Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
- Size 2.3MB
- Sample260908-rseq6ascna
- SHA256 f26c81550bf80252c2de9ee2214111dceb39aeab589e7fb3967ea57de70b8bc8
- MD5 93ed1cb05bb963c7857fedf491763cc1
- SHA1 6f35f36351bb70dafe5a211fa85b7e9a4057b0ac
- SHA512 991eb0765e93333fd2b80ca94b0184d73aa62b4770404f92d2ef86cb1ec18046e3cdbb6781073a2ae1ea9570079efe9957ba4ca484931e3ff773e4ccc31c694e
- SSDEEP 49152:c8krRUDwl/rpC3qi1kjsVc2ot4+Ej2EsjKQKnAX1tIc5foj3:t66kjsVc2ot4+Ej2EBQ0Okc5g
- TLSH T1C2B5AE24FA488295C17AC27DCA9A4B4BE7B1F40847349ADF509506DE2E737E44D3FAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5000 alg.exe 3812 DiagnosticsHub.StandardCollector.Service.exe 2524 fxssvc.exe 1580 elevation_service.exe 2824 elevation_service.exe 4340 maintenanceservice.exe 3608 msdtc.exe 2928 OSE.EXE 3196 PerceptionSimulationService.exe 4868 perfhost.exe 736 locator.exe 1136 SensorDataService.exe 3656 snmptrap.exe 4964 spectrum.exe 3312 ssh-agent.exe 1616 TieringEngineService.exe 3048 AgentService.exe 3764 vds.exe 3544 vssvc.exe 3268 wbengine.exe 4184 WmiApSrv.exe 828 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\302ff7e67c8d181e.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a509a289e3fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a22fbd299e3fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071a794299e3fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f401ab289e3fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc222e299e3fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007eedd5289e3fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f5f0a299e3fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe Token: SeAuditPrivilege 2524 fxssvc.exe Token: SeRestorePrivilege 1616 TieringEngineService.exe Token: SeManageVolumePrivilege 1616 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3048 AgentService.exe Token: SeBackupPrivilege 3544 vssvc.exe Token: SeRestorePrivilege 3544 vssvc.exe Token: SeAuditPrivilege 3544 vssvc.exe Token: SeBackupPrivilege 3268 wbengine.exe Token: SeRestorePrivilege 3268 wbengine.exe Token: SeSecurityPrivilege 3268 wbengine.exe Token: 33 828 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 828 SearchIndexer.exe Token: SeDebugPrivilege 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe Token: SeDebugPrivilege 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe Token: SeDebugPrivilege 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe Token: SeDebugPrivilege 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe Token: SeDebugPrivilege 4680 2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe Token: SeDebugPrivilege 5000 alg.exe Token: SeDebugPrivilege 5000 alg.exe Token: SeDebugPrivilege 5000 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 828 wrote to memory of 3264 828 SearchIndexer.exe 113 PID 828 wrote to memory of 2092 828 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1528
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1580
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2824
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4340
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3608
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2928
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3196
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4868
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:736
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1136
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3656
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4964
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3452
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3764
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4184
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3264
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:2092
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 2403ee503cdc1d92b0a62216f48fc4fe36bd4d9a2c04d408e159e435c629ca92
- MD5 6d92adcfcb5fd4f681a6840422dbd3f8
- SHA1 664c7fb6a58930fa3af7309fb528d07550ebc2ab
- SHA512 fdcaab4757ed851837ef117c44a3397c1d794da43848784883cb7407ea9de187130f41c0cb2d071eea21e5cf9431d2a1d86b53821d8be7ea4cb3dd28edd912fb
- SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxKnAX1tIc5foj3:q3q6sjB60Okc5g
- TLSH T17FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 5edf74f6559813f9b61da1e8c5c2f8192761078adbc38f3e700f512711f81969
- MD5 ca3e8770b49b2580447683ff87a3a9ce
- SHA1 59c7dfb9764ca5cb8a7fa8d4abd7979987d83e90
- SHA512 2dbd98fdfc843cf02553d2e74043e2b79f2655c54f2c9a862f849cfab6725017099b4e9169a32d58101ab31601ea473f6d5472e15663e9bb6eea316d79be6b2a
- SSDEEP 24576:3XYfDtczAY3KnAoIBlEq1tIgAWz5foj3Z:itcvKnAX1tIc5foj3
- TLSH T11305012477E408FDED678238C9B28406EA33B8514370E69B03B499266F377D85D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 7c14b4826620364e0a49028513eebd2f58fcb0586f2a9851fa1e329f6bfd778c
- MD5 79b350ab7114fc1560000486ca2ba638
- SHA1 c2864e3430b30b4520c8560ea30649605b59184b
- SHA512 e5ba42a7ff4b3fddd9a3c31eaa69f710aa7f2c297e5d08e7810480cb6deb34b987131c4456e5286ed34788e8358468f0d354ca46ef7da784f5a615f94183b34f
- SSDEEP 24576:L0Le5ji0hmxxrMp3KnAoIBlEq1tIgAWz5foj3Z:LPji0AjoKnAX1tIc5foj3
- TLSH T102359E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 5305554cbdaee663821fcc1fb11eed8676a76537ac5a3bd2ed99bc1039707ada
- MD5 61065216c38523970f11192be033f470
- SHA1 f059c95c3e351f65af1863a72fa8f4ebe0b10a25
- SHA512 78b0c1fa0bcb6fdb03a5cd66035fe1b4531506befdf212bc7a49548fe34bdcd023b1fba0d9483a9209e8d86a28687929a7296d9e79e8a62cc604493bb138c044
- SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWn6q8wyuv3KnAoIBlEq1tIgAWz5foj3Z:S/ezSC6vUzPveHjyMKnAX1tIc5foj3
- TLSH T119756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0a0c28707c8f5fbe980bb9177970123c8aee74d273aee525ebf8879906739543
- MD5 1a7c13488ea5b44450c6befcf9b57911
- SHA1 eb59ef52911729348f3dcb86e6324708f75a2eb2
- SHA512 9828868e3191908fe0acfb98d5832078a96f0f97ef3573b499f6193aa2ebf0cf31bbd816bb0e03348f0ffdcf25d253faf3ee6c76cf30bfd2dc5ce4d72612d3eb
- SSDEEP 24576:bVbqPb88hv/l+Y03KnAoIBlEq1tIgAWz5foj3Z:bVO88hXl+nKnAX1tIc5foj3
- TLSH T18F559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 cac60bd53991514c8c387181140c3cb3d87d91210b3c178264bfac4b25771889
- MD5 1f3ba2385b81a9ea2e24def9567e3e95
- SHA1 f8eb589365c1f6ecc2f3185c029827ee19405add
- SHA512 4f7e39f4587fe5459c7cbdf57867a7c32afffeffba6b0ea8cada709575e3ab3579a564ddca6e05a4fbaa5810b8a68d3f8025a0ccda4aaba7610743aa742562c2
- SSDEEP 12288:tL7Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:tL13KnAoIBlEq1tIgAWz5foj3Z
- TLSH T125C423217B5C182EE7674631A3FA684AFD75DD70453A48232036FD07B63DDA0A83B276
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 4f9486fe21fe6fd2daacc60048c6d699e7522ae52e588f88cdb8a7e539fa2687
- MD5 6ee0d26967853f31f0a7dc950b28e565
- SHA1 a4f9035c1ddc9e064e3af24a692544fe0fecb424
- SHA512 91f2a8b18861dfed31d6c8d6cc292d5a4a945998ff20bb4b72204375adb0739725ab7b710f2371d78730fc0a55f8fb93bc2f1c4d5abb4747869d2510b078106c
- SSDEEP 12288:jeBNUbTVO86U6Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:jJIUM3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1CA05C037AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 339652416495d59055994d0bf76ea038e0453527e5bd308150222a59503a2296
- MD5 f30e844bea747efb2476c6ae0ec1f6aa
- SHA1 95f5f8ed42cc34d83292f8da6bb8828563701ea9
- SHA512 b3aea575f0bdb8b887381041fa8f997c7e77807804d9b01a0aa8c480d6c32a9264666b89ccb874f0ec1c94dffb7d3a3d4dae3a0cd5a96b705284e4bf62d4b68a
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:kQvGAdlCEL8c/DRNw5CP0Okc5g
- TLSH T183266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 a361e46b13b440cf0a9b7f266e92db685750016c348f29e5f7a062a3dd76ceab
- MD5 bfe54bf0a887dfd63dc0e165da2769d6
- SHA1 b9760c8f16e3c80ab966874ea0cf7d5cb9c6683f
- SHA512 8abb0804ace40704cd7053ccd4aa0a45279fc13a29099902d5034d08db3aeb9154d17cef9d911907f52d9717b086db6f18a8a94668cda96002bd8d9015949dec
- SSDEEP 12288:3AwSfxL/2Dc3RDLLmt0LDQewsAj4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:Q0ewsAjK3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T19D15E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 5512f01637292a4bd72ddf0993c1ac50bdbf07a6a34e927e940d2a90d75cf0d3
- MD5 4d6c1fe2be916e8b4942aec0733353a7
- SHA1 5bf1817894a016b16f28f6553e46e538abafbd2e
- SHA512 f8491ab36120c0c9f933cf3d71c7c3d51192d0537b63e02acc460041b17bc57aeef032f8e0b95c8095f88626e099f26f5530748b253da7203e15cf755cd3f45f
- SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHNOBg:oUEtQevvqc2W1cpV2tI324
- TLSH T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6e8313beb47370e68d5fd181b3d9f983f6ed79a793607f661707607c7bc21961
- MD5 ee6a58f461ebf6e00a15ff4a3333f0f9
- SHA1 8416e9a32e7140dd0ffe702774ff1de203eb4c2e
- SHA512 2e6217e965d17af5c38f0340c759d259ea95006d8009b26e34b894341a763f64e364b2ca46b1074af34eba0d3895401f09a10a8989e2146936e00dd79c4fbdf4
- SSDEEP 49152:8CbRquA/m2yL5zTfFiV+XenmE3/zYKnAX1tIc5foj3:1oquVjnmT0Okc5g
- TLSH T109D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 5a1af33a5fc8b4fdc9b44e130b5284242d06dadbd05f781347beaeebad198d87
- MD5 9f6890cfd36cf03cedf236bf8ca1e8ef
- SHA1 c41aa98c9258a12aabb9c42e339aac811033d7eb
- SHA512 8cb07b87b11420f32d4a541d2d0a9bf9809f5bf86eafb2f0e993b2e3b33f02fd1ec245a579008552149cc3818a06c2186940408bba2fe45a7af732c22272e328
- SSDEEP 24576:wAhGL3IFoiwtA5l7S53z3KnAoIBlEq1tIgAWz5foj3Z:wAMUFoiq5jKnAX1tIc5foj3
- TLSH T1CB35AD80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 da75f0e25bfbe17785edfaeeaacc8776b564efed21ca676cb9b8865df0c478aa
- MD5 0de3acaeb3262b48cb1135be9fedd0ec
- SHA1 f7d5d7d9df174859a1ab87c54c27ac7237601fbd
- SHA512 8fb67c164873636cb8a997e2e3089f76ca2609c559f57981b947cd5a93b577350a1684a3676f8024dc053807fd1cd610dbbeec072042f3dedcc3e91109c385f5
- SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+C1Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:Iwu4OWu3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T15805F14537A80CF9E9678239C6978536FBB2B8112A35CB1F1370C61B6F376616D2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 188f1920f402805d1a0e25b8e3cdb04380b6101fd397be0844a93d63866c39a1
- MD5 2d58dc12833f4a19ae5cc9351071efa6
- SHA1 c411fb5a9c45016a44d1a222b86189a46008ca3e
- SHA512 4a3451312d6112ac43f723ce7baedd0d5ed5cb6f1f0e7f8e2a9135c408cd40a32edcd3306c614e913aea6af4e8cc62983bf0818a98feeb13312afac8b4255aaa
- SSDEEP 12288:YeZ1IyIZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:JZuB3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T138E4125137E824BAE2A34238D5F5594AEB72B861533643CF213586577F3AED12C3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 1993b98398bdc9dd37fcf2fd9a18950dd0d805c8e76f85dd1b82e8a83c52f619
- MD5 f11541b236d432803b9cabd127b70e65
- SHA1 45abe26ea3b9930f4b2fae7a70897efae6bcfd3e
- SHA512 1b5debc01d6fb488d2dcc2ed7396b7fa859151f893731cd0207949a32ffe6beba3fabea8a3e4d74ab604013d4c93f543becf5b885e82d60875fb7e4fed0cddcf
- SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uj:xQRQyi36YOcPbLvw2gAf+PN3G0Okc5g
- TLSH T1E0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c353b1200ed431a715c85dd84f04fdee2d812444d184d620e22ab603c1a97cce
- MD5 aec61b235503a498604f632327d6454d
- SHA1 c97ada183514a4c92e46a9f8bf7c9065bba67cdf
- SHA512 24bf29cd08aa957bd8c23c687b002200b0cdc4872f5bcf46e1b7b6b02fce3a1cec990a4233bc1ccbf40b176363142e5ca31afa502b67e2b78331c9cfbc7752c0
- SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uj:4QRQyi36YOcPbLvw2gAf+PN3G0Okc5g
- TLSH T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 1621862f70b964f815e49921d67c25dda6981c8eb3626487666b2d3db55f7eb3
- MD5 2a582a0a05b4bb5ea9a6add6bcc1a632
- SHA1 19c7b616f29ee376230f3baefeeb63dcbacd8cd1
- SHA512 c3cd894187f13291e3792f42526dac7cd42cb28f3aec0874be2253a2b27ab211e58901a97d788bd02ae9fa056fb5cdd37bdf9dab312d7b9457b6bba862310650
- SSDEEP 49152:i68Qg55nhceWu7PNU3/oKnAX1tIc5foj3:gthLRc/o0Okc5g
- TLSH T166B55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 9b89cbb7928a6074cbd8367ca4e8f9ea39d859dc1e9336a4bacd430a2a9e2518
- MD5 c6565fdb30302da5c945b5133513d9b2
- SHA1 720f304c7a38dccdde3f601778ad94036f4eb02f
- SHA512 6cced86c6f0d56967aed194d299bcbe9543b8535de7cfb3a0da2078747cc7ca8cdc2d811519c62462de6ab89c34a87b3c132be8e1dd2d9036801e489d7714b95
- SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99d:py5112gYy5azzVvt69nLKnhZF0Okc5g
- TLSH T114167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6249003753bde82c20438b724d3b238d9ef3d2cf53f85d5ff2f4385c134b37ce
- MD5 16555a451e9e1d99f4237043c69ccd11
- SHA1 5fdd97e64c43d5c104bfce546851d5bd3f16fc2a
- SHA512 54ea91503d51b005afae42c0b265d0a2df63ba550bc96ad342c2e7054c141ca4c4bcdcf0129a2194b5feac4266f1a93a6b8d5880089342226b39a051519cdcc2
- SSDEEP 49152:BB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gleKnAX1tIc5foj3:Xu6Jmdxd2de0Okc5g
- TLSH T1D8D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 2ec8e462ecbca711b03d028042a7d206451d538a89183a1076b361499c9e8353
- MD5 12471beed4e6dab8083dc31dd7aa7c70
- SHA1 59b71b3e31955ce345a69ea9e473338bc50086c8
- SHA512 e501e3d07e977802aafae5e0f04e1f4add6cff2739442fd7b8d97eb55c936bb83028e750487cc13af21b50e6bb3e8688bea514c87a1383bd2190653406fc5fe3
- SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4xCKnAX1tIc5foj3:rmifPWRT0Okc5g
- TLSH T1CBB5AE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7962F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 de9ee4f3d15b81c5f896143c33624d7a557cfa412c8c218006290cdde1c9a7f3
- MD5 8111ab2971def99e94085187d2ab59e7
- SHA1 56980218338bb2ea379fe3f41c91f20fa8fdc8bc
- SHA512 9f7d286c1a1d47bdffc979c6884b2a47a40a0442939c9f089b0a508c79664f27bf9bae3fa97f1cd389ccb71009df584e350b5d7c58b963babad8dbf1373c5769
- SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqBKnAX1tIc5foj3:H5dKii61B0Okc5g
- TLSH T1CCC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 4307d64e76db319d58dbf6463fc0ba2e09cb6f4a55416811206b0db342478ad3
- MD5 d0ec466e908c28c2d26ed904959e1798
- SHA1 cb70155ea6e6bb091f3ce9488cc8850d9dc8047d
- SHA512 386751fdab48afdc3a7f0b47c9343a45a9f807bb9c8d59c30ec483907dc49b89da8e7472371af57a342946d5773cf90a53905e1a6e4c4a93d878a1864178f028
- SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wuKnAX1tIc5foj3:XX2imph30Okc5g
- TLSH T1F495BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 7387e757595fc2d98da2031ca65b4c8c94acee5f88f898ba626328d592ca16f1
- MD5 262e023594af7a554d3ea9ebcc9bd6ce
- SHA1 84aa1ea9af646f43d178ea257fc0118c0136d87d
- SHA512 81d1421f54e892cffedcf09c1b35bc096cdac27d7c5a78192d8f7e783b31c6d6407e7bd40bfce6294a4aff431f72d45417095a7cea9013d8ac2a573ce3dc3ab7
- SSDEEP 12288:ejZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:eN3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1D8C423217BAC082EE6538671D3F6548AFD75DD74453A4427313AA813B73DEA0283F2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 c138cc45e6ac248a3dd81f469a64c7c9b31cfbeddd715315315425a748f3cc2d
- MD5 00b1d884aa06c16aa0983bcf699eec28
- SHA1 3aa767367a0b2cc7144e2c10d3a2e1940fcdfef0
- SHA512 d8952c19a62385c97ab6a376ea3df261c0897b77eb226c13aba523eb65df4d52b13c24519ab1c95bc03474244eaf8f8ab67b8e6c160d5e5eb6f2b7da67d33661
- SSDEEP 12288:/8Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:/W3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T17BC423217BAC082EE6538671D3F6548AFD74DD75453A4467313AE803B73DEA0282F2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 25e1cadbb285cf00b514e6de410dae512de19b5d83fc19edf1fdb248e5a63466
- MD5 6b4c8947be034dbfadbc9041149748b2
- SHA1 523a6aa35b57d1a2887dc61f5fa9f0b7a1fcf4e1
- SHA512 1aec1105ef5567c2beb2357202caf28d1a6697c2c5f381f6dae1b73d6dbd1c85a47d50069124aff9ec5837709a96a58741fc38e5e91c2d53a5fd3ba8e01e715d
- SSDEEP 12288:eCZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:eE3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T154C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 0a5417ff5e5c7dc43e71227198f65fd17f6214d61f65e6a57a7060c1df27b3f4
- MD5 742c3876e8cda2a519ec543f2b17b3c1
- SHA1 7d4ee0bf155268ef5f48c452d8db5c9ce798e1e1
- SHA512 22579ffe659d9f4c143b9502e40654516297885542915b6cc2568d8b9b304eb2b1abf101287b8e1b911c6c90a52a3defe7cf9e975e0eba2ca01621aba3fd9f67
- SSDEEP 12288:rVBZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:x3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1C1D422213BAC04AEE563C274C2F6544AFEB5FC748636446B252598077F39FE0283A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 3c08b72ad3fc6dc50c151b716c6a0be18a98cc4314a7a89f325fb7a720388bea
- MD5 26135503e699b46a56b2f6f9748efd7f
- SHA1 c8abc6bd01d77718d94341d9e6db8d513f788f76
- SHA512 64190359f9e15d93b68663a575de47eb89a4fc5179f2087acf5f1bf8326ea23d332ab3b1426f1aa0f55573336c02afa4f91caeb5ed053f881902ee2827434173
- SSDEEP 12288:pZZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:pb3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T171C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 96a69846e2b396347a0a0ecfb27df5a1d4000d95beebca25611f155a0ace8abd
- MD5 8d6860a027b31cbb61e5033dce4cee96
- SHA1 a9422e3ce3b26b2bf3dc50f88cd48cfae1f75e66
- SHA512 11cf75e6b7a804528411a9fa418a113b0aa14c2a409d68aa9dd9eb3f0751f5b96bb78f8e4a570f6f0274897de4a64f293472621c66c494924f71e1f13f48f4fd
- SSDEEP 12288:7gZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:7C3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1D6C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AE803B73DEA0283E2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 a267f10bd81771db1acc0e92be4bb24f3b031838ed6d4b2e31173b562b3e6ca8
- MD5 2c734a971b94eaf8236a39625283b72e
- SHA1 c0a411cc0da6e0826dd7fd420279121c25a2f6ee
- SHA512 1c34d3e6c2bde0d71d00324b948f86be08f1fd3b6dc74f6eb297a6308da4ebe4e92c7643356d8f510da61fcf8d3ad78921fc54be22efbac12ddd8a6a05931a67
- SSDEEP 12288:sUZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:s+3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T14EC423217BAC082EE6538671D3F6548AFD75ED74453A4427353AD803B73DEA0283E2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 d94f59fb5dfc35e0d00bc220b90d53cc5dd8d2568711d64a2c5aedb323928d90
- MD5 e904ff61d65f261980f6ade09b22545e
- SHA1 dc9bb3b0eff910e16d7a94e6faffa9efb92a5c46
- SHA512 f04c944d467e27d8c3e003fa9bf161f74f8d264d1044fd3966217808637b2568b8cd5c144be1545cac17c740ae242beb8e4801713f42f6a1b0d87c7e88875cbd
- SSDEEP 24576:GZMRzFVSO23KnAoIBlEq1tIgAWz5foj3Z:GZMRzfAKnAX1tIc5foj3
- TLSH T1A605F161739418F9ED63813EC9658906EAB2BC650770C61F13B436276F377A01C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 595c36167a8d198b193605887643c06848b45c628c7f8189d86a3994344c4ff3
- MD5 a38ba4d84dc445e55917894961c4fbe2
- SHA1 85f6bb26823d6d2f76214b7f7c002e4d94d67814
- SHA512 e72570fc74a925a5b229ebfd4a64c00f852fa3a452472350b087f93bfeb243b069a1622e34fb95ebff32313649c5cbd48f6f0b81acc7a14dab7ac3abd95831b3
- SSDEEP 12288:kvZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:kx3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T148C423217BAC082EE6538671D3F6548AFD74DD74453A4467353EA803B73DEA0283E2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 b04339828ab50e3b65c5d10c277a2db3bda303d5d5add4c7697b9f334c1ff9e9
- MD5 0f37565e908dbb6b57a4c1ece892fd43
- SHA1 73fd307d4ea0d7f205cdd67c528ac5dbbff56f71
- SHA512 f9e604ac6c72b202ccdb060bb63a44335edd6ff9716ada28b38f79a6a84f395e36c5b96c08cb044b07a5932866984ba20d783521fbf40b3afb025f342ee94ec7
- SSDEEP 12288:oLZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:ol3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1E0C423217BAC082EE6538671D3F6548AFD74DD74853A4467353ED803B73DEA0282E2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 7fd3734957b2e0676fccd4b97c98389e7b7bb5c904e7c5ba837f33a4e28f2f25
- MD5 39551144624504cd726ad87647b9137b
- SHA1 0ee87b46cb6d5a3fe36b8e24fb155b45d0178f40
- SHA512 f829add0cc337439a5cb2ba9f26b339d68ea62a8135c57bbf0fda59f15e7c6498acd72a0bb07dc85bd1daf614b64379442f8b36d376e87186fb3074e22df8f9e
- SSDEEP 12288:dyPz5L8IZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Uzy63KnAoIBlEq1tIgAWz5foj3Z
- TLSH T183F4021377A820FDD1678235C5A21906FB71B83147358AAF236446776F2BAE06D3EB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 7712b93f02311501af3c168e9d6efcaf5a05dfda3a7e171ea6024648f96b6c7b
- MD5 9aea9dbf5958cc7965f997ab426cc8b0
- SHA1 3f7340e65c590701fafbee88a5cdbcc9d6b50acd
- SHA512 61a8e376de7647f0d87696d7af8d241586506e444531983743f783a214ab0dffa59fc78be41ce0ad251dd898c9f861a203c8d4bd94ba7cc25b2656650b583276
- SSDEEP 12288:svZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:sx3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T173C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 e6fadc50fc7663aaabfe2843e7adf8f35d278463b3dffdeaa09e55831ccce82e
- MD5 c8dd3d50641c04df4e1211f8068df061
- SHA1 44f8a002f2117be97018fbaa09df66a4b356addc
- SHA512 6c2cba911847b165bb326ea381eed16bcc29d3c794629203879ccdc13c34333fbb93349b5a33dd10f16f5a322a6c1015856f573a65d78ab15c4e1700940a6c1a
- SSDEEP 12288:evZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:ex3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1D8C423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 f537068b66970f38b0829da96a2593be7d65c9fbdb252762efb67469d4915d5c
- MD5 d0f3cfc41064aba7d416aa13579fe61b
- SHA1 159a515650a9210c997b31431e04382920f4d10a
- SHA512 b720c09d2c9272d7e805acc8df4d7afc6de27b3a5fb0a2bbcf22c9fef91d5ae25de53b2a0a99072a689a696290e54312b5116629ab539f0acc0be3d2caf01798
- SSDEEP 12288:5yPz5L8IZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:4zy63KnAoIBlEq1tIgAWz5foj3Z
- TLSH T10CF4021377A820FDD1678235C5A21906FB71B831473589AF236446376F2BAE06D3EB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 f35bca8dbe41bf74609986157095fea304f437b5a306330a2b8fc33017d93f5f
- MD5 2251093ef740f5cfb072c3b65ea4c3f5
- SHA1 4c906a227304c8602222cd897bfb6ff4eee75811
- SHA512 683dc3b26cce2155c8757f9a440c4c4b8f0dfe11daa1b246518df1258baea5833e6fa436bc19e9410f54073496ab0592475c25c892db91fa7804cee841a0314d
- SSDEEP 24576:zcP4mcvIjkGOxhKP2l71SNKbrh/8KB53KnAoIBlEq1tIgAWz5foj3Z:IP4m4IpOO67N8KPKnAX1tIc5foj3
- TLSH T1EB65BE2DABDC0096D0BB913486658A4AFAB1742A1F3286CB1170933D7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 5a8ace6565b88155b58b0dc5dd1b3c4e50ba4b4061904f0a40625baab91d163e
- MD5 cb4bc7c2119af3dd263a3f6d76c99203
- SHA1 bf61270abf7c90beee0790ee3ef2e8c73a8a7433
- SHA512 d6bf32b34bb9da58e8499ba9c00b5f2f03e1e1576d8a5c3ea4be6585b5c66da5a1fcc0b1afd0176fc9d76e7fd4bb7a5fcc677c19a1e83730219e71c940b35f09
- SSDEEP 12288:bbsffZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:OB3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1EEE4F115E29801E9D16E5275C7A64A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 2fd52e53cd8a34babec5889c08fa706988ebcb62ba189872a484385906794fef
- MD5 d98e07069fcddf9ca8bb91d46d3526f1
- SHA1 20f2a29989ccdbbb24366bf2b3edd80575009181
- SHA512 a32f20045d55af318bbc9cfb08f69b367e8c5c1517bcb9af567741e90dccd027e22dc9efe92dd3352553209ee9d83777097b2ee2a5999e6181900735cfdb69f9
- SSDEEP 12288:s/Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:sh3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T123D42321779C182FF677863092F69419FD39F9344A3A84673039A517B63CDE06C3A27A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 4f4a493b02f4d16c19e2a12a91f39aa221d824125b992bece3b057f0cd5c59dc
- MD5 009037de2cbdeb36369bf6ca7d3f60ba
- SHA1 daa3a6fae572177070bc7e2aaa7b77cdd327aaf8
- SHA512 664a2117c87fe98c53d0555e6fab1dbbf12ecdaac5fd0a78a9ea21e9c26f636ea3db4160d7e8b6cef3cce46eb07d2a8118783598f9ed3f952717ac7626e2df2e
- SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQbKnAX1tIc5foj3:Ha0hNYG4Jwg0Okc5g
- TLSH T1D085AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853E3F37DE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 9d0c8d81b3ee991e92d434203c6a2719cb4aebb89004093595e5d52ea50285c5
- MD5 6157fb6276a11878773376cd69597d0a
- SHA1 6e5c3e0ca285383a86601a1b379bf7c33b21bd6c
- SHA512 634fdc799ffe800d8e325c1ae9784e327fd95b9464c45401599cd21f048ae9ab44014ee754ba647f41940808c47ca938f37c191dfca43676d22d7c8bbd2e0a3f
- SSDEEP 12288:VhbHjfXsZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:VhbHjPm3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1EBE4123927AC1099F172D27D92A6454AEB31FC35072153EF22A5C13A6F3BEE41C39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 1ec9e1e95f8cf7cf466225f22e59b1c4a95cd09afd4e49940e87971ba2729a3c
- MD5 62b8def7a0b22fb3316b1ae6ce23154e
- SHA1 84eeb0513860cb838acd0884151bd9ac0b6f7774
- SHA512 f9c20febbb265f56b1927dd26c1ef3619625cbc80b2bdceeeec0d4e98e9ad1344e175ee25b2629bbe8c34cd815bedb85870b1219f8b3b686957e2d3998427dbd
- SSDEEP 24576:B3YgnJcRTk4yti+R5dpR/u3KnAoIBlEq1tIgAWz5foj3Z:BIgnaTk46ppR/sKnAX1tIc5foj3
- TLSH T11645BF2DF3B810B9D8A6D236454147B5FB71782D1F209ACB0170C538AF1AEE85E39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 14b3cc882763ce876b562fb9e941d66ec16a914da793cc44cb8bf71e8ebb55c2
- MD5 8c06705537e738715fe794e9cd4ed49f
- SHA1 96ef0aca091c14cea59b5781fc113dacd0e68060
- SHA512 cef12a5af2d1bf1d21a0b0d4b15c3210f0b0e4e8e07604d4a5bd834cb680e1143927f0b7616e59e6714f640c53786c67406dec1602798d8882c36bf754e7c346
- SSDEEP 12288:nbZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:nV3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1E8C42321375C182EE663867592F6544AFD74EA70473A44E7303AE913B73DEF0283A2B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 afe7baa999e37c8c35f604dfd5d699219575cc2720e9c1e233b0ea7c46ed9824
- MD5 dce94f9531ee79822c4ac5c1246b9967
- SHA1 9811305a70a313311c28d9e13d3479c4c744b7be
- SHA512 f7f94413655e271afbc7f8b40188a99286ae8f3404dafa2d9153d13c249288c97e9b5d6d02bfed61ef56b4f637f35826ec88fb24f43f94e6742bcc0393fffe08
- SSDEEP 12288:JObfA4LWOsvAYFT+Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:+bL3UTY3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T15625F111F7A804F9E967C13CC5B68916E672B86D0324E7DF03688A562F237E14E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 a2b6111aeb4207e0ae5ebe2ff66727bbf5f8891a0663984d9cbeccb39609cb8c
- MD5 88a5cc7b88d670462b56e80c43aadad7
- SHA1 142aa7f17991a82c531060eae4c288587009dd0c
- SHA512 49574b7cb281ac51493c3c1d72194ca7298c1eeaf895d96d11b0f67c01b3c42a79f0ed07199ae5fbf874bd8c32106b6af4211217b7032b8e2e21739804aa765e
- SSDEEP 12288:QpFtIOaZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:rOs3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T142E4022537EC10E9E176913D86A2424DEB71B875072247EF02A0816F6F67FF46C3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ecb0940a3ac27fb2a38d8ebe8d6576e575f2c70b1aea9ce00d1948993613e9a8
- MD5 32323a434055aa91f971aeef4616094a
- SHA1 5ac19c5d5136fdb26c1275dea58e015ab4ac20fc
- SHA512 556bc1f3a61d287c9a443631979ac14b0ca6070d64b346b64e130288d85e20bba3d0a12e373523bec97f9df09d3c607b1b295027b7c68b47deba5b461729a8b9
- SSDEEP 24576:Z7NM9YmZqmWMUkPjZM48Mv6bEhsx3KnAoIBlEq1tIgAWz5foj3Z:Z7cBWMpPjN8DbEhEKnAX1tIc5foj3
- TLSH T18E65AE2E6BAC81E5D577D13DC9E28205F6B1B4611B318ACB1162833E7F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f2070e58fc0f067809e25b489afc7c0e9f7e102dcc655570b2ceac8966c8b756
- MD5 65382d0bdb602a09f84878e64c592539
- SHA1 ff1b01f34337fe0fabfad1387a265a8922adbaf2
- SHA512 b4c0ae5e5d07edee36d6c602991acf1c28a235583d40e1ff87d61f82d48893dbcac32aa380d11ece61e9fb5a17e31c36a9d3c68f1ca8c83e657c33290028b18b
- SSDEEP 49152:PF2YuHNETovcvNYf8kmxKnAX1tIc5foj3:W6tCf8kC0Okc5g
- TLSH T1A4857D2927ED80A4E0BBD27D85B6D246FAB2B8511B3055CF0255862E1F33AF45D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 e3b72fe624c3dfe86c415a36dd28f69d3eee3ea1791cc598959c1d4948c15918
- MD5 b16993a294e2f8420bceb7e9810cea17
- SHA1 ad3a78820c85e107f3a8413f4a49f744bf894ec8
- SHA512 76cabc46dc4d01476d4a36d27dfd1cbf2add518e3342b825ca4fa57694a24d5bb5c234fb9a831afdf89ec4e6e060188b8711dfc41b35dc615693a7540d5b7bc2
- SSDEEP 24576:eAFs06+OmlfkNXEbToQ3KnAoIBlEq1tIgAWz5foj3Z:XFs060lwXu7KnAX1tIc5foj3
- TLSH T1B765AF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0160C63E7F6BEE81E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 f9f3ab7828c388cff0fd85438c80c1d9211a4903ec3db0329a4a3cbde020ed51
- MD5 bad995dd49bc83dde0f6566aecbec8b1
- SHA1 330396432d4714e4f7b9883e2a4909ffd1134c38
- SHA512 a524b3efb4c5dffe9d21958c145071472beb95a75c7f723c5f62365998374e69816dd7a779a92cbce72ad43fafe66a481248d1bdc78e0122939f07f211d1bae7
- SSDEEP 24576:TJnJ5D3Wt73KnAoIBlEq1tIgAWz5foj3Z:TJnJ5DGt7KnAX1tIc5foj3
- TLSH T13815D02DD2A810F8D4B7C274829A1B86FE72383D2F2269C72474D5357F16EE0A979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 73cea50c57178d3db5d7e4d229faa960200442991d19872a604fce063cb676f5
- MD5 b2afb6ec75cfcf4c16b9bda35bac62eb
- SHA1 34f9a85e3208a8f6d06361d1191be10dcee092fa
- SHA512 1ee9fabd227762f18fbb3cb44d15e64180cb3586c916499d892600793f19a47b47a5199d522d519d8a42c9044bf014833bca389858084faac7c9f0b9a046fc31
- SSDEEP 49152:Zo06DIKdwc+eQnSt65aVdKnAX1tIc5foj3:OH0Okc5g
- TLSH T10A956C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 0c250aae3867e9209d54bd014c3647bef2c7f07fb5fff82be470cf1d43f554da
- MD5 f7c65887088bf0f3138201242951708c
- SHA1 52f463c3a70bcdef6205b7d4c39b106a68cc8666
- SHA512 6f425df2d84dbb3c486aabf112bf5833cd8da1aa19b5defcdcfc104bb9e194636d271c65dffaa5e779d49659d3a1fb924aa607c9e2d32a1c52f6008360140ff1
- SSDEEP 12288:/EP3Rr1Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:ErP3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T18AE4026D37AC20AAD126913D82A18549EB72F470172217EF11A5C13F9F3BEE52C3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 e8d0d0d98ed87a89ca1429529f183c88273037e6fa3a1a7f06ddd8e3064b147a
- MD5 aa5caa16b53ca17daab2e2ce5f998321
- SHA1 c37076bb3b180fd6324d462fdda87b1479f60ff2
- SHA512 1a51ebb3a6625bdb60829381112c5b63ad0b34788066aff8c42eecca27b93388f8dca7edb2e17197692d688638829ce28a1db0d757de7580b35e64016b0b9b36
- SSDEEP 12288:+jky8Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:+IyW3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T180F41210239C1499E6B6463896B34195EE75FC304B3545EF20A0E62FBF3AFE06C35B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 372879216067fbc13a4b2a9ca020e0b742082952bae46f59f19251562f5fa1ff
- MD5 2185390d25d7e95af549ebc2282eda0c
- SHA1 e6a5d9add895f10d20ec0944892168eb1267f29b
- SHA512 1b807dd54447e5f26fb32dc17864bdb8fe86c21520acfda6194fa73f1ca635c4eda59b119c4238a542d842d18c665e36ca29185d877935e50b33431cb6233d9f
- SSDEEP 12288:RFqZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Xc3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T19CD42320376C282EE653467492B6594AED74F934473604BB3075E533FB3DEE0283A6B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 d96ef9f5d24fd6155eb45c711c83e2c7f1b255651d3b16ab985e559c3ec93fa3
- MD5 a940a782ac1b031f24147343a7511d23
- SHA1 9d05f13d02c82bb55ca71abe33dfd206f54249b4
- SHA512 96e6a22935990c00640be410e39ef126cd02447bec19c0ffe20bc74a4ce1cff379faa311a9eecd797adeb784a94a2067a79ae7d45aeb6ef7f08cf1fe6e1b3570
- SSDEEP 24576:OQ9MxZKdcz97w3J3KnAoIBlEq1tIgAWz5foj3Z:OVKXpKnAX1tIc5foj3
- TLSH T14B558C2DABE9099AE177D235D5A250C3A673B4301B35C6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 61939772470591856ca73103fa61b29aa1fb31b04b584ac343fd061846f064ca
- MD5 cc94ce1ba5b6817c6606f3adc796d0e9
- SHA1 51bbf0c51530a4b7bc5dc0fa028314a43356a21f
- SHA512 5299b306a8f7d3b570d7842496ed1a72a35cd98f5dda4b212fe9353071be07cf5faa8787fd78ad7ca8e2a9a1871e6c65152ea07680af61f4d6dfb618abf9def9
- SSDEEP 12288:dyoKo2HRple9p4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:dyocxApK3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T19DF4E01FBB6D00A2E172813C89958645FB73B0305B2253DB6591C73E9F27AE87C39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 1f810ebf3c3b2d95c8336003a6a21938a5aa1b2c3a8222bce3b9aef433f5933a
- MD5 424e77ca646f17c4fd560c3a12b085e3
- SHA1 f96293cf659528e5c8a8fb34ca80097fa25bffbd
- SHA512 73f2f49b94932fbcc87e7b13ee8e8b0bccfdcd3b37e0d62c2a2fcce66a3b2f14b6d65ec748aaef93811e95af2fbd5920486100b54c3c7baa5688aeef823ce102
- SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK4KnAX1tIc5foj3:X0zuNI80Okc5g
- TLSH T134A57B3DA2BC00A8D9AAC375C14513A6EE71742E3F2055DB01B0C578BF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5d00e2473ed302274a211b6c013998a22ef9b16b1e5b0b30687e854a42c046b2
- MD5 cb9b3b29b79e58688cea5543879efac2
- SHA1 b1c7eeba60868060f941dc0734415e849b1a52e4
- SHA512 e1ef445ec59f4a7fac0b8dec767edff5b3981b8f45cd63b568a1f5d864bcf58c37f4c67380899967c426907bab13879443b3aa3bca7c839e57f49009aa45198e
- SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYujMqbP3KnAoIBlEq1tIgAWz5foj3Z:DTDxR+N5YzT4jMiKnAX1tIc5foj3
- TLSH T16155B02EA7F815E9D17EC5799A23C512FA727821033193CB42A0C17E1F6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 3217395945b40f391b19e33d21c92c655ae3bd5486199b5f64b31d9e96df4df7
- MD5 334ed741c131daaba4ab9f1ae421452b
- SHA1 4b6ab55819f4bed1acc6fdcfc47126290525f733
- SHA512 2871118b9f6b1603c6521427f8f76c650a125efb5b8e99e84393e659b0e75c1afec226ec778b2fe9cd545b7e28603f3f40078ea55d17184c53a4a108533708ed
- SSDEEP 24576:ATMdOz0FFS+bmSLT3KnAoIBlEq1tIgAWz5foj3Z:o0K+bmSLTKnAX1tIc5foj3
- TLSH T13915E13E63AD14E9E57BC27CD6538906FA727461032265DB06A0C07A3F5BEE4393EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 8b0ec2f16eb22728849a079c87869235deef339ec28ab08783856ccfba44fe5d
- MD5 373eb0bee929711330d674e3b262ceac
- SHA1 cfb4cf5a0eca9bed5883b17e0e9c0a529c541866
- SHA512 399d3934da16043edc4c53609ecb85005af0f547ba10d4d6759cc05155ae2757b3ac3288e5b75a1f4238eeb007d55af2c20c239581260e75fe3995933dbb8dde
- SSDEEP 12288:Q47+Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:3Y3KnAoIBlEq1tIgAWz5foj3Z
- TLSH T1DAD4121937EC24A9E5629234D6B6414AEA70F835033545FF34E5C93BAF3AEE05839722
- MD5 SHA1 SHA512 SSDEEP TLSH