Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 07:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
- Size 2.8MB
- Sample260919-hs86bscf39
- SHA256 ba995da269f6a5b748baa059764991adae04a8c803614dc7d4344628c8a306a0
- MD5 4d6783118f7441ec6f9d514a08aff52c
- SHA1 8d1af44d229e4d037a84a577a3462ccc65998d9d
- SHA512 b4ebef0ea9054fe42792bd956f16dc617174554184e09ebf9f76a808763d26ebca8b2a56cff1922183c7a27588dbb4617b7e28b2627d9b2f737df1e4cdacd2b6
- SSDEEP 49152:0tbIwL5D4Jc+b01tnAyB63TANQnMEu6Te8wT7HHk1HyB:mkPbiHV6ZukIB
- TLSH T15AD56C07B3F941ECF0AAE2B8D73156329EB2BC52CB34A5DF125416151E71AE05B38B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
pid Process 2056 alg.exe 4712 fxssvc.exe 4352 elevation_service.exe 3772 elevation_service.exe 4076 maintenanceservice.exe 3196 msdtc.exe 4056 OSE.EXE 536 PerceptionSimulationService.exe 4792 perfhost.exe 3924 locator.exe 4824 SensorDataService.exe 632 snmptrap.exe 3680 spectrum.exe 4632 ssh-agent.exe 1824 TieringEngineService.exe 376 AgentService.exe 3596 vds.exe 4268 vssvc.exe 3560 wbengine.exe 2384 WmiApSrv.exe 4672 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\92096ee160f3a3fa.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaw.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d4625b90448dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec0849b90448dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000481732b80448dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000402683b80448dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a28c28b80448dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bc1beb80448dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001813f7b10448dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1524 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeAuditPrivilege 4712 fxssvc.exe Token: SeRestorePrivilege 1824 TieringEngineService.exe Token: SeManageVolumePrivilege 1824 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 376 AgentService.exe Token: SeBackupPrivilege 4268 vssvc.exe Token: SeRestorePrivilege 4268 vssvc.exe Token: SeAuditPrivilege 4268 vssvc.exe Token: SeBackupPrivilege 3560 wbengine.exe Token: SeRestorePrivilege 3560 wbengine.exe Token: SeSecurityPrivilege 3560 wbengine.exe Token: 33 4672 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4672 SearchIndexer.exe Token: SeDebugPrivilege 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 3848 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 2056 alg.exe Token: SeDebugPrivilege 2056 alg.exe Token: SeDebugPrivilege 2056 alg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1524 wrote to memory of 3848 1524 2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 88 PID 4672 wrote to memory of 2204 4672 SearchIndexer.exe 113 PID 4672 wrote to memory of 4448 4672 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-09-19_4d6783118f7441ec6f9d514a08aff52c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x298,0x29c,0x2a0,0x290,0x2a4,0x1401ba6a0,0x1401ba6b0,0x1401ba6c02⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1628
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4352
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3772
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4076
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3196
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4056
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:536
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4792
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3924
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4824
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:632
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3680
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2516
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:376
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3596
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2384
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2204
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4448
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 af9ae52ec68e6997a1997244c32ac443467b15b258fbfc1dda64d1a241416595
- MD5 f90a3872b446cf7070476fbb893ccb26
- SHA1 5e90c694c2a826141ef6b6203bcfe4a051b02a69
- SHA512 96f69c9d851be46f4cc163ab38263227386e974e2ec6bb7ad7380358de6a9500ead3dcab3f2c0b03d95969539119f520235445bcd8ae029d797b8cac534e7a92
- SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9HHk1HyB:t3q6HjBokIB
- TLSH T17ED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 37a166511b8a07a194db7d7aade64099fa8395846e2a72614499a4cc5c996b25
- MD5 fb81b911eb31d0cff7279024386727ff
- SHA1 bd121a4c8939fd49792570bfe10b1282afd39c56
- SHA512 eb27efea5abb48048dd0f0346ef921454c481a221dc4976e6fd9023f23c5534d62deeb4873a3c8760712149ee8797512e24a25c2e202639355bbe2966b3f40f0
- SSDEEP 12288:L1XLsswWkxy2lRq2czA54gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:xXYfDtczASyYHkP8ShemDk8laa4BC
- TLSH T11665012867E004F9EC67813DCDA2C501EB727C9547A0E79B03E499652F336E85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 14a785fa98c1c5713636e6423c93d5676c32eccb67af8ea89cbe6d40cd6172de
- MD5 cc238192649c9442458143ce25d3ae41
- SHA1 d0fe832021bbd0d3b410a4ae795801c34f5c67e4
- SHA512 43af2454ed76c4fc4c88f31b25704f13da176440e4694d99e7e830305f85ea0232876c66cb7d81d476f852cbded4337304c1bb94baa36a14276462781a99cf7c
- SSDEEP 24576:l0Le5ji0hmxLrMVyYHkP8ShemDk8laa4BC:lPji0AloHHk1HyB
- TLSH T17385AE66F6748335D073C0B9C5D2A68EED7130825B308ACB4286D76C7F67AE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 9d508882d374467a723a127dfcc328aa6412e20c0ba35c8cff14eb99c346178e
- MD5 e22ed88de5ea410b131e79afed37276d
- SHA1 134464ba8a4354bf83411418f4fdd35dd2a25d73
- SHA512 2aed3ce185189c320f64d164f4e3fdb01ada7fa99b5caaf36438c45230c324eff1002e9ffb65c5c15aba4483545deefa876e15a8841f7b4351e0c28bddd5543f
- SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuvyYHkP8ShemDk8laa4BC:g/ezSC6vUzPvxHjyMHHk1HyB
- TLSH T1A6756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b0683e6463050d6c9ff1383ebc013a98afd62ed1652e108d2b41b71b06ac32bf
- MD5 ff3c317d3aa9217528ea8000a4822d5a
- SHA1 3455848de3ebe162f665b4a840defd16e5b9d54d
- SHA512 84a8ac94ab8349acfa30ba32c3c2d6867e9ca42938b1fa037fb915b26da2a59fa3998a7404df8d22cf7f50aa036ed2ebca85b9db372913eeef9659b2459ee7a6
- SSDEEP 24576:7VbqPb88hv/l+6+yYHkP8ShemDk8laa4BC:7VO88hXl+JHHk1HyB
- TLSH T111559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 c6e9f46f5c3a98f8bf0943c3f265772bc44cea07d890f94c1930194847eb5703
- MD5 853c782f6a4205a69025ac3156e9adfb
- SHA1 f00b2ce5eab36a80bd6b66b23c648331e0de1bc0
- SHA512 81a1f9861895efb8e171bf1d1da6a1294fc6aeeeb771e36051fa34f74b8f1f3741d49e072b499f4fb6391deb557d59ea9519f9ee8de55580b8efa2afd90d43c2
- SSDEEP 12288:zz+4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:zzxyYHkP8ShemDk8laa4BC
- TLSH T1095523E24F6411D6ED06143B7FE5F0C19EA02CE48EF4051AA4923D80B974DF9ABB75B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 3568df303525a31a0e0baad2a0fd666452aea434ad9a99cad42a87037c022ef5
- MD5 ca146a8f1bfaa287dfc323b10162326d
- SHA1 c7a1a18a70d46bf3c1e4c50efc105e55295c2dd7
- SHA512 85b3cc8d537f2d873ec72eff8379afc15835c9af17a20814ecb625997e46441eb70eca87cd1cca53df91fbd1c31f61541ce795d147a6a6dff053a328e5d49979
- SSDEEP 12288:deBNUbTVO86UF4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:dJIUWyYHkP8ShemDk8laa4BC
- TLSH T18E75DF7BAE28FCE2C27A4D795B91C240D7B278704F6193CBD165820EDE235E05E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 13b5c879bcd3426056136fef3137bc409f51e6101bbb72eb27e290ff651521f9
- MD5 0a53e98fe203816e792f7019189fbd2f
- SHA1 adb67eb52fa57f150cfa3816ee2970988fb5facb
- SHA512 5b761c3c78e68e5a0d9215675f3475282edb2c57eca8f30f327a9e8985255a4e2be1d174e4c89a57ee5715a9194df36684c686a29527995d758f581729122ebd
- SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:DQvGAdlCEL8c/yRNw5CPkIB
- TLSH T102267D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 77ce8338d0475e5df2f70f0820f68884fc894cf5c6a1af5065508108033fccc8
- MD5 9117c7e233950623ea7efa1a7d6d1c6c
- SHA1 982a9d5b3c10f9d89384c7d80244959b08ce9c53
- SHA512 20a34eb378952b1f561f9139b03a68ad9d8a3e02aaea8156de2f8709ca28e4b260637707714e0af4d8f46bb6ccb7d5877e0fddec7e6fccfd0ef484668d1fcd45
- SSDEEP 12288:BAwSfxL/2Dc39DLLmt0LDQewsAjn4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3m:iQewsAj4yYHkP8ShemDk8laa4BC
- TLSH T10A75E031FE74E036C67B0DB62B76D706586C79604FA11AC3E3E84E8D59302D22776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 b07f1c380abc403103f0fc914e55c2f91cae9a2321cfaf014271bdf800d63167
- MD5 c067e23ff5a5bc7f27ce577d0a322850
- SHA1 66d58e05f2c3cfc121e63f5920b263572f91ff8d
- SHA512 efb3037eff2d022756f25774892b87fd8e8d100f35b9b3ae0afe306654431c00532c57a9622c8e21848926fce53bd57c4a1aeb20b87f0410d874b62a559d2a71
- SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8:YUEtQevvqc2W1cpV2EI32
- TLSH T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 83b909dc1fae7c06c8e7296f136ad5584bd01fa306172445686835067112fccf
- MD5 e91fe416f1ab11fe7c0972f96e50263a
- SHA1 bd42c90e92cc795e17ba1d2c226342ea00d0f0a3
- SHA512 5afa5cc49491e8dc3df6bb9cb02854a8ff7a75a07a6384938224d7cc5ac947a8137da87699c30242c1ddec34f7a462aa7bb2f847c52bcb30c2b7c3297d131785
- SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/zYHHk1HyB:uoquVjnmDkIB
- TLSH T11FD58D1976B8C2E4D1F6C77886A2C647F37178154B3197EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b3a4dbd348da52cb00276af10c8b085b80ffe68041cafe07a7f979a5dd2bd874
- MD5 65456cb704faa33d689b4d38fa1a25aa
- SHA1 6e0f0cf9b26ae26ac0cf0767ae9e921f1d8cc5ef
- SHA512 81d764741b08e167a50f619697e2b74bcf1e492aec4a7b18cb4010bfe646783067cf40face0a839d3760a9c1b684976c84e9cef855c4b4d50e5751eb19b95995
- SSDEEP 24576:oAhGLJIFoiwtA5l7S53DyYHkP8ShemDk8laa4BC:oAMyFoiq5zHHk1HyB
- TLSH T177359D81EBF951D4F5B3AA7899B69170EA76BCA65E31C20F2150D10F1E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 a4436560107fb24385b9d8c576250674467f362a60ec4eb6ea5a9ff0bfa36627
- MD5 6ce265b37ba2b90d7567f2f4b98fee90
- SHA1 c0f55d04ca24fbc25a69617825067d1a2136fc5e
- SHA512 c7172da63bd97436449c3661be31e9048d66a6ff2a89386efb34dfc89a671cd2c099e9f5171873e7a18abeb6720e7302d9a4ea6a7466118b719e9f867f75e7cc
- SSDEEP 12288:bmw5HEjsChN2BFgl0WDm+C04gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:6wuHOWsyYHkP8ShemDk8laa4BC
- TLSH T1EE65F18637A408F9E96741398A97D136F7F2BC512A71C71F13A0C6466F372617E2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 5ef517597ac4fb0b2fead69b6888bc6588f93423a3811adc72ec73d97c6d73fb
- MD5 a8a367a43c83f6ec9441e59d26fc0a5d
- SHA1 f301d31b92cf1161c18fa9ab8cfad09d7e186ad7
- SHA512 062545bebbbbcdc2b52d55143ad3c17e975ed71cb3f19499d6379dc3fef8692444d73d63844aa466f2357d0cb1e4ead6e16af967a5f8221f45b270277a1228d0
- SSDEEP 12288:PXZ1IyX4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:/ZuNyYHkP8ShemDk8laa4BC
- TLSH T18A5512962BA420FAD453113EDEF19185DBB13CE25BB503CF11614A816F72EE52E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 8ab0d3faab9c7ba4c5325ed2f2053bf7769765e91a9e6749470ceb2decdd1c77
- MD5 a1b4a4ed7f17278adfaca19d514f6ff5
- SHA1 29c0b1c983f2feb871f96cd25e0f0f33a9527d1f
- SHA512 74bc96a7f779e6eae3674179f9320270d9d159a17f40d9ba22f8be57f8df5eb3cedaca683ccb72a524c48f875f7c910f50897c9be5e82e47ade3a7a4d3705c7c
- SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:DQRQyi36YOcPQLvw2gAf+PN30kIB
- TLSH T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 1315f76b219d7f9641b847ba604ba39644fe42a0aacc05c1cea5e8c6064bd751
- MD5 aa9190ac0035b8008bd81c07c4f83107
- SHA1 0bd964698dac518c2c7bf0e1b736a1f2003eeae1
- SHA512 d01d82bde800c4b86747df2a34ec7149ece8cb753a9840fb418e12c23f1bbfda389a1825d4679e6f9bc7f10a3389d1a6a995e30906fa8c266879a196e3c43fb7
- SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:uQRQyi36YOcPQLvw2gAf+PN30kIB
- TLSH T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 57c71a7b91241db80258a88d275a9401c7bbaa1c5e86c6274b288bdc46c8e587
- MD5 cb9e39cd69611eb3f2f24786b90430a5
- SHA1 80a90c805c629010040754b68c2bba53751cffd7
- SHA512 613e23bdf292ce2d6a3872978c441f97293c3dbeaeb2a19e63cf17cacc24db3c457e2509baca9edbc5b1a9eca8f28e8e8dc9f4078bfd848a2a34378f33a7523b
- SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09yYHkP8ShemDk8N:o68Qg55nhheWu7PNU3/oHHk1HyB
- TLSH T1A5B55933B2F200A9C44DE1769F4A972196D27C758FE0E3DB855172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3f045f3be2a56301e0a50679332dc440f28038137ffae462d1961a28d2e51bf5
- MD5 5f1cbbb068b9c3a53255b8b3a7c12247
- SHA1 f2747b073e15469d799afed7e76a492c3e2cd831
- SHA512 a993581832d88b02ec86248028a2b90a8aa46d657645818ffbf56443959ca30be3ca04553a37e1245e2ee326e77f40c6cdf6b3fef4d8e1964f6910bc86c3bf64
- SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:Cy5112gYy5azzVvL69nLKnhZtkIB
- TLSH T1F9167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d6a4c83b512da699f2053d0c3bdca97302b9cb880607ab496bce34e56090205f
- MD5 c143a50136d3a41cf1d386d1972ad896
- SHA1 355d365b7f751d01c560b2477a30f0d6ce41d611
- SHA512 0ac962856c8454cc68bd16dc05a745595d50f35856c3b8748a875646480997b91e9e701cd7cf8ff5abf7a1c2730689c17918f6c939184acaa27d6ad8503a4b80
- SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCHHk1HyB:xu6JmVxd2dckIB
- TLSH T1A3D59D13F1DA01E8D06ED479974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 8cdb7626e85ed527a1e5a6a3ee9c72c83376d28d2121e361d2b75a7c0ec5264b
- MD5 196418f230ab4dad18982968c8e865b9
- SHA1 5117d7ee58f5c7e630d1bacd92426c7b8a8ed91b
- SHA512 11914bcc8aa6267db93e97d606cbab13dc73c6368bda74bd5c0bf424952fbef1b38731bc2fe5626f3696634c9674030524927c0cd1f19ccdde5638e35764bee7
- SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4x2HHk1HyB:omifPbRDkIB
- TLSH T192B5BE13F2D901E8D05ED17887569232EA62BC450B34B6DF0A90B7962F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 aac72542e1d4fb4bf437a3318e0111567a4ac8f5554420859a6d4d3429baf605
- MD5 24a8b76f368edfbf42f17a9c98a74ff0
- SHA1 e389a919e22ea978432bf0da4bf6eee595f4336e
- SHA512 baff3dd4451ac8df768ac29a60d11b9172f9c58612b25078b9789f1ae33444e9bebf7436480b1e25670eed766435c3b3f42886b2e10d20b88de55f7d45f87a4e
- SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqNHHk1HyB:95dKTi61JkIB
- TLSH T1D6C5BF13F2E901E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 6cf827382f7b064d02a1840ddd05c879ddb519591503ab4dd7499d282334e088
- MD5 f733ea5a9b68683ed1327ce3aad95c5b
- SHA1 7f62ff3dc10081e7ddb9732a441892b58ad3515e
- SHA512 139d068ed1f639021820d5cf6428ffe8a6185a7ff4f7e0f9d16cfe4c4cd124bac15929e0daec0fce19f354ee99ee2c2f0ee32de41f0a2355ca6906e96208fedc
- SSDEEP 49152:/htSn8EApI0figngiDn0AP5wSHHk1HyB:uX2iyphHkIB
- TLSH T1DE95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 13a3bb14e4fa785263d847a354e6509451c71f727f480fc6689b6eb96b06093c
- MD5 53a4016df012bd615d51fa916690449c
- SHA1 a2c2887c8f1f27500d0965557e7f4a0bfea24e33
- SHA512 0388841799fe6854a7539bbefa9e96f098ffb26c25d92fa5d111f812acce833a33df43cc963b2a556edc2b48fde3221464a5572d7bebb42876d045b044fb5040
- SSDEEP 12288:Ym4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:YJyYHkP8ShemDk8laa4BC
- TLSH T1B95523E54E6511DBD802153BAFE1F0C4DEA02CE5AFF5011AB4922C40BA74DF92BB75B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 776d8a8454b661accdbbb5e437fd7b3a83b8fa454fae839a06d7c8dbafe792aa
- MD5 d86b8f68d9a92b85a4a629da64ba4ded
- SHA1 f15a0cf742d7966a0e3afdcb7d83f3889056b8a6
- SHA512 c172c4e752e529c214bddaec26652545f1420c5cf1f2fdffb600bf11ab5c20d48c6fe9732b22b6b8ce3f600b12e6a3e19958095800d1470464469ebd1441fc16
- SSDEEP 12288:3L4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:30yYHkP8ShemDk8laa4BC
- TLSH T1155523E64E6511DBD806143BAFE1F0C4DEA02CE5AFF5011AB4922C40BA74DF92BB75B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 0a7142accca5e913d92dc50ce2b3bfbf08049ad799e060dc3e118d396041b794
- MD5 9d715fb71a92041aa43fabb43baad199
- SHA1 b7242a6bcb2662692781a887fb5acdcd6d6f3046
- SHA512 36f053b6bfd1b333acd5f2b4c6057a2187d6202912d9625d9172221c5242801dec997031fe6103fdaef4e9d4244869d091cc17470b9483a15e6f971f2cb821d0
- SSDEEP 12288:9N4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:9uyYHkP8ShemDk8laa4BC
- TLSH T1F75523E54E6511DAD806143BAFE1F0C4DEA02CE9AFF5011AB4822C40BA75DF92BB75F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 b51c5ce6afdf987cd4e3c31a4faee54c3b3817823108265e1aeb3bd97e96ae17
- MD5 3652774fd6a6b1cff1bcef14ca7dd701
- SHA1 4bf318967c394956c067172186ca79df30d539e3
- SHA512 6148612341fcc4071b144a8bbc27236d166edc98e047e1266709217834cd9a0508ea3a15cddd195b5a0de5d76a47c1cf5add296a6da72b5550343e09528dfd34
- SSDEEP 12288:+VA4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:IyYHkP8ShemDk8laa4BC
- TLSH T1345523A21F6501D6D812513AEFF2E081EBB07CE59FB5025FA5811C407E71AF82F76AB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 dcf204c0799b9dbbd4700fab912b62d27e5a0d48870a4e73e4fd49af4c106d23
- MD5 8b7f22909c3eaece72536dbb69a5a487
- SHA1 68484e3c294c5ca33d0da305fd1815b5332cdb1d
- SHA512 7bb3ffe84924c129ac470b94e5350d5cb3cb8bd89b73ee5b64b156d0cb41e0ec133ad8fafb110f77b2a694b0058fc67e8f0bedc3aa3296cf320a712b4c70032d
- SSDEEP 12288:g44gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:gLyYHkP8ShemDk8laa4BC
- TLSH T1375523E54E6511DAD806143BAFE1F0C4DEA02CE9AFF5011AB4822C40BA75DF92BB75F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 5609303349136db0b5ca37da25a81368d8d3fa6dc376045bba49a7e6146bb92c
- MD5 59d0a5875798890f99d65edc4061b58f
- SHA1 250e0b618936beee46eca71da45e7e1b786dfbd0
- SHA512 463bceec5c8c743a32a90692a6378fa3ab0bbf45c95a3bc361498c62a859c39b5d08070b8fecefcff0af41fa6b7e72cf26eb8d56b642003bc99e5dac945a82b4
- SSDEEP 12288:WP4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:WQyYHkP8ShemDk8laa4BC
- TLSH T1CA5523E54E6511DBD806143BAFE1F0C4DEA02CE9AFF5011EB4822C40BA74DF92BB65B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 164d8185c4d49d2409f66147bbfa05e72c2ef86321ae80001f7b1ac6a45e789f
- MD5 323dfceb891ecbd82dfd78946523d236
- SHA1 acc8c9b419dee7c26913fdf856e2b97aa6b693c3
- SHA512 164f0f1a0e1d2761cc736dc57e6b529c07b9c2f1f8df51dad32376664368bb68c3e1358dac75a604b3af01a012e6b718ecf9dcf452f92bf449e53dea028c60fa
- SSDEEP 12288:Aj4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:AcyYHkP8ShemDk8laa4BC
- TLSH T1C05523E54E6501DBD806143BAFE1F0C4DEA02CE9AFF5011AB4926C40BAB4DF92B765F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 0da5477fb00860c21bad63d72c594af7ebabe0015aebf5f6443800fc232e5d40
- MD5 3431a2e2bdfa9831ce0b9a80929f064e
- SHA1 7c8a1dbf4ad3f4a55a5c7cbcf19b4edcf9ef399f
- SHA512 1832ea1222a22bbef7f13fd896cf8bd878a02e63545b64b943ee64d1cbae1e000a59d511a180eacded8dc1dc7cc50b065ed68fd4eae1c4c6d7232e6be3e503cc
- SSDEEP 12288:hiZwbDzzFEoS2cPvyr4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:kZM3zFVSOUyYHkP8ShemDk8laa4BC
- TLSH T18F7502A573A018F8EC63413ECD619905D6B27CA90BB0C61F13E436566F337A11D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 9ec993e1d5680721f0a623968a1d0177fddce9e90cd6a92daaf9935a311424a0
- MD5 544460bb78a0ce3655008bb725e2bebd
- SHA1 2594071a40452aa9b03ef0d803f0e78c8e042722
- SHA512 628fa8b6a2601b2a0864212e50614f28d07193489c1f362b37c79c8858050985b1ffe5748e4d211d2ee787c7bcbbce22d212406bf6ad7c717d8251162d2a514a
- SSDEEP 12288:3y4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:3dyYHkP8ShemDk8laa4BC
- TLSH T1C35523E64E6511DAD806143BAFE1F1C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 19a7f7b867ce2a7193f6d1315bb91b8b44dc5f690db7468ec440cd0e15d44e79
- MD5 a195035b0683bf38d4b9521301e3f003
- SHA1 f0797a51611850f420ad3b1e7f5e64f047872ce5
- SHA512 36e683edac7530a563f4ae390704926d5cd8d031dc14cc30d819f0efc866d7a7379e0608d41b1f5b8df2a49f3763509be578a59d5933bc4a175f2cc91dc08429
- SSDEEP 12288:Ju4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:JByYHkP8ShemDk8laa4BC
- TLSH T1255523E64E6511DBD802143BAFE1F0C4DEA02CE9AFF5011AB4926C40BA74DF92B775B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 4e96556fd1da3bd174ee0db8884c0a97de3d091e4ba347995996727cec086d43
- MD5 c44f52ca2e3b8b869cdf1db2a10eb64d
- SHA1 920d3024149038a1b07012d313d9c48dc9b1ba16
- SHA512 abf003454e479e1707d068efb5977636ab39f14fa894a516f9510d8f1da4f774a35092e294185d9f2fee5013bc4e13f95783bb8a270f6cfe0d90660c21b93843
- SSDEEP 12288:FyPz5L8X4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:MzyIyYHkP8ShemDk8laa4BC
- TLSH T11165125727A130F9D4275239CDA25941F7B17CB64B704AAF52A00A623F336E06E3BB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 78da5a44e58e7b023ae6c253eda1901b5536608bb69f22f97c2558719028f659
- MD5 a6878a11606fe3b494fa5767bb596e9b
- SHA1 d51d689c8839a694af6f4674d8b5eaf064c9e854
- SHA512 210ce786c5b51d74ef2529334520146510ea41a58c529938b47114ddfef4e03961230a8283c5b7365d10b7e0057c8a6a9af6bf09c70fd542bb0e0b78f6f5adcf
- SSDEEP 12288:ny4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:ndyYHkP8ShemDk8laa4BC
- TLSH T11A5523E64E6511DAD806143BAFE1F1C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 ad7fabebd6a566ec8020e91e1e892d33800272a3014810af30fe8bfdc4b9873f
- MD5 71a60d31d73145aa74a0f196b7d80560
- SHA1 4be05131d36bcaf01ec538b491a2f16fa9ef135c
- SHA512 5de986674a602322852ef9f9432e4ea47093fe76b3d0ceafab549b8b1f8c0a376736aa3168a5c4f171308aea91d75a7e3f1fba0f55bb0ae212c47b6c8bf1f48f
- SSDEEP 12288:zy4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:zdyYHkP8ShemDk8laa4BC
- TLSH T19B5523E64E6511DAD806143BAFE1F0C4DEA02CE9AFF5011AB4822C40BA74DF92B775F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 213ffe8cd825b9a710b855bd2fb31332d099f5f38aa28d7401420474d256b218
- MD5 4a1ba952a966e4a395c88c4ff6919cbb
- SHA1 d828f4e8763393e9479551fcc68fc5789ff4daf2
- SHA512 45c6e52607138118da714d7471300504ff44d9d5bb27c41184090167486dfd4a601042b4cc54c18cbfae0b070490c9d296556180954f7920a1edb560d5380061
- SSDEEP 24576:8cP4mcvIjkGOxhKP2l71SNKbrh/8KBFyYHkP8ShemDk8laa4BC:3P4m4IpOO67N8K/HHk1HyB
- TLSH T1F065AE2DABDC0096D0BA917886658A49FAB1742A1F3286CF1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 3961b8b08f3fcd8b64fd3cef7b4977033479c98188137711af05a91d245cc220
- MD5 4b566bc004a67aa0834b3d37bbb26376
- SHA1 da9a65c35d1275189e69d36046db6ff3cd831a4d
- SHA512 29c5bb2a97360d4223ecb30e8917423f9445bc46218dff55c4e594a1463d11ba0eecf4cbfe3a6817dbdaf89917f95d299fae9e3d1411a7ae90462d305532ae7c
- SSDEEP 12288:dssfC4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:tNyYHkP8ShemDk8laa4BC
- TLSH T13B65F159C65402E9C05E213ACB919680F7733CA58BF183CB62C0F93D2F75AE45EEA653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\92096ee160f3a3fa.bin
- Size 12KB
- SHA256 1593baef8c07d8b1758f44be235a9cb0cc5f7d4250ab9c81be64c8aebcbf9729
- MD5 854519837962c4e736561ae2f2b91c48
- SHA1 e480b09e5afc9a40e6d71e0ba42c1599b35d71f1
- SHA512 27f090a7d8a527d97137b2b2a0d8fa942d5857e91a538c5810124a17c1494e9d52a40ff853326bc1aab72d1c33b8d6e3c47cc8809cab88bd8c4dcac2051e86e4
- SSDEEP 384:OyI5yDO875Y+9MZ6M+wr+Jt//C5uxGweFdLRXwyF:ZKIO875JY6Bwru/bbOLRXH
- TLSH T11442BFFEC5694F0D4C2D9B853A04164008E2FB137556BD9AAD002C7A6FDCADC29AFC22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 6ae8dafad17b2e9a404434fd3c73acd8204aa6bfe08bc8b72c3c004a86596c8c
- MD5 ed92993e727280090be930ebf9410407
- SHA1 e4ecf47b5a303931367d79f3af9705f6ca416a42
- SHA512 00ed5fbb999f035f1c77b094f4835fd67de3f3ba02e0f37287b49903b1ce0a67fb1dc090faa6abf6acd4cf57e0ebd0738e17780a5c527616dcec8491613b30a8
- SSDEEP 12288:Ti4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:TtyYHkP8ShemDk8laa4BC
- TLSH T1005523E24F68119BE816253A6FE5E090AA643CF49FF4011FB4812D80BA74DF56F72673
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 8d37ea5edc54f33173de5625741b58f3ceb4ee705078e5534ba119e0ce978ce5
- MD5 c4a82718fde63383d575642c69974b52
- SHA1 f80fa56893a3ca4644a223a84507d9101c43a7a0
- SHA512 22c0059cd96390c3054920c3e40a7d85f5a512b5cbf9c316cd685647b38191f4587aa3d506c2abe6539255fcf569c36379c4b7906df80f251dca5748f5115545
- SSDEEP 24576:QoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bvyYHkT:Qa0h2GEkuAe73q3pp46zwwQLHHk1HyB
- TLSH T129859F1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 a4fe2dd6ee0c5437f66a14b8f49271109d701dea7e236b65c035b62c9cc0bcc7
- MD5 02d90c46be6e5871adfb4ab3f0b95105
- SHA1 4fb421667f2cd6981af820e25c254f94e4123b99
- SHA512 43dbdcc1db47485183b13b5c7494f30af52e7bf7de1c09b0a4d5c3ccc20dbfe408aff58ee9ef6aa4469a047fb251506cf6d3c4d53e174b88a08deda8a2399f7e
- SSDEEP 24576:R3YgnJcRTk4yti+R5dpR/syYHkP8ShemDk8laa4BC:RIgnaTk46ppR/sHHk1HyB
- TLSH T1F045BF2EF2B910B9D8AAD136454143B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 5bc3143af31809326daf77306f17af41f3b018a4ea6690dc01f6c388daae25cf
- MD5 a5c7e7129fb2901579d0d4e2a23dd518
- SHA1 9fd90b94e6afcaf9a077d08067e66dc60e56b8fb
- SHA512 d7c9f20bfb46c932a363ef3bcf94ee9a0c14d706943103b793aa5ef25a863e44d816812b1dec082bda248f9d45987014f549631f9990f5cc2a3cfbb8b666a25b
- SSDEEP 12288:ze4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:zRyYHkP8ShemDk8laa4BC
- TLSH T1275523E50F6511DBD806153B6FE1E0C49AA03CE49FF5019BB4922C80BA74DFA2F765B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 2c9602acbd369d2fa2a468a5975b3eff22d5f57d8f3698c51c8473c6032456b2
- MD5 67551ecf93076a7a484639603b07cab4
- SHA1 4c0844a242153f64137b13b10ecc76094f485851
- SHA512 773789c98015f8606b9c0c3e8ce402cf50c6a938c155991fad8689978536f2942861ea6c13d983479c437005b3396beacb65fee199b67d8f9101b757b81cb22c
- SSDEEP 12288:nOb4A4LWOsvAYFT54gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:IwL3UTSyYHkP8ShemDk8laa4BC
- TLSH T1FB750155EBA400F9E867813DC9A29512E6B2789D0764E7DF03A84A512F337F14F3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 bc75be97f3aea8f131fcd84ba7fcf6b23743f8796d448fba8e3ddf72c1640b59
- MD5 6935d0954c2f55901f1c844b0c8e59f9
- SHA1 ab91c50349b15955e388698d2894ec34547437f5
- SHA512 3a0b74cef7fd0de51bfb70c04d4520e0bc85507a3bbe9abdc5f69d4fd2898d332a19c64b33460dc89bb3ae246c6debbe5329564e4d191ef7c36a7760c0badbde
- SSDEEP 12288:ypFtCOl4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:fO2yYHkP8ShemDk8laa4BC
- TLSH T14755126A3BEC10E5D426613D8ED29249D7B17CB50B6103EF01D084A96F73EF86D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1aaf6297a28b50847da98b7f7a88341c55f82fd45216511466be7305eddb7de5
- MD5 53083ad4bc55330019eadf56db8e216a
- SHA1 a4336ae127b82f66ff0cb80acea0be48d910105c
- SHA512 50a80e2ba9dbc5ff9e7df73347d7da39c5a6e6b2988211227c2bdbd52f377830cfa6ad388105f700ec9ffa2519eec752d91771343843612f0253acfb2b241b0b
- SSDEEP 24576:N7NM9YmZqmWMUkPjZM48Mv6bEhsdyYHkP8ShemDk8laa4BC:N7cBWMpPjN8DbEhEHHk1HyB
- TLSH T19E659E6E6BAC81E5D476D13DC9E28205F6B1B8611B318ACF1152833E7F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f5718f53803a76d2f012d8813de28763a8ae6b9a3a44dc3405a6b16f3b9391fa
- MD5 998c8b5fd7443e1efba935ff49e46854
- SHA1 52895deacfeda6d98f9ec355df3c293225c4bdca
- SHA512 58e2d6686de092d5489cb28c3887992f695d274607178ff8dab027c993bd4cfe91c10478c08e364aefa4e4605f86633fd00b5e310fc7d954c2c280af7d89b5e8
- SSDEEP 24576:0W6BApg2YuyuNDYTabvcRvNYf8km13yYHkP8ShemDk8laa4BC:0F2YuHNETovcvNYf8km9HHk1HyB
- TLSH T115857E6927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 f0865cbfb3c7a8a47489d21b601aa4b3f48ee79c4bb0972dd7ad5e309135b0a5
- MD5 0ec5023b66d53e21215e9236d7b7839e
- SHA1 37c088367074a11d7b12b8f818311d58e0f4add5
- SHA512 206cd9d330944550c4afc69c064512e730a25748753e034f37203edf0c216ad4894bac512512e595ffc8a3253f502c090b0e9ba9cdf8373b85e3acf17d2c5782
- SSDEEP 24576:hAFs06+Omlf3NXEbToKyYHkP8ShemDk8laa4BC:2Fs060lVXurHHk1HyB
- TLSH T1F565AF2F66AC00D5D07ED17E8A97C91AF6B1746307255ACB0160863E7F6BEF81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 b96cc73d8c412ac49cf2417f58e36b894473af2bc1e070b0212627a3a8d655f5
- MD5 e7458ef2cfb1ff874142fba010064345
- SHA1 dcd17df628067f7cb049b7dcc874ee8919e172a7
- SHA512 e4f9d1a6b0701ad31f6f604ca15449e71d5c44077979acdbde5dd5420bc04fb4c5d58417df1307e7aaa68184f673e01ac40ad9e09a04727c1086d383a858ba6b
- SSDEEP 12288:VCJnJ5D3VkrazxS4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:MJnJ5D3WKryYHkP8ShemDk8laa4BC
- TLSH T19775D02DD2A810E8D477C274829A5785FF71387D2F2269CB24B4D5353F22EE0AA79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 c4b6e82f88f92a6c92c664add0d7f0c0cfc4fa8041eca1610d8eaef9a8e3b14c
- MD5 c4c25fda65071d3daa001b18239788ba
- SHA1 875db0506dcacb217ea75d93498d11914a6bd0da
- SHA512 18eb8c385bbea7550ae9a30e5956589f0d57e1b543b30537860d98a40c6abccd57f23671bbfa3e1de167b6aa606da4f56a60e8255b0c5ee1aed15e124d24266a
- SSDEEP 24576:SEPohm6/7IIXdwcXrif7qQncjlP65i3VusyYHkP8ShemDk8laa4BC:lo06DIKdwc+eQnSt65aVJHHk1HyB
- TLSH T19B956D15BBEA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 4273c77368018b81b139ccae0c70b239d6d41164bc023245ce27e75f2987c549
- MD5 6d87931c6e64ed80da8831d56967d116
- SHA1 b4aab88fc2c39a7c6ef6a95791629483983105f4
- SHA512 feda696608b760cf4c5a7993f2eb3909e45e3c4a8c97e5ed6876b0cdae746805bd1424bc37580bc614c51ce2f73204b4623f3e7b55a6d4d57ef564ad7c40fae6
- SSDEEP 12288:mEP3R8r4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:l8UyYHkP8ShemDk8laa4BC
- TLSH T1F85512AD2BAC20EAD426503E9AE1C144D7B1F8B01FA213EF11D185385F77DF92E39A51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 8e0e39c2fd30db7fef4ff9f5b0e213d9c2a025313d53700495ea1d6091f70132
- MD5 aa6fa82332995531e5125983df3e3c6c
- SHA1 5687847aff1af2b5c4d970d8e8d02c90206a41af
- SHA512 878ddc86b71c2c37b4f1c8b2aa711d4dcad0f1abb80ffde86fbac141538fc8e0f19474b76535189349efdb0408321743b8124c221897766bcb4bb1bb0412f9de
- SSDEEP 12288:SjkyL4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:SIy0yYHkP8ShemDk8laa4BC
- TLSH T15C65125517A820D9E866053DAEB2D1909F70BCB05F7042DF60C0AA2D7F76FE46E31B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 e7b7e9b817e59285f555eaf1f72385642318acb00e40aa360ddfda34ecfa36c8
- MD5 06510d223a5722459065a9e636b5deb3
- SHA1 c5489a97094a7f098bbdc165375f83b63e36dd87
- SHA512 4290b158fcffbbc93ff39d79487f304139cb9a31c8c91671eb786d5060b2b10fe6ff32658e3a11acfabbecb78be698900b7266cabe5e82ccaafefed45cd6f0a1
- SSDEEP 12288:63V4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:CGyYHkP8ShemDk8laa4BC
- TLSH T1B85523E90F6521DADC02153A6FE1E1C09AA03CF45FB411AF64D1AC40BB75DFA2B739A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 bb85b13695423481fe88d765662a35ba3cb4f64849ea98f564703a82ebda3481
- MD5 869fd5dffc742a0164eba68738733955
- SHA1 8ebda496808dd52dad4a9b4fcfb2bdef3b0cc66c
- SHA512 0196390677fdbd78ab40ec2913ad17493ccb0088d12eadd9d1443f9318f66a95f348dd2da58a2b117217484595d120b631f8e1aebe3b100a3541bf91bccab266
- SSDEEP 24576:CQ9MxZKdcz97w31yYHkP8ShemDk8laa4BC:CVKX1HHk1HyB
- TLSH T104558C2DABE905DAE177D23995A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 7adb4de20dad231f824abc5cf2903e79ddee7f7844b2f35d906c09aebea67099
- MD5 1f6b9385f77b43a8f2a7337e0fb2cfeb
- SHA1 23196904884941a995f94b4c6886efa99c76bb96
- SHA512 903551494818ad2c443b3194f191b5adc77510064962c8a76e163f95e284778882e2d2615440db04b2df3ed6bd7910c6313460bc28c4baeb62e2e1a3ca44edad
- SSDEEP 12288:8yoKo2MRple9pn4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:8yocqAp4yYHkP8ShemDk8laa4BC
- TLSH T18F65E05FBB6900E2E022813C89858245E7B3B4705F6213CB6591C73D9F37AE9BE35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 9b87116bb9c698130d1d941ab281ce755be1457b6999e3010fb005211c95fac3
- MD5 ae9c6c6b5b673152a582e8fd5a69d430
- SHA1 951ffd67b7944a0e7c510e33b44ba5350990ad24
- SHA512 caa0130814ae99f55f6ff701edfec264d3873bba084c69bce1c7d0d369a0375670122c9d957ca96e85548865309fd4d16b1f2aaff5a60e7e001f8285d36b3bab
- SSDEEP 49152:/WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK4HHk1HyB:n0zuNI6kIB
- TLSH T135A57B3DA2BC00A9D8AAC379C54513A5EE71742E3F2055DB01B0C578BF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 ee664a486afc40b815b7e5d3e752149a572759072bcba0d3bf874c38fdd0336b
- MD5 8d33a2a0ffa5d09d3dd01b21829fca9c
- SHA1 b831042b2f442c1c9ad9f253727f3205815754c7
- SHA512 e0d582ef5edadd7a189fe00aa6d248757a705f4f565c53efde77bc6236012ac0c36b9079e245b77ed107c5f7cbed4685133aa62b5220b4e473716d34d53ba760
- SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYtjMqbUyYHkP8ShemDk8laa4BC:iTDxR+N5YzTfjM9HHk1HyB
- TLSH T10355B02EA7F805E9D17E85799B23C502FA727861073193CB42A0C17E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 e71b8493837d993e7644de530079d1eeda57c1061f14a9af036aed59b4069d96
- MD5 b267e2fa8ce328abab5d493e39f0da7c
- SHA1 c8e2d4499c83b0daa86940081e555409aa93d751
- SHA512 ab76910b53c3d942012978f5e77671a07e8e80d6838cab611f8c0a23e8457df1de33c970a4b654355be209c010bb9f90f274fde051966b05aa7b905a017a6519
- SSDEEP 12288:3hbHjfXA4gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:3hbHjPjyYHkP8ShemDk8laa4BC
- TLSH T1F85512BE1BAC20D9E432A13E9A91D146D770BCA51B2153EF22C181685F37EF41D36F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 04699b3bf4904839f79d32341a77d7a2635b10586b4e6065b640d3e75fc87815
- MD5 a75ce93ffaeff930019695c08e922794
- SHA1 a035ea3cc4e5b1c6e696c725923d9741d6332d26
- SHA512 bec07578d356cf2603281fa58488908e22455fde2ddaab5080f36a1d9964c1c143826fa7e044e69945bbee8798948362345b5b076cfc232f4194f8bf52f657a7
- SSDEEP 24576:4TMdOz0FFS+1mSLjyYHkP8ShemDk8laa4BC:Q0K+1mSLjHHk1HyB
- TLSH T14275F17E676D14E5E43BC17DDA53C906EA7238A1032166DB06D0C0793F6BEE43A3AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 ff78e0fbf6078d1aed1c1ae1a51d828577efaff761f3ce46b6bd2b9460b9a900
- MD5 4d93327c05c9ac40c0e041dd347e6a38
- SHA1 29501c9f7fc29e2e4c256583ecb94a5b9a48ebf9
- SHA512 4e777c5a04cb82ef063d9b66706c2f287ab924d488fe953beac7aab97e556098802daa3bb8d01132759d697c29fd6756339e6c568b3a9eea7f43bcfe507cae3c
- SSDEEP 12288:h4u54gqIFUN14kfcPmJ6r1Q2emZhzQ/vONlxwz3a4fJC:hSyYHkP8ShemDk8laa4BC
- TLSH T10355125D1BE830D5E822513A9FB29181CA707CB51B7412FF34D0C9756F36EE8AA35B22
- MD5 SHA1 SHA512 SSDEEP TLSH