SSDEEP 49152:shtSn8EApI0fig3giDn0AP5wo6c55DJu+tX:NX2imphUcnJuQ
- TLSH T1B995BE13F2D900E8D05ED178C7568632E962BC120B35BAEF0A90B7561E7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 807ba842e2c5ca314fcf00c87db4b35dc86dd3739e6f8f92d92720c6a3a0a243
- MD5 e0aceb702ffc1e7cc51f89e82a0bc2b3
- SHA1 e7566d72955cd241332acc1044d927c109f271c5
- SHA512 6393ef0ba67ec3a662347a6a67c820df6c2f60621875a79bb9bb1dcc5df1e0c8936c52d61736d2f66ce0343320429a05f3870daf9c522d7ee8f030adc36ab59d
- SSDEEP 12288:wD0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:wDHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T17C5523C6AE9E0566EE1865B348F712E1606D1813C5D236C9364033E3FFB8B75602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 29e112c651d05a290e10d362821199b76b03b97c142839f610b84202d704f37f
- MD5 242296d0310577674acf3a6cd61a82b9
- SHA1 da969d208be8579c6c3b5ba630e01c9c25271851
- SHA512 ee1c30104019bb49bd697103802bcd478005ee8fd9489a5dbc8d7699971589a32f298e64fa5db1a0793eea392e32bdf756d8c33f5b12bcc869cf4eaa79be1b90
- SSDEEP 12288:o60BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:o6HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T12C5523C6AE9E0566EE1875B348F712E1606D1813C4D276C9364023E3FFB8B75602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 81e7c2a9a7930179ed65299401fb83f2f5cc687afd8eded1b1fcf63e2f0115db
- MD5 d7a1e1839d5aa394d52308f810c9478b
- SHA1 1655f1ca472a87a1d4b2a42d52ebf079e6433ac5
- SHA512 263867c8bc4a3afdee86ebc5e9993291f08e7c62d7a11fd5bc9c1ac73632a030471eb31040f77dbe280b6e4507498c656597a5db572379767735ca09104bb715
- SSDEEP 12288:A00BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:A0HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1AB5523C6AE9E0566EE1865B348F712E1506D1813C4D276C9364033E3FEB8B75602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 ace4a50656fdab360f1b7a7785ecb73ade60c84b47726b406025659cbe7553f9
- MD5 3ac43be9cebca2b7b905010e801db8db
- SHA1 d86bc9f5a6d413d31849c33f876c7ad1e4258ae5
- SHA512 df7c540be9125164768eb17baaa9b3073ef97b0c375c42bc6921992e3cb06309088c25c4d5377d85631ea88efec7ff162fedeaa6ea8c98f66c583073828bcc89
- SSDEEP 12288:eVl0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:+HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1805523C66F9D01D6ED24A17688F342A1A07D7C12C6A277DF260017E3EEB4764603DFA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 fd9030139d5437f355b89617d2635ce895523ce7153f7fad63cf4e38a70a808c
- MD5 3e8168a04b99070622ea27ccb12b4ed9
- SHA1 10ca83ac261ca0f0b619df374edd5d8f8f691b47
- SHA512 a66edfb15cf7b4a46d71bb4d912e36641aedb3b800ac0181c4dcb23affb9540b17784fd37e81ad9aff2ad26c297bdaf58f91bcaadbf29a2f7a5dfbcfe9d9abd7
- SSDEEP 12288:MN0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:MNHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1C35523C6AE9E0566EE1865B348F712E1606D1813C4D236C9364423E3FEB8B75602DEED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 6a6d18fb0d63ef762269b5fd1c06cceb0a4e11381d85ccb6c59e6c1b2c542989
- MD5 12c074669d2137c1c2c539e644f2edac
- SHA1 8e3bb6c3d5b276004814f4648f1614c1ec56af36
- SHA512 4b56e8fb538db568dfb939885338d691f3d48c05d740ae0a069dbbf0389de4c0e50e34aa960a99b4e03ace5ea1078de837e893653e854a29f1b66c25b560dc09
- SSDEEP 12288:Xm0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:XmHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1D25523C6AE9E0566EE1875B348F712E1606D1813C4D276C9364023E3FFB8B75602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 0b8ff37fb0846c5b1a49e6bdbfa1e0ca7a7a69325816cbef8223aef1de84c9b3
- MD5 4fae2ad3329c3a5a9b4468255d5f9e2f
- SHA1 6c6ecaa7443e3e63c9b621013bcb8e681266c178
- SHA512 cb29aac756a188f9c7797eaebbce345a2202b2ecd3bcfa95967fa4e01b59ade7dee86e0376467fcc13f20a37b7776cc89ecdbe5452d976f4aaa37e71ae7eb0c8
- SSDEEP 12288:SC0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:SCHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1465523C6AE9E0566EF1865B348F712E1506D1813C4D276C9364063E3FFB8B39602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 c7faabacb078b9880d2178debbe9a24990281384e88453e57a7661f383c8eb0e
- MD5 74acfb086482257c1bdf09815bb9aa4f
- SHA1 696a3f87cc10f64e03f13015dae5704194fd307c
- SHA512 2412f9131a7ddb1cdfd9e065a271dee17555c89821170466877497cd78298246b8bd4db83a6b07774072d18bebbb7d812d1b2289042b92b9f48e5991fc5e7b02
- SSDEEP 24576:5ZMRzFVSOaHKozqcAdu3pDQo0d+oOblc5wv0:5ZMRzf26c55DJu+tX
- TLSH T14A750195B39018F8EC67813EC8668956D1B27C1647A0C64F13A437679F333A11C3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 71fb360055413ac4afc52eb1e0f898374c7afa140c70f22e9c31f444fec362a8
- MD5 340730cfa78ea21f409dacc7a70849ed
- SHA1 4091bdae3180e258edda652cd593300d344354a0
- SHA512 a0b6cb206f8cdf83deedfdbef83b662f67b9bef5f75dbcf07d53781efd023719a937aa13158b1f45d33c7137fccc39593b0fe9384c3dcf72020e9d21fc16eb76
- SSDEEP 12288:j30BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:j3HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1335523C6AE9E0566EF1865B348F712E1506D1813C4D276C9364423F3FEB8B39602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 da85d977bd310a3a9fe56978e5212f12447fee2e7939f34f9609076e913e540c
- MD5 d1602b5ff820494417a7a6b115f5037d
- SHA1 bf81ed57e5c368f4b0b8491e3259b7590a498c4b
- SHA512 ba8d1560c3cc367660d5a4b652b2e13e857e5f03b16e9e68d933cb73df190dd3e45b6676b1b03111e354b6c527016fae75aa13cd1b2039e4eee1b622d72f62d7
- SSDEEP 12288:070BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:07HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T17C5523C7AE9E0566EE1865B348F712E1506D1813C4D276C9364423E3FFB8B39602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 f11682b5680b0cc6eefb507680cf4406611cd69d0b23b9ed0f6d825a4321c170
- MD5 6b4af0aac1cbd38c33dfffec89bba8c6
- SHA1 8924d35da5aacc6c27c8232f4bf5cc17427302e7
- SHA512 ba7767798f2d14fe239876d776efcca64f3d7d868220f55f7be9020726a2cde79e7456ed1f75dae8cd694dbf50397ac6ac9d64db0dc98242a32fa69229e995f2
- SSDEEP 12288:WyPz5L8e0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:rzyeHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T18065024777A530F9D536923988A21A52F376783247609A9F13A007B36F377A09D3EF60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 7c0b6334f8963eec3999c6e0af6e287af1252488ea5520550310942c881cdcac
- MD5 5ed3904f14481541035541d7d8b07bbf
- SHA1 f9759d100cbcbff26a1f636a7cc79696a8bbdcba
- SHA512 73f69f4ed43faee2201ca8f8102771eab17652952e83df2118304aeb362fdf9818c51f5f84bcfc04e99d11685474a686cf986ca658855a4c029379c1a7e468b5
- SSDEEP 12288:R30BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:R3HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T12A5523C6AE9E0566EF1865B348F712E1506D1813C4D276C9364423E3FFB8B39602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 77e9d1d819a008517e948c844650321024828e7786653da7330cf977ef2d1227
- MD5 7707ba68f51f9abe18c3d35cb12eb6b8
- SHA1 ac509cc7443e07c4611caa410b53a9a47198fac3
- SHA512 66d0d3166b107e47723c4600aa8b153721a948ffe1da62c72213695a4bec7009d7fa9293b371835f02de1d8bfb4bf8b5acb11e394bc5dc23ae47a6df7aeb34e0
- SSDEEP 12288:/30BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:/3HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1DA5523C6AE9E0566EF1865B348F716E1506D1813C0D276C9364423E3FEB8B39602DEAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 98daa2aa75bf96507b49c014187121078203f8e9ed2ea2e6caec045df6fcf8ba
- MD5 3c66eea812facccff3a66648e2107dd9
- SHA1 27b1cf422b0915f57e00e1a60e20851b337d255b
- SHA512 1fa481259994f83101d28a10c0d5a591105cc685473e3d9d9feebe5b09fad8d45e567967f431b049aec052645f5687f7e84139ba47007c496ae6f422a362036d
- SSDEEP 12288:FyPz5L8e0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:MzyeHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T16B65024777A530F9D536923988A21A52F376783247609A9F13A007B36F377A09D3EF60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 d1fcbf72b54b3e4db97df275f03f0e0f86c16310d5da287fa0152b45499e429f
- MD5 e76a7b8c736a2967225b17105561d19e
- SHA1 7f56c1b356992894fdb8b6d97a80f8be90e90997
- SHA512 7679c096a254ed6481af39cdc0022db958065d3876580073421dc7beb6bf43c134cf83f8a43ff20d477c2bb323554fda7c6e6a0ae0a296e88aa4017aa0361dce
- SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KB/HKozqcAdu3pDQo0d+oOblc5wv0:AP4m4IpOO67W8Kh6c55DJu+tX
- TLSH T1CA65BE2DABDC0096D0BA913885668A49FAB1742A1F3286CF1160933D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 210e12b3a58c83c4a38f22bb3d5279906b2a0fa02b79e40b2464a800ecfd5f10
- MD5 b555f8ff3e6ec3cca0bfbafa617305b7
- SHA1 d6baf1e228c0d7bc800820657e9e0e67709274ff
- SHA512 1851981f369c397ef4e41890d5a21e16a69aa1c91c789f22b9109aef8d8ffc9edbe1cac859c63ea663f7047172dcd4062a7bf350faeafbadbfd6083f72732654
- SSDEEP 12288:Qbsfn0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:3nHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1C265014AD29802E8D52E6176C7964681B3373C2183E1E3CB23C0F67E1F756949DEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 4161cbb73a6dfdf2c87d0d08e1a29cb7047a585bc9c175f5fd5d55c7856ca3e3
- MD5 6d89ae7b868e8a6db20ef1f0a180cc2b
- SHA1 e2baff5d824746b0e8cb25623e59726e2b1984dc
- SHA512 ade3969391de2a99382b51ffc4c584027e948aca0803396939a4a531a0f16dc7008b5ca80b2611ecba2510f791c05b5d289c9624d9c78dd620e225fbaebe9130
- SSDEEP 12288:0H0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:0HHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1CB5523C6AF9D1516FA38767248F742B0202E28128AD176CB754023E3FE78A75943DF5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 57e26b8cb6dead28946243e5f82abbe460db261f154f3f9237053923e40a6d93
- MD5 69bb843a31675a5b19deee0b2d64e884
- SHA1 8a2bf5779dbe562ab3a0e6024504c2e90fe440bd
- SHA512 a36d9d22e5e34e03a21fc9ead655e46af5a86ddbd02dca58f53368062f4024e084b829f0fb14413d0e0c96cf2afee4dbe49a52da819010bfe9eb4b660e94b7a7
- SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQN6c55DJu+tX:Ba0hNYG4JwlcnJuQ
- TLSH T1F385AF1E67EC82B5D0BAD278C9A6814BE6B2B4220B3156CF1151853D7F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 482f914875dd9a50f6cd85401e9f19feaad8c4c91a4c68f59e53d372100b8828
- MD5 e5111a28cda6bc0037d4745a73b8e3bd
- SHA1 3dac32c2356961823e670ab1ba0367651c450bc7
- SHA512 1bb6a681dc4b254cd7b9f22cb33be99e116a49e3e267e51ea92f4b929af82a1090b243412713ea1fbdd2b4a5e07473d5b81f03ce8653658e3740d4376db1d19d
- SSDEEP 24576:qhbHjPqHKozqcAdu3pDQo0d+oOblc5wv0:qhbHjC6c55DJu+tX
- TLSH T1865512AE2BAC10D9F535E17D84A64646D231B8220751A3DF23C183BA9F3BEE45C39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 66820359a685a222e55408a2f336c6981b8dc0bb70047717bf39d9af062a9068
- MD5 ce341dd7b02695b147d5ae91d86673c7
- SHA1 86c93771ae4cee18f0873377b2bc31df48d052e8
- SHA512 d623ba67394d1c9194f677c9a764b78eb7fd81443b756b872c0b08db73147293c480e4266ca57ffe0eecd72c859fd496e97cd0f128613fb8063a1812903ea286
- SSDEEP 24576:m3YgnJcRTk4yti+R5dBR/SHKozqcAdu3pDQo0d+oOblc5wv0:mIgnaTk46pBR/S6c55DJu+tX
- TLSH T1A445B02EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C638AF1AEE85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 59eb17478214a2cd658827e2943873250e179c28491652528b15596b7f3bafa8
- MD5 8aec379a1d95c5ebaa290cb19e0f544a
- SHA1 b42b49ce34e944b28b889dc659771b8a386c19c0
- SHA512 97e76e0e9183415568cd4949ae57219390e8135cbcd9c06e6e01f99de7b0bdea0b5c49ee5a7cfdaaac478a3928c6e6304fe16797fb42aedf749164c5f1f69744
- SSDEEP 12288:PL0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:PLHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T17E5523C6AE8D1566EE2865B748F706E1601D141283D236CB354073E3FEB8AF9603DE99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 43112e161c8a295c98d6ead22eb9001754eb7ddb9a5531d4883c0e4bb9ef0f5d
- MD5 1f98f98cd982ac05ecda40961f10b209
- SHA1 217e8b58b52141fd6a934e34485fabf77818e167
- SHA512 f7e827e8bc1d557746772dce5a1c610bfbfb934459eb8746829b45692547a331c6e3d5078da326d4ef8d6255d3c01301f1ce105bb0c9f1343a76370fae12b364
- SSDEEP 24576:ObL3UToHKozqcAdu3pDQo0d+oOblc5wv0:ObL3Uc6c55DJu+tX
- TLSH T18375F155F79400F9E97B913DC8A38A16E27274590360E7DF03A84BA61F637E14E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 de7a6ede7021374919a7fc712906781dc940567e2d57e8b523c79547f06fe710
- MD5 70d053240100bbaac0f7f8663c1b8fcd
- SHA1 66e887753e421ea82897ddd93e8018baa46f115f
- SHA512 d9120187c0b05b6ff884d094ea246c669bbea9c3c21a144b1d822c2aaba69445ef503701fe09062b2f5181c2dfe2468ab53ead397edba4d4e26b9ee1bb5bb450
- SSDEEP 12288:epFtIO80BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:FO8HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T13B55025A37ED10E5E539A13D88934349D2717822076267DF029082BA9FB7FF86C3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1476dff13b298bdb763b14b140dc131ebd79cde12aec24e12e28e0a6eb0f3aac
- MD5 7202dc3318c8e53d7c9166697830c70e
- SHA1 2620441f7a1e496d4220ed409b36aadf0dda2bea
- SHA512 a02bd1fabfed7d44f88d2782de1d4d11436bd3f584ec1fc55263b7306be2b81ffc6017080f9873c5db660da62f07dcea34f1ea59c8c2e01ba3795b3295eb8c0f
- SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhs3HKozqcAdu3pDQo0d+oOblc5wv0:A7cBWMpPjN8DbEhK6c55DJu+tX
- TLSH T18965AE6E6BAC81E5D576D13DC9E28205F2B2B4611B318ACF1152833E7F37AE44E35B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 598ff0229bc9a0f5773d8518e58368fe8c5d4c8b96221ef1ec5202c5ae54ff89
- MD5 8b046813fdb668ffd0764cc2c835a236
- SHA1 eb063fab7b34daf92cca5fb5552d9d6ea21e4442
- SHA512 8be816fc3a19d106ac85be0a2baed6606b708462a662be054423ca358d34eb8143c4e0b293261b193e7fbac4be1208dfcea775b8aa26893d016e368f398c13d6
- SSDEEP 24576:OW6BApg2YuyuNDYTabvcdvNYf8km15HKozqcAdu3pDQo0d+oOblc5wv0:OF2YuHNETovAvNYf8kmX6c55DJu+tX
- TLSH T130857E6A27ED80A4E0BBD27D45B7D246F9B2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 037781803989c7d9fe629e833d7a00129dfcaf23588846abcbb417268a112112
- MD5 57c0f2ebfa92dd2bc6aab7b1abf1f790
- SHA1 87c97e9441bcbdd4f6e2768271dd194e2a6b53d7
- SHA512 109e33453a810c4db05363c9c04909c5845a981775478de3cd3fb3a649cda1b0ad67dc1be00f48ddd47e1093b9cbc2c93e0e62d8fd201e3d137b2318cbad2b3a
- SSDEEP 24576:PAFs06+OmlfkNXEbTogHKozqcAdu3pDQo0d+oOblc5wv0:YFs060lwXut6c55DJu+tX
- TLSH T1F865AF2F66EC00D5D07ED17E8997C91AF2B1746307216ACB0160867E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 fdb98f9424ed2c8917be3de704fab470581e2dbceca999d06122d0bdffed3580
- MD5 28155071eb6a1aa78cc270e7cce16214
- SHA1 0dd8cf1ff7d85fae7848e89a61de388663528899
- SHA512 ba5aaf2970cfdb97790821bf7958deebff3d338b8e1f8d3662561bf5aab5e26fbb60517e98d172e658894017b1f88e08ea77d8e4fb70d12d959a5ec1e3350c22
- SSDEEP 24576:WJnJ5D3WXtHKozqcAdu3pDQo0d+oOblc5wv0:WJnJ5DGXt6c55DJu+tX
- TLSH T1E675D02DD2A810E8D477C274819A1796FE72383D2F226ACB24B4D5357F12FE09979F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 71859e3f3c524e83415932b79ca1e5c24eddea98bd5661e97730aaba54937083
- MD5 0eb7aaf8104f3b55f222e90d07dd5477
- SHA1 cf87356f5a1e3656aaed18c624536eceb8490946
- SHA512 52d24dafdc7cc2041c424954524db71ed7f2041cd92c4cd43d8c8c810b00e9f2b116ea3ca473a54d666fe9356213767ba5790d8b40214647efa529c96e481f9c
- SSDEEP 24576:REPghm6/7IIXdwcXrif7qQncjlP65i3VuSHKozqcAdu3pDQo0d+oOblc5wv0:Wg06DIKdwc+eQnSt65aVD6c55DJu+tX
- TLSH T13F956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 e6fa33670f0160423a46daa7ca7f52fd769d5854a866e9acac380817ce400e1a
- MD5 bcf4db0834a402cbeaa8240eb99fbf21
- SHA1 5d4382debb6085138dab4f73eada5612f085727b
- SHA512 8e78ce670ce7225f32f1df27ff7a55bec8af2b9b097505b0de16c3989bfad185fd7e968bc3c4113a3cda4042d4ad69cad437d181c943f1991ad13701c332965f
- SSDEEP 12288:ZEP3Rnx0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:qnxHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1C155129E2B9C20E5D529A17D84A28245D376F031479237EF129083BE8F76AF92D3DF50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 17135c885fbe27e03125624b5976825a077d588ec450402398c7c440d38cbbdb
- MD5 b058c1c99a232c62ab3013198bf2627a
- SHA1 47121e6f5589b682e1b43a3bd686ed2ad7f3fd53
- SHA512 a5fdc34d97b4c6117af94ea54eeb42f240901c4eeea1df8b56eebe4f483b642439963e4c8c6abe6df475581669c8074217dd9cc598ff89a50dde47f76a982b16
- SSDEEP 12288:kjky60BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:kIy6HKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1B565228567D81095EA78563988B342E09439BC218B6163DF2180F77FFF75BE4A838F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 759c156d15025f874848eb345e4194e652429850ef113d34923107ec6fabd9b5
- MD5 c960569fd9de0611db9932512136d9eb
- SHA1 c30706c204b799a773d26dbae8035541b51a538b
- SHA512 4e05bdfe6be1a29731868e20451e4b25d5c253d15c713b9e0a41f10fa10ae33a5c8e255d672a60238a9cdf864a66dbe786caec6c6bfa4368e9b0fcd84808c591
- SSDEEP 12288:xyM0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:gMHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1CC5523C96B992169EE2465B644F706E1503D342287D236DF2180B3F3EFB87E5603DE89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 aba4e1809ea6e50e0660a9f821e60788bb42ec71a18cd376c50771be38976ebb
- MD5 d4290da5f1b5a1208a3b614a39627a21
- SHA1 b71120a54f4f1b9d8318e9917ba38fde4f4b057a
- SHA512 af3f6cec7e9d96c95e486dcceeb370ed1f677c9684e88c98635da19d7fb6a278d8e387f123119b6551fd1503f63cec0426c208ab23dfa9b661b56fcc33370550
- SSDEEP 24576:MQ9MxZKdcz9dw3vHKozqcAdu3pDQo0d+oOblc5wv0:MVKZv6c55DJu+tX
- TLSH T100558D2DABE9059AE177D23594B250C3A633B4311B31D6CF2448D13D4D7AEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 c90e425c1c7c369543e3a1c6f9e6c175d55ef61e1b6cb62d1acae074cc754209
- MD5 3fa9b18934bae05ea489c7e1875cd567
- SHA1 6d84b96a44478964932e05a77e7057239336f275
- SHA512 7230df98041a392872dd48762d2d469a76d7f47d02ea617083e1da38cf4b9120539af0867154a753c8be65685cdc4295db0480b3a59ac55413dbf45aff62ec7c
- SSDEEP 24576:4yocDApOHKozqcAdu3pDQo0d+oOblc5wv0:VocDApO6c55DJu+tX
- TLSH T1BA65E15FBB6D00A2E136913C88868345E67370305B6267CB6591C33E8F77AE9BD38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 cd0ce5e74d63f71a5245d9440db24205325f3684be9386d6fde2cfe921cc65ec
- MD5 50f034b9bff10466222c1605c0c0889e
- SHA1 b97b74762322d9923415fdfba8adebcd4385e493
- SHA512 45bb0281722436a79f85872e62938c8f2ac908986fcd6b00b9f3cefc1db26ef934bf790b71a56b6d174b6bbbde795d232cc19952ab7aa4d3e9b721821b78dcc6
- SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKO6c55DJu+tX:u0zuNIXcnJuQ
- TLSH T1C9A57C3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 2a47351ac1556aa0ffeb452f6618cfcb4622956d2259684ce9102e0c74e410bc
- MD5 735b60e19c958dd95c2c9d929744d847
- SHA1 d504005803a57e39b60edfffbb57be49cfde545f
- SHA512 f5dfc84550dbbbaef06e76d9ad3935de8ddf20f435e5f8d9fb77777dc905526320f1b8502b3efc71c92d6ae307b21b75ce6a653feeffa2fb8ae4ea2cbfdf4e54
- SSDEEP 24576:r1QT7EcpfxR+N5AWAz3ooiYujMqbxHKozqcAdu3pDQo0d+oOblc5wv0:WTDxR+N5YzT4jMc6c55DJu+tX
- TLSH T10655B02EA7F915E9D17EC5798A23C512FA727821033193CB42A0C17E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 c4e951582078c4155e2bc2c823a87a7698dc3ebf08a258b49f5afbb7851d3b03
- MD5 61cd52a2437b92c19d149237b723ef84
- SHA1 edf304fc6bf9278d24546afc67a3141dec5a6123
- SHA512 17ba980b3c2efe951679682b70b3223ba9b3ff4b6d81cd171498166bbb57a4156d6da68ee482d86bc8e9a6c2fe4df3267aca00c5b679672035f02871df945a16
- SSDEEP 24576:JTMdOz0FFS+bmSLlHKozqcAdu3pDQo0d+oOblc5wv0:D0K+bmSLl6c55DJu+tX
- TLSH T1A575F17EA7AD14E5E43AC27D89538906E5723462032276DB0690C1BA7F6BFE4393DF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 a1c6648bcb26757aa3253c20d52f0619a49d19c6ff3abf2167a7246cd3393bc8
- MD5 13d872b3033199aa5c89b5953b4bed67
- SHA1 810b33bc002faac528719a6818090e158bdb6856
- SHA512 99c9846a14a9361ba6545b44ef9c3a3f46fe26072bd4ec148b41d71f6fd7b80bc9fd29c87c098b3b9706d432baed4437ee8fd059e5008b99bb28973904ffd114
- SSDEEP 12288:04Ko0BwKITLh9qKxNAcYj/u33ZN1Qo0ln+oLSbq9m/c5wTLg5:SoHKozqcAdu3pDQo0d+oOblc5wv0
- TLSH T1FB55128D67EC20E5F935A27689B702919035B82203A136FF35D0D6BBDF35AE49039F16
- MD5 SHA1 SHA512 SSDEEP TLSH