Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/09/2026, 11:47
Behavioral task
behavioral1
Sample
2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe
- Size 1.2MB
- Sample260918-nybpxaec97
- SHA256 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42
- MD5 f7ce06aac970075ac0d92c9249eaa3b3
- SHA1 e1d81878ecd320b7ca2562277191f00655d4d593
- SHA512 4fcea5fee0c20c87351ad4b0d99589868226ae9cb8a2a2884b0ce94fb2e1bc0a8338c1361007cac093e6993170933a78c3830f1212f27fc0695a64361d800155
- SSDEEP 24576:45GXkH4nnwitNfuq9wgsdy3V5vgNyo3Py5yOdCN/j2GLl3iFSE33b9:4sXkHuXJOspgNx3a5qN/j2U4FH
- TLSH T19545C059A39402F8D0BBC235C5828527E7B2BC465571472F03D70E9B2F277A19F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
tele@engineer_at_meta
C2
-
daksh.in.net:8080
-
appgo88.company:8080
-
33win.com:8080
-
liman3d.com:8080
-
hay88.london:8080
-
nohu90.com:8080
-
ee88-com.asia:8080
-
digitalwala.in.net:8080
-
u888d9.com:8080
-
jinyazhou888.net:8080
-
yakuza88.co:8080
-
jilicasinos.net:8080
-
imo88slot.co:8080
-
106nk88.com:8080
-
68gbsg.com:8080
-
f5tech.in:8080
-
saudi365.co:8080
-
ok365.org:8080
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
3
-
connect_delay
0
-
connect_interval
1
-
copy_file
tele@engineer_at_meta.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7IXOGO
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
3
- startup_value
-
take_screenshot_option
true
-
take_screenshot_time
5
Signatures
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 5 IoCs
resource yara_rule behavioral2/memory/1892-0-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1892-17-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/4488-127-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/4488-14-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/files/0x000d00000001c65a-13.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
resource yara_rule behavioral2/memory/1892-0-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1892-17-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4488-127-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4488-14-0x0000000140000000-0x000000014013E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/files/0x000d00000001c65a-13.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" tele@engineer_at_meta.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ tele@engineer_at_meta.exe - Executes dropped EXE 12 IoCs
pid Process 4488 tele@engineer_at_meta.exe 4076 elevation_service.exe 2104 elevation_service.exe 2524 maintenanceservice.exe 5548 OSE.EXE 4932 PerceptionSimulationService.exe 2028 perfhost.exe 2224 ReFsDedupSvc.exe 4792 SensorDataService.exe 2732 ssh-agent.exe 2904 AgentService.exe 4632 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" tele@engineer_at_meta.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" tele@engineer_at_meta.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\System32\alg.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\SensorDataService.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\TieringEngineService.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\SearchIndexer.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\wbengine.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\74f811467fac3b7.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\locator.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\vssvc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\GameInputSvc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\AgentService.exe tele@engineer_at_meta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\dotnet\dotnet.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ddec2dd6347dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fd4ce986347dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000394c87986347dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003db19c9a6347dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4488 tele@engineer_at_meta.exe 4076 elevation_service.exe 4076 elevation_service.exe 4076 elevation_service.exe 4076 elevation_service.exe 4076 elevation_service.exe 4076 elevation_service.exe 4076 elevation_service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4488 tele@engineer_at_meta.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1892 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe Token: 33 4536 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4536 AUDIODG.EXE Token: SeBackupPrivilege 2224 ReFsDedupSvc.exe Token: SeRestorePrivilege 2224 ReFsDedupSvc.exe Token: SeBackupPrivilege 2224 ReFsDedupSvc.exe Token: SeRestorePrivilege 2224 ReFsDedupSvc.exe Token: SeBackupPrivilege 2224 ReFsDedupSvc.exe Token: SeRestorePrivilege 2224 ReFsDedupSvc.exe Token: SeBackupPrivilege 2224 ReFsDedupSvc.exe Token: SeRestorePrivilege 2224 ReFsDedupSvc.exe Token: SeBackupPrivilege 2224 ReFsDedupSvc.exe Token: SeRestorePrivilege 2224 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2904 AgentService.exe Token: 33 4632 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4632 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4632 SearchIndexer.exe Token: SeDebugPrivilege 4488 tele@engineer_at_meta.exe Token: SeDebugPrivilege 4488 tele@engineer_at_meta.exe Token: SeDebugPrivilege 4488 tele@engineer_at_meta.exe Token: SeDebugPrivilege 4488 tele@engineer_at_meta.exe Token: SeDebugPrivilege 4076 elevation_service.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4488 tele@engineer_at_meta.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4488 tele@engineer_at_meta.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4488 1892 2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe 86 PID 4632 wrote to memory of 2052 4632 SearchIndexer.exe 100 PID 4632 wrote to memory of 2644 4632 SearchIndexer.exe 101 PID 4632 wrote to memory of 5980 4632 SearchIndexer.exe 102 PID 4632 wrote to memory of 564 4632 SearchIndexer.exe 103 PID 4632 wrote to memory of 4132 4632 SearchIndexer.exe 105 PID 4632 wrote to memory of 4432 4632 SearchIndexer.exe 106 PID 4632 wrote to memory of 3304 4632 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-18_f7ce06aac970075ac0d92c9249eaa3b3_coinminer_icedid_njrat_remcos_vidar.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\ProgramData\Remcos\tele@engineer_at_meta.exe"C:\ProgramData\Remcos\tele@engineer_at_meta.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4488
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2104
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000508 0x00000000000005041⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2524
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5548
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4932
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4792
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2732
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2052
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2644
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2968 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5980
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:564
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4132
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2968 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4432
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3304
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 33d1068d4627e27c5dd8bf2e91f8eb112faf809efc9165a94d10f2a8f96abf6c
- MD5 8a616df429cd169ecfa2bef7e5a4d62b
- SHA1 99395dbeb3a51c081a15d0390b4dbe14a56756e2
- SHA512 cece7a337b9c8bccbd0a84e7193154a47c6138e673069215f3a1369da5c1ee4b8b4d5441aa189e20ef4a425fb5d808deac23bfa3c5d4293bc15be116a2359235
- SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbN/j2U4FH:K3q6HjBgj2jF
- TLSH T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.8MB
- SHA256 f781c35c00f63c083148bb4fb3ed239c376f39afa9d86fdeeb9b42ee504df01b
- MD5 436aa7cd2cecb99195b8522623109763
- SHA1 821e3e4a9dfa70bedef92ee795606ab01415b0dd
- SHA512 ceb8fafc221272daf5fcfc3b31cfc82bdb2439809c07b9961f23b4c374eb35e8015120d2cc33c1d0f4b0f50521645196b0d4698ea6ee1c26aa60cc4bb04c80a4
- SSDEEP 12288:p1XLsswWkxy2lRq2czA7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nXYfDtczAjdCN/j2GLl3iFSE33b9
- TLSH T1A885F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 d0bcb97b8c5e4601b15eeaa5b696c2b18fdac783c24043e74a6fa7c6e3943df1
- MD5 a11e2a5bb34bf5533844ac176e8d304e
- SHA1 56b340fbfb5829ca809ded4130c73b8d55e0c7e2
- SHA512 e518ae4cc9aa52d0268e95a8e710a86dee94dc3323396200e60c95e7f871ae5ec8ed6d78eddc0f646f07941219365d9bb5837ee5bf21c15a83ee0cbdb9c621bd
- SSDEEP 24576:g0Le5ji0hmxirM4dCN/j2GLl3iFSE33b9:gPji0AcGN/j2U4FH
- TLSH T14DA5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 124a86505d48d630c693062125987331e6578fb2c90194d7f2f120cbda9f1640
- MD5 b1ea364bb131b81652af2b05774498dd
- SHA1 6095b8121f977de04e6af6825ed26f6e6eabbbeb
- SHA512 8fc9e46faf15c31f0f5fb4602c5ae9f881ba002eebf282afc6ca6746abdb666ad9769bc3692e344ed4a5cb9048ad818a997f75bf70c79cb566246be73508f4b1
- SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWE6q8wyuidCN/j2GLl3iFSE33b9:J/ezSC6vUzPvxHjyaN/j2U4FH
- TLSH T1D3755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 95bd3275460c3fff09a18ff5fb8cf71597ceebe28cebc521e1d6ea21f9d4adbe
- MD5 e04ca31a03f7e4d4755c248bcad31678
- SHA1 8551b9ed473eb89c149f6849eb829f5a4b8b4a7a
- SHA512 f4e6094a9cf10a94f5b211149771f197cdfa1db43dd291202460d0fb2b3950a8bcdb5f21c1a1ec88317a6698399003eda20779f9b7f87ad769d3ea1696110053
- SSDEEP 24576:6VbqPb88hv/l+6vdCN/j2GLl3iFSE33b9:6VO88hXl+3N/j2U4FH
- TLSH T1E7559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 8cad128988f0d391eb1bb8a8b0097fed0f2a354f8211aba429261b4265ce91a1
- MD5 6efcbcd070e4a723556a76bd24821130
- SHA1 47aa2edaa214fb5cc83a14129a5a94ffa4984e11
- SHA512 f0724fefd4a4edab3fc5a08d8a12298e57d24f464470f661625a2473f764c261290d785592452c9db531008dea34f794fd8733396aee6fd24030b124da9234a4
- SSDEEP 12288:kRMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHy:kRkdCN/j2GLl3iFSE33b9n
- TLSH T16F752364DAA4B565F6AF837903ADDE615200FEE8E525884786917BEF117CFE8C033063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.8MB
- SHA256 773f6a654abd267929e59a41f83c89ea9c5354a17e71026c52bca066bf3037c5
- MD5 9138e8755878134499eb2391aa678629
- SHA1 9380ee0c7543c1994b130dab9fbefb13d4df09d0
- SHA512 bbeab4e93d1edc30b65f696dc0d800685bcf54a955d0cb8346d64c1e3836d266fabf788cd5967be27e47fb3bffb3395ca3e10dbc78a2282388bcc76b50494912
- SSDEEP 12288:xeBNUbTVO86UXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xJIU3dCN/j2GLl3iFSE33b9
- TLSH T10C85CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 284c4c24c9fd1a7457ce6e2b8b0aaa72397ce08f8819a1ef863f91373bb97243
- MD5 ccf8f76b512aba87b7f7d7454809eb49
- SHA1 aa5c9079459b529a991981400561e8f657d466df
- SHA512 4ba0b9e0d3ffe0b63c50e5d7b6e82034a3d6ad4e7f234b06c75e9365287f92bc092474f6887788dfd3e63ae4e19eb04f2e8dee64657743470aa4a4e48b1a3580
- SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:aQvGAdlCEL8c/yRNw5Cbj2jF
- TLSH T1C6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 c0d7772070ff9587a8d41f7d5e2e3c4f9aa805973ab2caf31ab533965d4c3e81
- MD5 61429b0ea2ce99cb501e15eddc32fc1f
- SHA1 3b0d1ddb673b5df9b936cc3459ea4b08ebfc0b30
- SHA512 31c59d3564a7b9b3476487b3b47dc0375149bf426a13037ccc00699500396087f995bbd862a5d4ee4508761ac9a74131ea8d8efbda2adb74656019fdc4486441
- SSDEEP 12288:EAwSfxL/2Dc34DLLmt0LDQewsAjFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9y:ZdewsAjBdCN/j2GLl3iFSE33b9y
- TLSH T1D395E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 babb4768a6708dcb222a56d671902b0fdf6c6500bd62ad3380914600a438880b
- MD5 8f70824826cd3a0aa6e6ebfd85dd1c93
- SHA1 de8492ac576a676db51d46ca4c5b923d09abd1c5
- SHA512 592caea388e8ae5170652d5d2816479bdb57111dcb7d5d6467e13a79e74e1f7e65c239d8432423bee52436544c30207e78278fa39763e8f7a6d39cdb5f6b5924
- SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHW8F:7UEtQevvqc2W1cpV2EI32W
- TLSH T19E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 9e4d3fd48da2c7b8dd4f4b6bb3fb91016d469cbbd3ace80682890f7e21de4c53
- MD5 89e3b2baf168103fbe38631369231100
- SHA1 773a4d981a198fa4d7276ac33ca16127e4f4dccc
- SHA512 e388e82c5424f9afe64a81195008430005355def4de00ae2e36d471347c5d8e7200eeac7f77e58fe057dfec6a883053fba2f5149c8737b37613d84061df0794c
- SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/z2N/j2U4FH:NoqtVjnmXj2jF
- TLSH T1BDD58D1976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 4aef54e0025421a04ef5a080cc770df4e221e2fbc1db6b45acd3523c8e8527f4
- MD5 3ede7c2dd0a4e2be0303c898df36d9b1
- SHA1 5da242d78e566df879c81e6e84c06aa5603f53bd
- SHA512 ec4e6334728cf3e64077fd00927cb2597bbd226561e9dcfb87352f14e75947e64ee623e7cb983d9aa051419619152f136bf36d02e77ac742157ff3dd6b89b12f
- SSDEEP 24576:HAhGLJIFoiwtA5l7S532dCN/j2GLl3iFSE33b9:HAMyFoiq5pN/j2U4FH
- TLSH T13035AD80EBF955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 dc0507866f218b37219b17b2c701607fc1f03b9422e33e7c54d1a9210e618111
- MD5 d0c7bc240334d986ac96571b661a6779
- SHA1 53157994fd76ab10a8d2c1b2fddb17b0cc784380
- SHA512 15f11a7e5a2df71af211f6644111a9b409389c620d9ed5f8bb9b1552a1387474df24c79a21b57218c5dc0760ede90e71fe90e0f81623f636c8d9f92d839dfc9b
- SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DwuoOWFdCN/j2GLl3iFSE33b9
- TLSH T14C85F14577E41CF9E96782398697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 aa4dc0fa0763ef1623cb499235992d9192356721408987f1adf63fc95f765b23
- MD5 8883f024b784f6f9fede9dcd8a9d034f
- SHA1 06e06446ce74e3d3c25b941f8e121ffba1aa8f79
- SHA512 a4f1f63df1e98568dfb73f9ab687e223d818fd2e7cb8301fcfca4c017cbbc4ee6b835b5d4d482b19105c6afa178b2b834a4054c295ef4a12668c6fade95da309
- SSDEEP 12288:vBZ1Iy1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5ZugdCN/j2GLl3iFSE33b9
- TLSH T11075125933E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f832aafeb3fa5f0f65cde55234d9b3012c78745817abf3cac7508a77284469d6
- MD5 263409f6da54459058324e674ce896eb
- SHA1 13a6aecd31453527e668ccd63ef545edb96a09b0
- SHA512 f7b36492ef86898ccf6684fbec021f4dd3a629faf907706ca8066c157d9c22236bd20a1dd1ada5531dc5635e16d39c0c8aeb3232546c66350c06136a376e60cd
- SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:bQRQyi36YOcPQLvw2gAf+PN3Uj2jF
- TLSH T159667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 457f412d58e1ab32a63d19a96baa9aca9855398ec68457a17caa218d847ba01c
- MD5 cb0e2ce786478c3299021c8c92a6c69f
- SHA1 a6be4f6e5b2af29051e12b77ce052b3658453cf9
- SHA512 b04d882647003f2f84a2af0125d6c206643c671a37c948d848db7ebabe7298fca0ca5627ddc0b7e49fde4db03499a0f9920b503c5b5e44efaafe92b2d5625d4e
- SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:hQRQyi36YOcPQLvw2gAf+PN3Uj2jF
- TLSH T1B0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b286ca3f16cf1534c20ea499ade646efa92418ce236a4bef43a25b58d5146bab
- MD5 3bbce59d29fb2ba4706a7fe7dcbb8b8a
- SHA1 29aaed300a08161d54e6d26c68cc569fce9a7067
- SHA512 d9ce086dde15ee9b2f3f38e58564f7174b10275fdace01192e8947f0ac38ca9fb325491a87ec093541b180ff63735a231968ee87ec8817f89ed117bb3cf62816
- SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0QdCN/j2GLl3iFS+:g68Qg55nhheWu7PNU3/GN/j2U4FH
- TLSH T1A0B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 a3fe00b05118ede4a7f4fdc57fc8acef57df0f075c7be83b1d25945cd46224f5
- MD5 a5645d31a558d0d5745540d72073c451
- SHA1 cb343d1f5067cca2edca02e43081f630f2e8e112
- SHA512 08cec5e8f4985d869945ab53e5fe6e76580710301dbd26cb93ed7b15874c19b54134609e8c7afcc042b9d4e7b9d7c9a6c178199298c7f07b40eb454474563a9a
- SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:wy5112gYy5azzVvL69nLKnhZRj2jF
- TLSH T1E8168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 3094467254f38bff959e42932aa55b5523680878dde22566cb35cd9fd222c470
- MD5 c053218d5ab764f712d09ee3a02f699e
- SHA1 6b8c9e6900e489f411a547ade8aa9448bac033cd
- SHA512 75f59e10e3352ff62f904fa48d9416ad2ab3feee9a005252bb8049895f71ec28b11a6c54f2c242c5ce089e7abb517042a68ed1bcfce77045288354904baad20e
- SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gldN/j2U4FH:Vu6JmVxd2dzj2jF
- TLSH T115D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 75f9ae842da5b0151cb0c390893439784119ef36c8919def0a00220d046b9556
- MD5 aeb358e75f0deb8b83fed45c4b745cf5
- SHA1 e5afefd29464c7cf8fcd485c6466a6d939346f69
- SHA512 fa2483d5a6c539564f4b57fb0945cd78cc8b140497f79f34296307a30a46fcaf437e84eca131a90680dcf463b4524708d401f2e8d9f3128ede8b31fdd3e53c33
- SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4xEN/j2U4FH:HmifPbRXj2jF
- TLSH T18DB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 94873248518b7dd1ad7a98ae76c0dd253cb6f5feb788472f4638bf2d079d16c5
- MD5 89f9af49aab3603d14be89d51319b648
- SHA1 7f6d3763f9582ee1fde55e8820b1e21bb12a6acb
- SHA512 edb0f8e5dc76dac59ff04f125a637ed83d1f391c5aae7c9cbc81048943565d5cfbf5a603fa1d93434cdd385c3c82330b2171cacc4329bd3a460c2faabca4d99a
- SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqrN/j2U4FH:a5dKTi61lj2jF
- TLSH T13FC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 05d44f2fe0f42130c13c81e3f749dba68c47b800612cdd1e90d454a98bf23277
- MD5 ec4741b745dd24109a78b0594ba9ade4
- SHA1 8cbc8d41e4fbdf8cf4904623114a88c024ca8c68
- SHA512 1b71b0ac4d4e7bf452fa5829190a3b4346ac971ecb9c9c60103dbd5e2870810230ea7df27e6eaa3c33179159bcdae260e7609a7317fe975f629c7309bf4afb4e
- SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wgN/j2U4FH:vX2iyphDj2jF
- TLSH T12E95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 a0e539821e8fa9c9eba662503460efb3e290c9b158ce1f8df776f0cb14b67165
- MD5 a88a694d7fc10e9afa259b3554e80cf3
- SHA1 6f1f324c61796c7cae1ded5f44d811dec685d3ec
- SHA512 a1e7678063435e10ff74efb5333677b69a97544d12ba15ec69269e57ea6e5d1d7832d1e02059518b6856215bdf9f922ec25c8bc4d2bf3f712a94c23ba84bb077
- SSDEEP 12288:4kJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4MdCN/j2GLl3iFSE33b9
- TLSH T105752364E9E6B669F15BC37943A9DF515100FEECF6264487868166EB237CFEC8033062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 733fceaedbbc6f84c523a54a960f0774ee89ccdd113203470e534f4ae39f87d7
- MD5 5114bfdfeb043f342f149332ca94ebbb
- SHA1 e8d6976441601746bc25849d75245867ae45ce35
- SHA512 01258e473c44e735f55286d239650113c745e709780f481bf1ae9746f647a36f676a41469a8ed4501bb41db9b46725030828aad9565f12202fca26a37b017ee0
- SSDEEP 12288:eZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:e9dCN/j2GLl3iFSE33b9
- TLSH T14E752364E9F6B669F15AC37943A9DF515100FEE8F6264487868156EB237CFEC8033072
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 7a4df40dae92b2dbc3496532e42ad7c8edbfb84eb7e6c04be1d887fc0b5025b0
- MD5 8d4d803d3179b33bcdf8168852c1976b
- SHA1 5e020f1b4b30cc6fc683b15cdfc519f29685dcd0
- SHA512 b38472ec5552e4ab77afda4fd75a67e4745701d618d4723907849234662e0ec33a79e92137b796e0c36acdbc05a03bca2cbe0d26313d812b20e7d70610b9d447
- SSDEEP 12288:TPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TfdCN/j2GLl3iFSE33b9
- TLSH T1E4752364E9F6B659F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 a3959d36e806e15ce6202a5382aece113dbf5f3ad4a439351b5a19275537d142
- MD5 63b66d1a3aeff6a8cf70a71c642a13dc
- SHA1 f93668e7be1e0f009ca7aeeb5aa1993d6dc818b4
- SHA512 63b0c3035e9e7d2ad4adc22750733a71fdb588e5749e479eb4b5e2cd1c02737580ea3a6a0dcdfa9b523c6292fcdf79acf2ed3fb1770de2086ec5451861e33f3a
- SSDEEP 12288:xVqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:idCN/j2GLl3iFSE33b9
- TLSH T195752360A7F561D5E46BC37C83B9DA11E220FDE8E73245CF87410AEB1B74BE89432562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 a5f007fac005eb32908ee75ec00f4ece6975a2d4efba0ad92c3cd49a5e0aab67
- MD5 d4ab3aabd4cb8b4f084204b06968e4de
- SHA1 8adb0d3f71772425c3133224d0e8f75bfa60c2d7
- SHA512 b7747e54e8e8006684013c2f6ff3303c0d9bc8c3a678f3afbbc46afd81db24c74a238456be3a6b4022a2ec7240393ee6db637bb2af6814c2f4ce402a733d5699
- SSDEEP 12288:ZyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZudCN/j2GLl3iFSE33b9
- TLSH T1FC752364E9F6B659F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 c18549010bbaa0185dfd0c8a47a3e0f64b8198e56e7518ec9cb6daf644fa6899
- MD5 b23d8ce3607130dac7a2cf9f1f68a758
- SHA1 628852a082bcf5b2d9d1cd47b7733db9e06f074c
- SHA512 55b4d16934fa7ec08463e82db3ceb985413579b9f6fe114b48c64aefeadcc5a9002533841d1e515e4000eb346ade47bccedb89f73d7cc332a0da2edf1636c03e
- SSDEEP 12288:N9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NpdCN/j2GLl3iFSE33b9
- TLSH T1B7752364E9E5B669F15BC37943A9DF615100FEE8F6264487868156EB237CFEC8033072
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 b4be3394df511de98ed401eb361dd7787b7c2363fde0731c27092245ea7048cb
- MD5 9261126dba756ef5c45c955e22ecd5a6
- SHA1 49ea75a3ed7466581c1509a09fd39a8a444ea587
- SHA512 d6ab043aa1816eef84de641ab3937458c9f945dfc361936726011d83264ddda292116886f384b70d05da8c589c44cb0ce3533f597582a9bf0067b565d39f79d1
- SSDEEP 12288:eBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:e1dCN/j2GLl3iFSE33b9
- TLSH T19F752364E9E6B669F11BC37943A8DF615100FEE8F6264487868156EB237CFE89033072
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.8MB
- SHA256 0c2fdbb2a6be6540e592df8c4802bd3fec7269e5e9d199b2e3d0f7d21878b173
- MD5 bc194e9f568bdff5a267fa5ed4bf64d1
- SHA1 76851f5994925525197b254f73f841ce8668927b
- SHA512 75687211175eaa330ba0ce44c56ffdfcde651d3d4225dffe7721b22c25d987be41f43e9381ead9e61c4d6e7dd09d622a117abf7dd57f251bcdb74caf6206b7cc
- SSDEEP 12288:oiZwb6zzFEoS2cPvy5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rZMSzFVSOddCN/j2GLl3iFSE33b9
- TLSH T17C8502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B1F377A15C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 0a1b64d9fd451e6a71c630a7ebe71250818112c15f1da66165953d97584c3727
- MD5 cfba856768dd7b904d1b693f029b5438
- SHA1 afabbe4643d83eca63fbb27a95e1ee2084e7b049
- SHA512 00acfb538b8a333d2138b10305ac7cef81257c224313cd0df07cc6dd3ed414ccd21daf6ae6edfdd7b4410e7b7251d1e5730e1c197b21e2a62655c142463ab94a
- SSDEEP 12288:eAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ewdCN/j2GLl3iFSE33b9
- TLSH T1AB752364E9E5B669F15AC37D43A9DF615100FEECF6224487868556EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 de23a96c5e8726d955d3e91e742ad7440e35dbf95dc9049a6421ac4eb9fe31b7
- MD5 6bacec34f7611a80413877c6fda56f31
- SHA1 53ed65b80dde5fa12a7f10b941dda22087479db5
- SHA512 7c2dab5f445e5395741d3fafb19340b11fc00529c409fc82e4c6e00ab3e18f6221b8cc8e71f69fd533f4065d906e4dfe56cc99fc82863b40e8583979f450b50a
- SSDEEP 12288:/8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/0dCN/j2GLl3iFSE33b9
- TLSH T152752364E9E6B669F11AC37943A9DF655100FEECF6224487868556EB237CFEC8033072
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.7MB
- SHA256 49bd0add750afe659820cc93d071b789cb5f4581993944f97e693a773e764c81
- MD5 581c0cffaed991f38c457f29621eda9d
- SHA1 5dc6aec4a984c0e1c5511adced492e3dd0e94c05
- SHA512 f9a682962d96df91d506b3b52fa929411ba6db652971f221ee261013e30727e07d4b4af9bcc849e8084fb6568c978ad9ddde0b54925d49ba47e87b31b47f6255
- SSDEEP 12288:dyPz5L81JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UzyRdCN/j2GLl3iFSE33b9
- TLSH T199850257B7A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E09D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 36cffe8d4b2e535f0e6456bdbffb1455a899a9038292bb9aa2bcd17f63c31826
- MD5 f4d28cd5ef879570ceab431d43535bd1
- SHA1 03081c1dc06bb26a34b95d36f2dd67beb3447a10
- SHA512 27752ea913d31fb4caaa9aa426705c1d6f7ca2514f1e80e36ffb6cc4c70f69d1f4e006c1b5c16bd6a054f38d897fc3bba1de2277c81560ff2e902b6c8966729f
- SSDEEP 12288:IAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IwdCN/j2GLl3iFSE33b9
- TLSH T1A6752364E9E5B669F15AC37D43A9DF615100FEECF6224487868556EB237CFEC8033062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 321e0043bad961a2fa11a47cfc1f84e46f3d11112eda475c712b5b157224fbcc
- MD5 a92e1f08f2b39e7c33e0673aa5b1e192
- SHA1 46d603da7cb3b6441924736c10060eadc2bca89b
- SHA512 1f4eb68ad7ff0f7b30778448419b60b8e9ca37765a5b72a006ed4e1f76a86f9efb259cc860c0a2a46b63fbfc3afb0b629d09a604699e5b730757bee5f3d3de71
- SSDEEP 12288:9AJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9wdCN/j2GLl3iFSE33b9
- TLSH T19D752364E9E5B669F15AC37943A9DF615100FEE8F6224487868656EB237CFEC8033062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.7MB
- SHA256 e735f69dd5a7b97034316e78966c91bf15484923efe15e53b03a7150482ef0b0
- MD5 2fa9c933757e0b996d970dec5511da8b
- SHA1 748714ed13c816aaac6f6fbbf2e2c8cd2c071d6e
- SHA512 39c260e21931c58a500792828851f73f2f151948d1210fa34b9f05efb604fea142e2854f48b604e43bff99d701cf403cba1987e912d6d8553431fa86a8222b99
- SSDEEP 12288:0yPz5L81JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tzyRdCN/j2GLl3iFSE33b9
- TLSH T1C3850257B7A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E09D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.8MB
- SHA256 7fb1143448e1ab656ba64148eff89a4cf75ce6261c2cee00b2e0d7faf4267843
- MD5 1bc9044d4f03ab4537ee5902a7abea59
- SHA1 d5c90f6fd642315b47328dfc75687033977cbd82
- SHA512 793a171afbd9324b1ccee892ab687c8cc6ec0bd033456a2ee4c9f0796f0a3a8952649eb92b606941e146949236b08ec95441889e1ff637b85a925603c4e6e195
- SSDEEP 12288:ACd9eWYoaLHF3z0z04PDvhfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZTHaLl3z0zDPdCN/j2GLl3iFSE33b9
- TLSH T1548502A4B39018F8EC67823EC9658916D271BC694770C64F03E4366B5F377A05C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 2.0MB
- SHA256 e2e780150cea7a328c42cf5e8b2c1335175a0dbccd703a5812c8b3417bfb5c9a
- MD5 8b3a7e010c45036ec4ceaa9ee342cacd
- SHA1 0a9e4a031e7b0edaa210dee5a87f379a61b77c94
- SHA512 eb2c17dc93e16595f18ab9504d1746ae862840440599f5fcff6919cc5fe26be897a118d059dbc2c817220176aa25aea26c7310a07da63a9a0c58597fce3784ce
- SSDEEP 12288:Li4e7+RdTfgwCHKy7GLbbdIvWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:L37d9CHKy7GZrdCN/j2GLl3iFSE33b9
- TLSH T1E895CF90F3E414E8F0B78A3589769511DA767CA95B31CE8F03A4265A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.5MB
- SHA256 85df27f749c07fed78bcd2b5fdb78d087640ce488e17119b78dd7ba6639ef5cc
- MD5 f18903268724ebf34d5ff133cf69db97
- SHA1 3beb74a875a75e34597169d87dad6e3a020362e1
- SHA512 33ade694c62bd3cb2038b1da060c44ab60d4ab8158fd99debda1dbd39f7a26d2d1ec4308e99b2526c0a5e2fd2e0c98c1503a7fd947e7b95dee4ec5433df9bab4
- SSDEEP 12288:MvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:M/dCN/j2GLl3iFSE33b9
- TLSH T1B5752364E9F6B659F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.5MB
- SHA256 ba3bd28a6dfd2438b5563d411961e8afedbae582a13d15e1c7c7cc17758d2fac
- MD5 15d6d0ca4ba2976de43bad1b563a515d
- SHA1 313ed599b87fef82f7e9c7480fba3b16e4d77f5f
- SHA512 e135306e85aaa998bd8874198d5ffc7acbeb9ba5e2e592471cd3736f106f17a6f65cbba4eb49dda2434f9e4a6c880d2af606376c4380548f813507f3cdd17d36
- SSDEEP 12288:rVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rxdCN/j2GLl3iFSE33b9
- TLSH T1F6752364E9F5B669F15EC37943A9DF615200FEE8F6264487868156EB237CFE88033072
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.5MB
- SHA256 ae20b02ee186705cfd14ed2c51df8f7fa5005adc6f61c1f99abc99f05c7168f2
- MD5 d9113cd6db0d8f1477fb34870c0015e5
- SHA1 af508300ea48364a52f86ace3bbbccbbb255241b
- SHA512 07efa3acda9d90ffb28e6b126ec310b55f786ade761f6f5642119331c9a817aea7528aa2ae887e6bda1995ecf833153c9ea97ae5846c86427763c3b74c32e805
- SSDEEP 12288:6WJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6adCN/j2GLl3iFSE33b9
- TLSH T1AF752364E9E5B669F15AC37D43A9DF615100FEECF6224487868556EB227CFEC8033062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.5MB
- SHA256 7e8ccb66318ad3ada2ed4d6b1254ece653ccaf967e3d77bdd32d6cb3893f446a
- MD5 52bad148b65f32e80053d9383977c2d2
- SHA1 5251c82d9a2aa860fc3abd6d4005cd2baf6d8675
- SHA512 ad74b8a486d8934fd2cc9483ff75d0eddfec9f7c6bdc3a20cd4af3557eb29d855dd8fc0f500606a082a96ef78d76eb264a0145fe8c89f2016a57faa764ad46d4
- SSDEEP 12288:/AJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/wdCN/j2GLl3iFSE33b9
- TLSH T1A6752364E9E6B669F15AC37D43A9DF615100FEE8F6224487868556EB237CFEC8033062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.5MB
- SHA256 5738efd0eef623252d7d90d52acbdbe0be75855343d77dbfa5e90f938cd1d5bb
- MD5 4afcdd5c253f607cd3fda042d388d88a
- SHA1 0dd8b79da19c3dc44c497a2911329393705cea32
- SHA512 f509037edb7747a31af3b334bfa7a3f396071591c36f3096f6d62dda2d6d028f5f4d939d6d28bea7da42febd472f02fd59aee95df13b4adcadcb79b38d8fb679
- SSDEEP 12288:lvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:l/dCN/j2GLl3iFSE33b9
- TLSH T14D752364E9F5B669F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 2.0MB
- SHA256 44b46ba9ea64493517b23edb4de0d0f54abc199fc7453b428c0d3078ddde0896
- MD5 d95ec201fe949fceb91bbb930d803126
- SHA1 1dd06abf873db50ddbaea382a18a737501c760bb
- SHA512 f5a3fc0ae5ef4cdad4f6685db43fcac84d04fdf6229aafe4b702f43c844ce805bd918b23fb134860a693a21e3c6ad2ee1999526543e6b7d314397d005ce99c9e
- SSDEEP 24576:Ffwvok9RX6wkyAIEdCN/j2GLl3iFSE33b9:DMnYIvN/j2U4FH
- TLSH T100A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 e149813a8bd7fe54e34d016ab6dcfd74391d4f2ced7fd44030e1f4e7ae40c23b
- MD5 59e35b2fff340b15a50d459076d48168
- SHA1 bf81c14ec4a4b3c882e672215cccb67f4dadd1f1
- SHA512 45b0646dab72a0e6d5c3619c2367e8b9f756af161bd0789cfd7f4597f51b091dadf20183f9471e18c2ac8f853e72bec3b5c95348cd8c15baf4c969ada79a782b
- SSDEEP 49152:nYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AN/j2U4FH:DySzP0j2jF
- TLSH T1FF067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 e9d790559d4f5c522afec4fca4f99fcff6d8939df7524c31ae9e3fb545b53978
- MD5 900a55f6d8469940e9f4b1ea39a1ffcb
- SHA1 51b70fc8fdccae1bb2af95728c12898597e1f36c
- SHA512 278053208b080001ac0b6d4068b9f40ab12d40fcd74c245e5f0fac83e8b5d4f807ee13d301cacc2256e7a636f45ae73b28210e4f78e003b1b05399546d453ccb
- SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtdCN/j2GLl3iFSE33b9:a47JUQj1irIhCnDHUPfF/QN/j2U4FH
- TLSH T1D565AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270837D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 7e168dd77708d03a7928409db92594db82ac35c39ca9371f4d0b0a6c439fa49f
- MD5 cded1c94d85e101b96a23260d62663d8
- SHA1 c48055f6f215270803be642921d7f58f2c06e145
- SHA512 da44f7f310a3a4b14d9b89fe3ef4d8c76c5062760d79b1423be8a878e1704424610e208b5ded8c9b8474c12e629bf1358a2482910e821e220e5efcdb7ebc505b
- SSDEEP 12288:PNsfQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sgdCN/j2GLl3iFSE33b9
- TLSH T1E1850119D29812E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 b035016d05b9483c5b89f3071a5a76a0aa1e89017f34323460c2d778a7d5fbfa
- MD5 acf392f51636d9acd4ae52687062323b
- SHA1 c9000f8e61565d10eb00e71da1c8ea0a55acb255
- SHA512 a8d6b6ddcc7c3003fd1155a73a490c2fbb40a6cafb4c5ac0ef92aaedd5ef604f937f20b74483b91dc06893fe10258dfc5d194b38b7fa0a15d7ce9a6cccc093d0
- SSDEEP 12288:tGypnU3fE3E5k8k6jjeMxhAWH1vIVNQh:gylUP1kj6HlxCWVveNs
- TLSH T1D23518407667CB4FC66940321E72D2CCAB707D05EE04AF0773C98B3F9576658BAE2692
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 325KB
- SHA256 28286bac2e51be6d638c62dc13ce6767047e1fa5ece08ca42c803994db2042c1
- MD5 a7295a22455843d8c1a19cbd5d7131e0
- SHA1 f054ee63b7d5a4b9972d57de285f035761374515
- SHA512 868e808cdc01379479a1f06c7d30bc5b8fca5353d83c1df8aac966c5062e4b60a600f143237f6b63ee695d3b0b79ceb2c0045a2eafb8210202fad0e71c838e11
- SSDEEP 1536:SYmfYbVYwczY6x2rbZHOYqvRbhYR8YklY:9ssrb
- TLSH T12A64A311F714B329C0B641B30871D69BEB39F416DF2343033BD41A99CCB62977ABAA95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Remcos\tele@engineer_at_meta.exe
- Size 1.2MB
- SHA256 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42
- MD5 f7ce06aac970075ac0d92c9249eaa3b3
- SHA1 e1d81878ecd320b7ca2562277191f00655d4d593
- SHA512 4fcea5fee0c20c87351ad4b0d99589868226ae9cb8a2a2884b0ce94fb2e1bc0a8338c1361007cac093e6993170933a78c3830f1212f27fc0695a64361d800155
- SSDEEP 24576:45GXkH4nnwitNfuq9wgsdy3V5vgNyo3Py5yOdCN/j2GLl3iFSE33b9:4sXkHuXJOspgNx3a5qN/j2U4FH
- TLSH T19545C059A39402F8D0BBC235C5828527E7B2BC465571472F03D70E9B2F277A19F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\74f811467fac3b7.bin
- Size 12KB
- SHA256 8652c85e27e16e446f556b68d10e2ee90eecc30e157b143f88a18d7639822941
- MD5 8ef212df70ff9855c603c8083dede5e7
- SHA1 54c1d534ef3edc49cf4a289655fd520dd976593f
- SHA512 c723a754d8a5343f9fefa10bf2cb166c905c8d4ba393b87caa1419c33d0e670c3bfebff304239eb2266766c9420b2d31ffd41cf2282824ee11bed1d3afea592f
- SSDEEP 192:KsigN+Q7ycM/xfdNObdCdJNwDQG4kRjLb+y7Kp7HTRywJmUAzH:KWtqfiGgDQYRvbXWVTRy8mUAzH
- TLSH T1DB42CFC1AD2DCAC9E3D190124831F57A484002EF96FF488841EDF31626C46D776F989D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 ea93b236e94bb90cf25b7c2153cb315304f73ea0fb4bea890636d556cc5cd1c1
- MD5 f0eca78fdf8723140a0545784360aec3
- SHA1 9eecaed40d36e00e5286b89c99efbe59ed67dcb2
- SHA512 66696fba1db41e7482202cddbe1c4049a09670c3742ebbad4705b7a26a0f93c7908b68ff8e25c078f55ef221756e1ee0b352c0db7df31504fdeba1a3bde3cad1
- SSDEEP 12288:gM7YJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHk:BYdCN/j2GLl3iFSE33b9J
- TLSH T11F752360D7E9BA55F47A837803ADDA316200FEF8EB1184C7C54166EB6278FD8D832563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 5cd08f645eb6fad6de93626199786a76f0e25a34096c6358e884d699d78984b9
- MD5 c6f372e666dd94c28efe67d0d9163a8d
- SHA1 9927c1280251d2733b7cb8918980f5b881e16285
- SHA512 ba0ce5c5b45c32bd88fd9f4a8a93b0a74ba81a6915a071ab59b9fd0f24bf4cea2e49825fd6715840e7daafd60a4742b2f07d75d6037305f1a3dcd9c3e78d0bc0
- SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYidCN/j2GLl3iFSE33b9:igb4mBIBhGFCN/j2U4FH
- TLSH T17565AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 a6a8709f1a37ad6e01fd2da0d95393fd344f47434f6d5e803ab974be7705391b
- MD5 e0ac09daf7165e1b29800c959debc45c
- SHA1 1e86cac6355bff24463b76c5b769f0856c36882a
- SHA512 56988609d99918aaecf3d5885353930a3914a4b67b96521ac59726df580260929cfd346b0a7e2e6ff719ab67899906bf5022eda802632289de4ac5be07c98322
- SSDEEP 24576:2G88u8FpJqH1bzria7/mddCN/j2GLl3iFSE33b9:d7ZFPqVea7/dN/j2U4FH
- TLSH T128A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 2b971d18f989af42f22f10620cab7090d024bb5b32ee7089ab0e211de02161ae
- MD5 46c5a967ccc3ff8a566a4760e66afc6d
- SHA1 e67a6d74b367092b2260de12d2950dab224f1455
- SHA512 36b23e7b8d59b370826211ccdbf14ca0fe557c966baa2a5d2581876b30579334a2e8617d45de5d56f6ac47096de1c9a7539ccf0314694139cfdaf4ee5af6ad0c
- SSDEEP 12288:qHvUrBFrEjwaQtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qPUr+NQ5dCN/j2GLl3iFSE33b9
- TLSH T17185F22E62E818E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 9619fb9d736b8e532b8107f7115a27d70f91fabdded329d28d6ec881cc6a5f40
- MD5 6c877fe7ce34a97acbe1a0bb7a01fad2
- SHA1 d701806c01aeed8649d7bcd16b25b01d720c6d96
- SHA512 4b5759a3c3837f9c7ae73b5739b6209123291f8b562d17a8e7c07e1db62464f59cea8b96ef7f977b020fe98c5dd7ab6bc7b2bafdb2ff8751285a6b4a334053ed
- SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+N/j2U4FH:SG05lO43bZj2jF
- TLSH T153D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a95442b0b030925fdab1d2c220a4264eb02b134c3d5550767e11ff7e5fafe438
- MD5 5414587d86afa6836d96ec25aa517279
- SHA1 02f5c48384e49f74406a7916139dbfc766de18d5
- SHA512 5c864215f0771d97d83d440a1a80e4da0fd3ed4d515facddb256b310a8dc6cb132ef31623a7d8a21cc73b16b9a4511329df7a989e3dcbeaeb05d3e2237becfb9
- SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnDdCN/j2GLl3iFSE33b9:ja5POZ3+Jt2pasx2+mGN/j2U4FH
- TLSH T14E65BF5EA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 3faf10a915e7f90406d03615cdb3f3bf1d2271b98bcec70edbf271bae01fbeae
- MD5 54533eea295fc6ccd46b1077540b15ed
- SHA1 96f58ff7d771e68810488935c4e74231a766a701
- SHA512 a4a3cb3bb9c57f89187b029d068e27d488927b5854d94455c4d10bb896f2ad2f421676bdd6b33b2d2a2d26b6d148e5ba1a6bf998238b18cc50dbda544a6c3367
- SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkldCN/j2GLl3iFSE33b9:SNc/zEOVHF9N/j2U4FH
- TLSH T126857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 9dc3515b4b290d4a4492b796cd7b2ee8529e6e55849537eaf84cba322bff8b65
- MD5 75025a2944dcb5a447e1cfa61b88cdd8
- SHA1 ff07b9a4fb17ff2bba9c7dd55020be110d316fe7
- SHA512 673d7bd95f1227923b397906bd67e6408587f0e0c9edeeabcc13e763dc439f9d446c0da88c9611d9b22b159b5cdbe0a4de207641a97ddc23b5dd9858b0012778
- SSDEEP 24576:U8kNvNnaFeYhJNtmZBmGdCN/j2GLl3iFSE33b9:U8MwBtOmJN/j2U4FH
- TLSH T12555AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.9MB
- SHA256 e15b3fe4437d42c9d1b0529ddd2064e0cb42fe321126b1c3ae6cc563af968a53
- MD5 896b3fc408ee22682dd7c308dd9583f4
- SHA1 fe2487b7cb7c058d7dd12aa149ddc8f707b63baa
- SHA512 ba71a83f2db8f20953f6be557d1adb96fc3063c7d90e436023c2432efdf9196149743f0e2c7dbc9a22e81a45bc05515c3f315d4eb8da875b6f1d607355ad9497
- SSDEEP 24576:3D3FHshBIYQgAsdCN/j2GLl3iFSE33b9:3DVHeBIAAXN/j2U4FH
- TLSH T16A95E17DE69C04E4E57BC2BCC6638A06E77178A9432255CB02D481BA1F6BFE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH