Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/09/2026, 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 1.7MB
- Sample260915-wrc86ayzhv
- SHA256 96645509032398aef3d0dafff6767c7f3519c96df5c712f3857391ba649b519a
- MD5 54c0b2771ec4212d30dbc0c84ce6abcb
- SHA1 4b4cddef4c5becebf271e72374615a1510ae52f5
- SHA512 d3668c89a3538bea7e2724e1fa15b80c0da956d6dca032cee73984de44d6df120fbdc2029d06575f661e87b328000911bac5996b84fa52a1a3e5e4145767f9e7
- SSDEEP 24576:QLBMAf0XHKDunAQLXimunrrhX4TOet62R6yz/TwSfVcYG3K/cJHlnFR+IGNe8j3w:QtYaDYzymsNiOEfLNiXicJFFRGNzj3
- TLSH T10185BE8997A401F8D5F7E275C8266903DA72FCA9077056DB0290338E7F3B6A1CE79712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral1/memory/4824-350-0x0000000140000000-0x00000001401B6000-memory.dmp family_stealc_v3 - Executes dropped EXE 22 IoCs
pid Process 3792 alg.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1668 fxssvc.exe 4344 elevation_service.exe 4968 elevation_service.exe 2236 maintenanceservice.exe 4656 msdtc.exe 1944 OSE.EXE 3948 PerceptionSimulationService.exe 2148 perfhost.exe 2296 locator.exe 4088 SensorDataService.exe 3840 snmptrap.exe 4788 spectrum.exe 4012 ssh-agent.exe 3140 TieringEngineService.exe 1856 AgentService.exe 1060 vds.exe 3580 vssvc.exe 1236 wbengine.exe 4240 WmiApSrv.exe 2316 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6a5aca53a26b1277.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ba4494f3d45dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d5a84503d45dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acf0954f3d45dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9a0874f3d45dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df545a4f3d45dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000290e57503d45dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1432 DiagnosticsHub.StandardCollector.Service.exe 1432 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeAuditPrivilege 1668 fxssvc.exe Token: SeRestorePrivilege 3140 TieringEngineService.exe Token: SeManageVolumePrivilege 3140 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1856 AgentService.exe Token: SeBackupPrivilege 3580 vssvc.exe Token: SeRestorePrivilege 3580 vssvc.exe Token: SeAuditPrivilege 3580 vssvc.exe Token: SeBackupPrivilege 1236 wbengine.exe Token: SeRestorePrivilege 1236 wbengine.exe Token: SeSecurityPrivilege 1236 wbengine.exe Token: 33 2316 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2316 SearchIndexer.exe Token: SeDebugPrivilege 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4824 2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 1432 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2316 wrote to memory of 4500 2316 SearchIndexer.exe 113 PID 2316 wrote to memory of 4952 2316 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3792
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4764
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4344
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4968
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2236
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4656
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1944
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3948
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2148
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2296
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4088
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3840
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4788
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4012
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4976
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1060
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4240
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4500
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4952
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f676473abc5829a0385d9f7183e487bb1d9c645726ef280e0d4a6aa147194adf
- MD5 9706dbc8b2fb42bd3ce8a7364cfe0ad1
- SHA1 2a18bbebbeb54fc2c5a64057cf8ba145206f85c1
- SHA512 479329f63f03886f18f4c7a56ce8d0f46edf6687299e7f7813fe054e3038ab2105d2813cfffcbdc791c9e725cccae9ce1d3df013544cb8f5b58ad7b2009244cc
- SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmLNiXicJFFRGNzj3:C3q6mjBV7wRGpj3
- TLSH T184D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 e5c2694ea397c85df457e0ce04f2033100e6e6bbc9740a0ec913b3162e7e0158
- MD5 0d42c90e1d3042f05b4713c32e9d4713
- SHA1 1d91d3ec04415d05b719bc6128abb76c745cd086
- SHA512 b550c65a15fe2ef2aea2b933ada32c011b04054649ff3e3f4756b5fab90f19be31e6e34bb0e3b3cc96eb9b3be606eee12b894b4d4ceda6fb62df72d4c354ce7e
- SSDEEP 24576:5XYfDtczAB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8tcoLNiXicJFFRGNzj3
- TLSH T18775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 cf069be086e4600d9f8dad68224a1cc67c4c573eff8e775c75ddc7b7c88e6856
- MD5 c94e8575ee4a332a1395a9b0b3c33ea0
- SHA1 9a1e3ea7fde257cb522e52df3dbef1e0ae607fb4
- SHA512 0ba4ce7d7151b4a3391a37036468db9cbefc02cb93340f3626bd41d921f06611d0c8efdd493b9d0cc22f883a46a2207874a2e13798502a80882b761ffe24e1a4
- SSDEEP 24576:c0Le5ji0hmxhrMe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cPji0AzXLNiXicJFFRGNzj3
- TLSH T1D485AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 86d669eb7a5b9478f9442953bd24f4ceabf2b29ef38510cf0eb9c4b78cacd598
- MD5 eedcd230ffef3e1419b6ab0234eee6ed
- SHA1 0f93b6c46b72ff9a946a2b2da5952cd290e57211
- SHA512 ef49757c1c2730824ef97184d07edfecaecf06d6b6626bc10e66c8c4f1d98c6b0ba0562b87cdd40b618af424efc0ff8ac2bec852ab30120a05b09544681e62ad
- SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWj6q8wyuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0/ezSC6vUzPv+HjyTLNiXicJFFRGNzj3
- TLSH T1B6756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0b57f1353e2884c3c9fede7c3a00279a67f8be658ec1f6d1fc84b695ee8fbbc6
- MD5 cef49a7173afbd78364d02ca6403ddda
- SHA1 2714c3210a29bb69123a8ead34bc5d9f06198acc
- SHA512 ebc8e578a7cac031ba942c109d73b1a6dbd295270d929249afef7550e5730ebda232f7c37cfd5e21aa7461f06c590f546371711819742c610c6f81d8066cbd11
- SSDEEP 24576:SVbqPb88hv/l+BF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SVO88hXl+3LNiXicJFFRGNzj3
- TLSH T1FA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 c7ab1f4194d1e5b266bf94a322a9deec8c6705b44e7a69c642c927fa32141cab
- MD5 95d00999158dc385360aadff88510ad0
- SHA1 93f698359cfae330895a7ed8c594c2837610fd16
- SHA512 b869ce2ce9abaaeb50132bab9694882e58a93c7c633c50f7515c18446c181e90ecd4e5d4dcf9a3ae2602f76c299f8b5ff818c14f0420d93c5495e5067e0bc587
- SSDEEP 24576:EGS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
- TLSH T1BE5523D3468855B1FBFD003A867A5828B5845E2CCA565CE2D2543E5E913CFEBCF38127
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 de32e0bcc109710a67f9521accc19aff5d41a3a3c410ab7a0ca1820fdc1d3c8b
- MD5 baf80d944bdf136b8b9739e8c75dea75
- SHA1 7cde8e6bd5fb476a33aea709c8c11185cd57579b
- SHA512 51ce990a472d8b74733a4d9e7ac58a8ef318acc35b13492451d85a9f345931e28e0a485d7d434b723243ac28b750bdb64af3411f9c0898c3077ff2ee379d0ed4
- SSDEEP 24576:CJIU9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CJIU9LNiXicJFFRGNzj3
- TLSH T11975CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 fe7a018c814ae5dc36a8fad028c901f994afe25c7069480e5b7aa3f0ed21b856
- MD5 1afe160ee6745c716ab85f10fb4294f5
- SHA1 69a1923061ef5971cd5827624dfee34d0af3f556
- SHA512 ba3cbad9bdc40c52f443c4a3f7dc6f346ff214d8577f9c0fb3b3c2b5e94e31b25d774f6fb2f3301bbe95f127fc13b2bf78e850fa747ec56ff31d999cebce8341
- SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THF:bQvGAdlCEL8c/WRNw5CI7wRGpj3
- TLSH T1AF266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 c152dd4c5e1731a0cb757de57ed3e1803f0fc75591ec62003cd0e46fc9f70964
- MD5 1fae5b5329bc9dd7f888c02e32b0b37e
- SHA1 e294c613d18da526a0511733c76d3b57ea39c01c
- SHA512 9f4e09339be7ef44d3429ec813b9dea6608f7514b805ce66bafe220f6114e13ecacdf5db0bb7a33de4213213ab291e7a68e590b21f022abf05a23c78510bc87f
- SSDEEP 24576:tfewsAjH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xljHLNiXicJFFRGNzj3
- TLSH T18675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 6506118b4239c971056ecee72fb14b2e42d7602efb850ca9f68fc3ea8d1ed20d
- MD5 c82a89903bbd1225c663aad47e333728
- SHA1 e2d18b8805233b547742516cf1f1a021d133efc8
- SHA512 72961f0ae4c62be3af47ad55a56297c461c007cc53e9fa44f50ff52436dd09b3623d8fda5efdac7db74ff975ce50a6c634c7ebfda6c87eed54ddc7f7df97d007
- SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHzF9:cUEtQevvqc2W1cpV20I32x9
- TLSH T159474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 613cdc5edf3624e0f975f985983508c10e3c01d4b42f6a506db4b32535897fa7
- MD5 208ee88e93cb38d7b0585a8577cee0b6
- SHA1 d0ca887b15d42293467a48f1878a7bc0c06ffc94
- SHA512 99bdb2a4f6d8cb18c1b6583ba84e55718b7bd04ec550755ed5740e4d911f6807ac2fe3944558e650dc1fbd147bdb6f928738b5f42a030a1c705517b94e9d1d2f
- SSDEEP 49152:pCbRquA/m2yL5zLfFiV+XenmE3/znLNiXicJFFRGNzj3:moq2VjnmE7wRGpj3
- TLSH T1CFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 972f5de67c099fa82dd56078fce0db21dd4d25e6845c303cdf04da5dbf55fbe7
- MD5 ad43e7a2a3223e55b67eded2b2cd0809
- SHA1 0adea3e143756c367cbe125a2f65b08f109e1184
- SHA512 e7031ce1628f98f8084665b90976075a8b12198998716a618d4f9c86ac369c0b923c6de2422224644d9bd39b68d96c64bad6da701311150da1c3dbaa839387a0
- SSDEEP 24576:YAhGL6IFoiwtA5l7S53k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAM5Foiq50LNiXicJFFRGNzj3
- TLSH T17B359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D11F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 06d0b1bfe905a49cb1fefa9866ca3859c9df5351bdde3106c19931427dde43be
- MD5 dab4abc898fab12f9754317186469516
- SHA1 28fe8010abff121694e1b8c8f33d6ede9b1863aa
- SHA512 ea998e3c246430245392e5803ffd1c190029969cce7967885ab87237732a24a882e25c66b8d978fc8b9656a53479028a050cdffe755cb96f9948971bbefe0b4d
- SSDEEP 24576:swuROWz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:swSOQLNiXicJFFRGNzj3
- TLSH T1D165F18632940CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 59571b92af7f4c912c0a6b4a9fab0ef213b287f981d22499661499a1586e2146
- MD5 47ab28f057307ef04d0ad395a846763c
- SHA1 21de27a549a90a3e7cb8e51a3e547b94e7bdfba8
- SHA512 5a705c8e2c62a1e802dc61f91ef7a5b316de478ecccfd0bbdca53b6bc16e47bf7fdc616929819d4fa4a8181bff67e907c9d8b9e133716624aa298abf5ef88462
- SSDEEP 24576:uZuW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6LNiXicJFFRGNzj3
- TLSH T15C55129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 7670ff03be84a44044e888542d8d06e9218836a47ccf16b54a04e432cfa5b4d4
- MD5 7026c2efaeb99fac0fb8c4f53fd11dbe
- SHA1 6376ba94a72a077b3f610d2f10ff2314a2fc1076
- SHA512 b52ecb5df248629479aacb61cf973b42da92d74a91966c70ad62e399cdf56e16a8d08bb65ab0a8e572179e44756cbec86708e8d952c2f1c3ab40ffe0a027a7ea
- SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN3Z7wRGpj3:DQyiKanX+PNdF9
- TLSH T1DE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b6c993576a3c698b36c822618c94577068434f3bca164ccf56fd36ffbfea80ac
- MD5 2f9bdb9e189c6d0565afeb040ee4ac67
- SHA1 a59e3aca7489586217c6d0140000f8811016de43
- SHA512 4b8b217f38021bb203b218bec2d89f2db42ea863f221e1fe4de51ef819e2576365ae41658838ffaa02415a8e36ec0a92c84502bb4e886f2f14678824059681b6
- SSDEEP 98304:YQRQyi36YOcPDLvw2gAf+PN3Z7wRGpj3:PQyiKanX+PNdF9
- TLSH T155667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 9c63aef3e5b3215dfdde83a0064bd41506d0e1ebb55845c7d1ae378d4912a763
- MD5 019cec19bf1d2d477284e8000ce90904
- SHA1 5c6c1de87309e0576e2c20acb846125f86ee93db
- SHA512 7c5ac00d428d6aa22634a639e95a3ef913ae7b13696b65e80e7094121065878ba6010724d17f0819b06aa09e3c637b9ab2436db31eb2a13dd28b0289922d129f
- SSDEEP 49152:c68Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:WthTRc/X7wRGpj3
- TLSH T116B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 cd4ae13c6ddb378b1d896855038f76570ab4881fa7d892ac96414a948637dd6b
- MD5 5fb98128fa3bde6ae736fc7782e5e9b9
- SHA1 ed82e908e92ccffb02a8aeec6329c0e83deb451f
- SHA512 017a9e63a30285aa26b1086657b86895931617d3cb72bc4537338f30024eb2e5726af26c6097dc9c47ccc5a713f3ed28ec81db898ba3f4c7e722413c15255db0
- SSDEEP 98304:ry5112gYy5azzVvU69nLKnhZS7wRGpj3:GLIHRWhoF9
- TLSH T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d15426fd6ca4f6b860d7fdcf7fa3138b252697348f1e4adcdda7622b2b84f6d4
- MD5 532e06ec07e5e1b184698afc21aaec94
- SHA1 725f1b2ea3ca802c9fa33f6d9dcea244018f51e1
- SHA512 8a30ecbed6c0ba893a12e9217003ff2ce582f344a41c0e174db2444d575728dcd159511b9e11132413527e9961c37bd343f99da42e9223c0e97ee9df6165ab5e
- SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRLNiXicJFFRGNzj3:nu6JmIxd2dR7wRGpj3
- TLSH T122D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 3fc7588310d9c2141c592cbc0a288d242873b800805bdf36ca2c455a2c0786f2
- MD5 88dcc4afef195603143c202c8daf2aa8
- SHA1 f88c4746b69262864e5d6e108f612885a2727215
- SHA512 e91bf5c92069fcf7567638944d52e1754625390cca90b460ad847598994c3f12f9c67bfc8d6e0759e78ef1dd99e6422eb10c3a04ede824b69664d45d67e9bd99
- SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4xdLNiXicJFFRGNzj3:hmifPqRE7wRGpj3
- TLSH T155B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 692eee2303db8b41b0c11453544591b418b0c13c86cf142eb61843c1961a716c
- MD5 63067f00a8f3f2f5a617f4772c0495ca
- SHA1 97909917fec33f37707a41975d858d9a6e6e2629
- SHA512 887930a2f5764e277306b613d639df1b017e4c24c7d89e2071468367c599c56eca0e0f21b4de6b560708a0e7e60de059265c89be2ad329d6d4829fd1b6a382e0
- SSDEEP 49152:CSuZQIY0Be2KkRVtOnks6NMHqWLNiXicJFFRGNzj3:c5dKqi61W7wRGpj3
- TLSH T183C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 0ff6ea309c892565d45f99567c0d2fcda276ba0ff760a89dec0e8b9458acadd5
- MD5 84e180ff1e1d0784c3af9f9c143aeb85
- SHA1 def2a41fec8c35f7858c5e82f0cafcfca49aa171
- SHA512 d7efab8521fa574520ffb7d5fecf3ce298f9857cb24d79ea196d95e8f2c2e122ce9b516aa012ee059bc614e9f0d51ef460c79e44ba6fc3db6ca63eb664d631d8
- SSDEEP 49152:FhtSn8EApI0figjgiDn0AP5wBLNiXicJFFRGNzj3:0X2iWphw7wRGpj3
- TLSH T19C95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 db629695f5d23813195bba1f817e969cd29876375534496d4d95618ef7114dea
- MD5 19d21b73fc69e3a14bd71ac6a77ba110
- SHA1 7e32d08b107bd87cf1992e2401ee1d162aa3e046
- SHA512 5e86e8f583bfdf93ddc3cae6322c313d1b14fddd165da654e68e4011c45223a8e39d016eaa6faa804b7a114e6ca01667df061c628133ac3e70f2c2b9af7c8c05
- SSDEEP 12288:4YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T16F5523D3558955B1EABC003AC6754428F5881E2DEB5618E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 b5dffda882cfbbf759fab7ae4ef6e46084cca6ea793e6796963f57db28758034
- MD5 d32f6b382a4b1796508f9193f3abd53c
- SHA1 97c4488077d36b8cd33ec0a158ce34b71a2bfa9c
- SHA512 3add032176761f7340cb7649368c693175c0e0dc85dbd537a6c3087067014ef4a43a6a2c680c7c6ed31bd8f1079f6515fadbd165e83031e8789e9cb3b1a1cb56
- SSDEEP 12288:cPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1EB5523D3558955B1EABC003A86754428F5881E2DEB5618E3E3483D1EE278FEBCF38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 76038f6280c8d66c6c823bf9b2e8459e715815b78951bc95f29be343355e684d
- MD5 04caeb9ced26ca168eca1962f24474ef
- SHA1 18cec0f4ec1da32f600255af53af234fad62ff40
- SHA512 9421df8ca84f6a8aa67002d33fc29fa81482ffdbd1d3f92f544e0cb0644623fe6ec9b7cba320104aa526d7b1f209e7e2557d11d95bd042654b13e5ea1397275a
- SSDEEP 12288:MJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A05523D3558955B1E6FC003986764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 d0ff70b1f445361e95df0c81284ca82685dbac54ee8a1d696311082b94d1eb1f
- MD5 9900d38d7b5890d97ff9fdf5f02ea4c2
- SHA1 86c65d61904e9d56d4c8783cc315c4ee2403278b
- SHA512 24a35f8d77773d8d2496798b4459254d94edc82a78f396d28e91675efd21fd545707b97ec6f73a9e5f5c006c59e57acea605894b2f8241f50c3fea4b40d88ca6
- SSDEEP 12288:gVCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T171552392168901F1E9BD803DC6764424F2A47D6CD7325AEBD3003D1E5A35FEADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 db5330a46db6eb19a54dff5379044c44f3e8a8c5331fa22c69c6f326792da4f5
- MD5 4fb8e23f9b3fe73e8084241d8c80565a
- SHA1 b98c2c886370bd43e9b8f814910d58124e154c35
- SHA512 513ce65b07f2c35ec876e81fec46c9ae739f539f98e5a6a52f4d24b28bd2e1fbc0547340fa6438abe81f4c354190b3ecabe23bbdda51a1aa737a72932ec7de99
- SSDEEP 12288:kKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1DD5523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 50036c8693f21e3350e63ced74759e946b327ac45ccb2e8065a50f3629c738fe
- MD5 b37a90e45ae4683f6a5a48b90e296a54
- SHA1 d0544ee3b1537c793c4f428fbe2a295cb7618fda
- SHA512 e6a909a76a7a4b5f5c94a6cb493c58acfe285dcd500ccad3725762715d10d8fa0e86b0b2ff780f0517c753aa964d7082eb1d176f4fb2cd0a47e42e9c5d0de5c1
- SSDEEP 24576:rf/TwSfVcYG3K/cJHlnFR+IGNe8j3IzF:zLNiXicJFFRGNzj3o
- TLSH T1EB5523D3558955B1EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 d095e1e04a724aa15b05b1505a2d1d2ff2faed4f09e8a9b47f43b63e28084c89
- MD5 c7aac9447891b26c106020be801a7dde
- SHA1 98bb37dcd204012fd2fc5e8a562f15e7bef22e0e
- SHA512 fcae03cfe9a613ed0d8a1fb37858daacb145f43a3cc8db08cb5685604fd22cb16134a572d9d5e61a3d75888a14efc193935c4540819192c92f89ef2036bbdc37
- SSDEEP 24576:FD/TwSfVcYG3K/cJHlnFR+IGNe8j3IzF:NLNiXicJFFRGNzj3o
- TLSH T1585523D3558955B1EABC003986394428F5881E2DEB5659E3E2083D1EA27CFEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 23876d20e46eaf52030bb5baea831131061f8aba9e174b5b2c2050ca487341f2
- MD5 4828c74e4546862a2005faae747d122c
- SHA1 51e73436d5568f550c44a7963775c9d8721ff7af
- SHA512 69c736782a6167b57efe1d0723391c631ada91f8023ed0a12211e1bdd5c877570a3fe6e4de945dc633173422189f35eb330ae36fa1a7cb09941eb73b43954897
- SSDEEP 24576:6ZM3zFVSOb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6ZM3zfPLNiXicJFFRGNzj3
- TLSH T1A9750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 433ccba3f9df0bb5136c6a8f0b0992090f29b8ae8925587b57ca94374baf991d
- MD5 e646c2ff74589cc2c65a18586850177a
- SHA1 6091542d6a1b42cf30296e506715a4248e71d7fb
- SHA512 099dc2985eb172bd0629a407daeb608552b7c57bc24b0b7c6cb9943d0865252e001a32e2f35d798a3c1126ae04d867f5e04a8238050060e0e2111bbfabc3a1cf
- SSDEEP 12288:38iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A95523D3558955B1EBFC003D86764428F5881E2DEB5658E3E2483D1EA23CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 4c54feae05e814b680700901122c6da9c6f66103ccc515502359e234da5b6ed7
- MD5 4388467f3e4ecf4ff4cfe3ffc1824e5d
- SHA1 19ca9b395049224d984c77961b8df3d8c14397ed
- SHA512 5084c8e4b8189c80c41591235034685d6493cec410948ca09af7088a767d868d4497c2f57334a941d9707c4766039b403ec914df6e7e83eec1c1c71cd221b723
- SSDEEP 12288:xQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1805523D3558955B1EBBC003986794428F5881E2DEB5619E3E2083D1EE23CFEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 66d6b1ecc7331b2202a363954d49047a4609df08d9ab661b486753ec8ff43715
- MD5 e8ac962e38830e5c271184f2b9bd008f
- SHA1 48477698fa6a547ced058dad0e6ad19b5d673a9f
- SHA512 168a5ab9d4e97a40a6e04d6a2dc13d3470e364b3f8c75265c404ff3fa7d4531a4bf3d47c11553bb8a4f395258c1aba58d6d8bc872f01e825cc930d7775959170
- SSDEEP 24576:hzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hwLNiXicJFFRGNzj3
- TLSH T107650157629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 dd59cf332523afc98e7a5e07b04c28e9cebe9afaf658f3e6fc19c2a942012bc3
- MD5 f1f356651567097b96282794efebfb46
- SHA1 3ae637ff81b1c2f65231f67792359a79b84de182
- SHA512 de0883776a12ada93cca7abe6b199f6cc8ecaa449bc59835aecf4160e8104d196541326cb0e772fc83531b0460b296cfaa1c496be2aab11142528dd2c0aab3b1
- SSDEEP 12288:o8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B05523D3558955B1EABC0039C6764428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 e32eb8468a8fbd4f232a9bfd6a17d8836279955013fb43b534f409c0c7ec32b2
- MD5 0981078f47ef6faab2b453395ea47bec
- SHA1 1e2f81276f825ab85ed5254cf279caead2d12a91
- SHA512 2d0d9932e87226dae12fdd8189c169fef4011b779666e2f0f2c38ee6aed8378029bdb7f95b290b4ed55139f190e410016d35b7c12bf3ce4a72870652834d35da
- SSDEEP 12288:Y8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T17D5523D3558955B1EABC003986764428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 3140f5093cccf8acb7e4a3e31d21df4b0a5aaa481b738756e4a9e1a0015ac527
- MD5 46c9783baa7be82fba7b92688dc12872
- SHA1 3c8b46d47be53b314e07c71cc1725f2421d37237
- SHA512 eb6ecd3399ca44d5a5ff677f2c384831410c13e1521c9e3bad9ad2d131c8fd62c33e1e16cd346eb083b2a0cfc45e8e9a457486ec68a82896a4a0fe3e5adb2fa1
- SSDEEP 24576:yzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ywLNiXicJFFRGNzj3
- TLSH T129650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 e55a5d3413a7102631367f6df915c5f6ee3af85dee936b8c36c5c700b7d508eb
- MD5 50a3f3681dc2e659e5faa1df196eae3d
- SHA1 9ed199a7cceac1a7c1583e282dafef2769f9a34d
- SHA512 41f74e3bf3dad9fb37bc70ede1a161fc7a1696b112374a51c3987ad48e8f908c01213ffff8cd43725ce3f7cfd3c4a4303eb6cc3123f2fc04ceb6f7cef7f541b9
- SSDEEP 24576:YcP4mcvIjkGOxhKP2l71nNKbrh/8KBu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jP4m4IpOO67W8KILNiXicJFFRGNzj3
- TLSH T1C365AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 2288f722e8caf8ad9474a99f5a3673d59f44092f1323b59da697693ffb5b636b
- MD5 d011a42c6c0d0afd91fefcbdbd56b569
- SHA1 91cbe1107970c44430f2b55b2f0abe7ac5f1ad8a
- SHA512 79d51f90deef83e48f0310275601e0eb3bf05b3f8a6aa46dd1387cf8a63d8b816869cf1a6edde46dde00db274fb5f6e64a4ff2b8cc668566f087383424d8bdfb
- SSDEEP 12288:OpsfsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T13D65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 e0278c32caf46e961c82449afb86703951cc2861c4b181cb9d5004ec46bd8c8d
- MD5 3c6f91e39aba20f333f5729deb3c5918
- SHA1 452fcdf511ddab3c64d4fa0ff66d0e63cd8d4374
- SHA512 2d387480ecb689778acaab7e5be064784459f9922cd88fb126addf5e531c8685d0c2aba455fbc747d25bf6ef0806f5cc39ae683c3657a60a8201ea053fdea251
- SSDEEP 12288:aMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T160552393968C5562F6FD1039863A8438B5497E2C9F5598D3E2043A1EA138FEBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 9e61822edf33686e11ce71358f13cb91ce6bc274c3a509578824a6358001bc02
- MD5 75f4aaf439acad930e14093b35bbee34
- SHA1 121e41be9bfb654038e36db10b327c1ee5a5a4a0
- SHA512 c2a98bfbc32aee3ad18f1bc18723a7916db3d3f9339d3411af01e350dd445c3aaf4f089bb6ccf041af5a2b7f2865d23c3d2846c04d313165b584be627cc70f1f
- SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQMLNiXicJFFRGNzj3:4a0hNYG4Jwv7wRGpj3
- TLSH T1A585AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 9051286661b719be3a044929386829c410a065abc545b6ae3f93d6ba874a7402
- MD5 ab3b4838cbfbfacad55ed66db62dd16f
- SHA1 daa15eb9bc524bbc9f184faf259ac229e7b51d88
- SHA512 b62501303dc93f2e18befd164e4b79b39b1a81fc8fee28fbe6485f6435394a05710b3087b0f957304821861c4a5bdae5dcb3d76b2749f17989eab441adc2effb
- SSDEEP 24576:0hbHjPL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0hbHjDLNiXicJFFRGNzj3
- TLSH T1F95512BE169C20E5F6B5903D85668409E370BC29172193EF6381527E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 a081bc76941231973423922f38bab9052e2aacf5b771584812cc2ccc72b610fc
- MD5 5a3009c5610eea68c758d2ea4c22b456
- SHA1 66249b483761ecc2dc41b0c7463405ac5edc1e3a
- SHA512 9d6d46bb5337471f7f2254a0d1e5c12d8074ac6c0f74c1c427c417f8f4255fc46a0d473853ade9f15e4c46a5392a17964d914ea4aab64c8c773d1ed859478aa8
- SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GIgnaTk46pBR/zLNiXicJFFRGNzj3
- TLSH T17245B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 c1da79ac6c2463c4aed036472755d265f63da7d2b29a9bcb68124a18c5c5fc85
- MD5 b4231dfd5e82d2c7bd7b909aabd1925b
- SHA1 cdf9446deeeced2cf64c747535af9f4210740a92
- SHA512 0753d0e793f69cbda0a4c14237537ec9b18f721c01382b86adf4f369b69d12ad6d8227fdf0a37a33f34b2e5d39fd27b3c8b534a3a1c51f6be42e00dcce53df3a
- SSDEEP 12288:/giJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T11A5523D2518955B1EAFD003D867A4428B5886F2C9B2619E3E1543D1EE27CFEFCF38162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 652fba324a94e4f9493eeedebf1990631acf9d462ece1090f9cc99e5e2660bad
- MD5 58485ffc105e990f883cf28c39687e44
- SHA1 b2269385f9bc57a0fa0e1606a051e52d56970084
- SHA512 26b9f07ae17170ff809a5e4d48ab019410d40804c3ff0362a709867a97fd97df64999ac118320068a38b319a3c38d9aa6783ead01394ea73496822fbd3aeb492
- SSDEEP 24576:AAL3UTB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AAL3U9LNiXicJFFRGNzj3
- TLSH T17F750155E79400F5E97B813CC9728916E2B2785D0724E7DB03A84B6A1F237E68F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 af1875f335d7d4c7893ba91ee4ad9a0144c8157ab61b5975ab60b1d617688bba
- MD5 a8a4c24c803054baa627b0d35756e441
- SHA1 2be95a68d6eb11fb95e0b6300bd5f41b5e1793b2
- SHA512 0072bce7ccec026b50639438e5ccb21898f04e12e6623643c7a34e7a54088d4dc41d22fd740e6d79c11be6e7fa874e1fefeadfbf57a5a7f9ae843236ddadb0e5
- SSDEEP 24576:oOd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oOdLNiXicJFFRGNzj3
- TLSH T1FB55126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 5917f4b6d402828aa97b422ff4989a2b4fb3cbf7fff69e3adad59f222359d94f
- MD5 fd32bd1e7c2804245fad06468ab6bc08
- SHA1 935fd40a337707afa22fcabfcd0720f9efc4eac0
- SHA512 19626c84e6a671c2b051171e6e6c57c7a526c4f1a6b31f5eb006ecc6c05d97271a503ceb361f0d4b325b37b5113a66e9c4247e80b190c1ac96c1a8a84cae44ab
- SSDEEP 24576:z7NM9YqZqmWMUkPjZM48Mv6bEhsG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z7cBWMpPjN8DbEhrLNiXicJFFRGNzj3
- TLSH T17F65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 b5d4f6b2e95ba74fe5abf5cfd62e3f95b09a7005ff176c43e30a58e69431d7e0
- MD5 8d31aaf1c426cb989f980341a900745b
- SHA1 074a680f55db58a174bca2493b6093d02f4fcb4a
- SHA512 8cc25abf52c88e15795104a7c60e3fdd6b0a103ebe59988500c0c6723aed32c9c1fa78f5d70f8906fbbd757c94c762f8d15390472a9677bae7dd5dbba253d3af
- SSDEEP 49152:gF2YuHNETovAvNYf8kmmLNiXicJFFRGNzj3:16BCf8kd7wRGpj3
- TLSH T157858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 354ad783d6978a1f7a332ab851dc13d8987214ddf2fbdda900749dd5f4638018
- MD5 a9064aeba913d78aa9d513f5893005af
- SHA1 b61e077456cd0fdb9a3e5bbc58abc961cc156ce0
- SHA512 2736e827e8a62a514a34f506e7a9c18cb1468ddbfa3cc639973e0e2d0fb10e24ca25313b2767f9a37677b49b58f33bfff4916b047295b0502dd5da781df38978
- SSDEEP 24576:FAFs06+Omlf8NXEbTo5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KFs060loXusLNiXicJFFRGNzj3
- TLSH T13965BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 e4d93b40e46a1c0770e130042c63beec5d72fb72e733a0665550800d3a9e2567
- MD5 05d6e9da641387a5ed4ee5436c4a3b50
- SHA1 980148cb7d027960f5ecf119fbf71244f0413536
- SHA512 c934bbbcab589fddce1ae064b236fa859ae7736bb43a23d00abe7f5e227ba5bb9b84667bdef1cbc3a660e2a10ff81856175e3d8ec4177105c5bed56980ded182
- SSDEEP 24576:AJnJ5D3WXs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJnJ5DGXsLNiXicJFFRGNzj3
- TLSH T10C75D02DD29810F8E4B7C274825A1A55FE72383D2F226AC724B4D5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a3fd696550940ef203557afdf5f00b99715c1dc95a2642bf3e804dcdd0b286c2
- MD5 f3f8cd3655b2efd3e101b9c8beebd7f2
- SHA1 2c2dbae826559858fb46dbd2af969986d792de3a
- SHA512 7c03e203b001799f5d6882d0cce474c50ece81e87e13617c92a146f4276d5bc9928859d63cf6e7f24531737f6895243eeb1e2a8df3cbe9316d9edcc38c265ab4
- SSDEEP 49152:Qg06DIKdwc+eQnSt65aVqLNiXicJFFRGNzj3:xg7wRGpj3
- TLSH T169956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 b46af7fb3a1951a5596d245e0951d84e3283515f407a423a750534fcf7621193
- MD5 f5129852a02648dff271774254d96f5b
- SHA1 3fc83d0365e93af7e186e892702c9bba2ea8d035
- SHA512 2689aff647be3d92263a8eb66e4d014d20c644db9d5a3d4e4d1e99c4b10b2b2222b1c526b068a49b23e7ff3ab3433f043aded092d2da0864526ffda0e6404a60
- SSDEEP 24576:yn4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yn4LNiXicJFFRGNzj3
- TLSH T15A5512AE278C60E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 06ef3d91676b094c4d088ce7275383d6db5e13a981d10b47a4b1646b14c5e432
- MD5 6c376152b6d9a191cea43f7b27ecff87
- SHA1 80d9dc91860eb08b69482a0005b9b18e95a3bd73
- SHA512 8ec1a0cc2673cd956b778b14b190f4e2990ab3c3a609e0ffd5ef2a76270d0f7b6a0febb32c051f4b79d1af8e2fa8c8a74f6411f75f256c43189489dfd58d3be1
- SSDEEP 24576:pIy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pI8LNiXicJFFRGNzj3
- TLSH T12665124553C860E5EAB9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 eb319310139ef807152a6362abd6431c352221dc8eda7ee6808f6c9214af77a1
- MD5 843a09372df39cd7744f231da45825d9
- SHA1 bd14f51e90891b4426a2f63a9f5a6935a8fafb72
- SHA512 e73a5b796176c11d167e423f88c19e39a7a495ca22eff318f3aed9a0245f12b71b01184d6192a3555c5fb65170e53d3c17f13efbc27a522fe44f5a50c4307fd4
- SSDEEP 12288:6yhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1EC5523DA118965B1EABD003D86354824B1943E3C9B1628F7A1947E3ED339FDBDF38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 b20a461266ad1679ba4c071840c04504ca8d312bcd3e33a9f8173232df9fbf22
- MD5 c12090427c71e3ee21a83e33b83e23ee
- SHA1 22a6c3e2cb116506db19c7745a261f2b27fe57cb
- SHA512 32a03c36b41630b52528d639f9c9e85e949bb6cee7ffd014b01838d8c711ab0fae2128843ab8e3dd0215669520dcec22cc5469a4ef10c7e7acdbb3ba0de1ccf4
- SSDEEP 24576:TQ9MxZKdcz9dw3+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TVKZ+LNiXicJFFRGNzj3
- TLSH T17A558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 49e8b73e9d969804e31d4e9d09d6b0c0ebca298a9129d917347ee8c13a039e27
- MD5 c8fba47fe29a8046f2e8e3cc1fe91c1a
- SHA1 59ee88781a95efbc4cdcc03e94d76767204ef25a
- SHA512 9747f719931b9e7c95b6f9ad6554a227a04b50e1ff3207e1b3f181b44f5fd013b42a3a1510c6cbb2c543cf93a6e77d27d4ed1d147128e334604e132f154f98d6
- SSDEEP 24576:ryocDApH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eocDApHLNiXicJFFRGNzj3
- TLSH T1AB65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 211af4670545e839d768f634cd6d7a4b25f4b8b72f2e09f8e1aca397d74ecd87
- MD5 0a787a4f1de3031cdb9174a63f78dd34
- SHA1 b4c0e25f41f09780242c244d86b180c1857dfedd
- SHA512 4a0081b37bda76ed08b7f59bc85429540d0fad209116b2e4a92fed506280a1af6bc8c9a3628459f0fde2d3d929cf7ee304701d454b94f98ff04d0b1083aa3488
- SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKHLNiXicJFFRGNzj3:a0zuNIB7wRGpj3
- TLSH T1CDA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3086f5e09fd4c851a952b5fc69579841133e28c1496c7abfd029db9f0b937f13
- MD5 ae0a2f2b5e48a3b4d7540b280c78d913
- SHA1 d827358d3fd8d94f5ad6653af8408262a2b6a279
- SHA512 f93377cf9477ed73cfaa69fec491f874fd96677b2fe86a04710f0502a1f610dd6f68c7511786e0212233e75904a90ea0f255e32ca5e247cfade638390281e6bd
- SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYzjMqb4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3TDxR+N5YzTBjM9LNiXicJFFRGNzj3
- TLSH T15455B02EA7F815E5D1BE85798B23C512FA727821033193CB42A0C17E1E7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 3a26c25775cf8225a8a84c449cb721fa97f60977b96b4a7a3f42ff97fb4501b7
- MD5 1aa8f47a889f07b1d27010f0bc0be0db
- SHA1 adb97fb0583a18296a016a65515b385f20d32bab
- SHA512 4f4baa31672df5a409e9de69980458b1e9e71a2fcff3b66d284ad908e2b02275103e7a13f7ed275aa8a7ba448d74b16a518025f5e56837c5a4908a576c5d1675
- SSDEEP 24576:2TMdOz0FFS+UmSLE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S0K+UmSLELNiXicJFFRGNzj3
- TLSH T18275E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 23aadbf977cec22d56c13f2203f49d884cf7b6f27a891e4292480b671e6ac463
- MD5 2bff52ac742e04f0457de7f0b8dce457
- SHA1 2caf0e7b1824f4093bf72d5486e6f65a335c521d
- SHA512 9aacef0ae2b0a5fcc9c4587d4f31159ac093cc8d3c27d86f8cc771a896a781bb0ad4611373359fbe2483772f801714aa70ac0e73ebb7e82c9bd0c0d593da41ba
- SSDEEP 12288:O4KdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15B55125A13C830E0F5B95139CA364014A260BC3957255AFF71D0E97E9B3AFDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH