Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 05:58
Behavioral task
behavioral1
Sample
2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 3.0MB
- Sample260930-gpc32ssdmb
- SHA256 f6911c84e17cb07dc3b6665bf1cb99c0333b4c31eefe760358a41196c0f94ce9
- MD5 07066b37b9f175d0f6436cc003c0d7d5
- SHA1 cb2322814ee2b3e1421958ad5f1856c612563f3c
- SHA512 ee8763b9d86b51311a5f748f91d3ecdeb18346522990ebe923611fab9331acc48ab63ec476c9f1ee4b2cf51e5c7ef8c7b7df2287a1408c5ffa6e14771b8f2c6a
- SSDEEP 49152:LgHsa8bDRvFhX9Vu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2oMvA9n/TDb2:K8vzVu0VLGMb5Cx0taAUgLdpq+Xvna9G
- TLSH T109E5E11A579D00EAD17AD37C8A964906D2B33C1AB3A05BDF03943A6D3F376D09E3A315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2648 alg.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 1876 fxssvc.exe 2372 elevation_service.exe 564 elevation_service.exe 4772 maintenanceservice.exe 1724 msdtc.exe 4500 OSE.EXE 4012 PerceptionSimulationService.exe 3860 perfhost.exe 4392 SensorDataService.exe 1940 snmptrap.exe 2952 spectrum.exe 3388 AgentService.exe 3256 vssvc.exe 4024 wbengine.exe 4772 WmiApSrv.exe 4544 SearchIndexer.exe 4988 locator.exe 2508 ssh-agent.exe 3488 TieringEngineService.exe 760 vds.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ alg.exe \??\F:\ DiagnosticsHub.StandardCollector.Service.exe \??\F:\ ssh-agent.exe \??\F:\ 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe \??\F:\ locator.exe - Drops file in System32 directory 57 IoCs
description ioc Process File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe ssh-agent.exe File opened for modification C:\Windows\System32\SensorDataService.exe ssh-agent.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe locator.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe locator.exe File opened for modification C:\Windows\system32\TieringEngineService.exe locator.exe File opened for modification C:\Windows\system32\AgentService.exe ssh-agent.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe locator.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4bb05179288da564.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\TieringEngineService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe ssh-agent.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe locator.exe File opened for modification C:\Windows\System32\vds.exe locator.exe File opened for modification C:\Windows\system32\AppVClient.exe ssh-agent.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe locator.exe File opened for modification C:\Windows\system32\msiexec.exe locator.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe ssh-agent.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe locator.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe -
resource yara_rule behavioral1/memory/4584-15-0x0000000140000000-0x0000000140301000-memory.dmp upx behavioral1/memory/4584-89-0x0000000140000000-0x0000000140301000-memory.dmp upx behavioral1/memory/4584-506-0x0000000140000000-0x0000000140301000-memory.dmp upx behavioral1/files/0x00010000000233b2-507.dat upx behavioral1/files/0x000100000000c535-508.dat upx behavioral1/files/0x0001000000017431-505.dat upx behavioral1/files/0x000100000001704b-504.dat upx behavioral1/files/0x000100000000c3fc-509.dat upx behavioral1/files/0x0001000000017816-531.dat upx behavioral1/files/0x0001000000017ec2-536.dat upx behavioral1/memory/2508-541-0x0000000140000000-0x00000001401BF000-memory.dmp upx behavioral1/memory/4988-522-0x0000000140000000-0x0000000140152000-memory.dmp upx behavioral1/files/0x00010000000178ce-563.dat upx behavioral1/files/0x000100000001797d-584.dat upx behavioral1/memory/760-597-0x0000000140000000-0x0000000140204000-memory.dmp upx behavioral1/files/0x00010000000215cc-604.dat upx behavioral1/files/0x00010000000215cb-603.dat upx behavioral1/files/0x0001000000021596-602.dat upx behavioral1/files/0x0001000000021587-601.dat upx behavioral1/files/0x0002000000022c45-600.dat upx behavioral1/files/0x0001000000016793-595.dat upx behavioral1/memory/3488-572-0x0000000140000000-0x000000014019F000-memory.dmp upx behavioral1/memory/4988-627-0x0000000140000000-0x0000000140152000-memory.dmp upx behavioral1/memory/2508-628-0x0000000140000000-0x00000001401BF000-memory.dmp upx behavioral1/memory/3488-629-0x0000000140000000-0x000000014019F000-memory.dmp upx behavioral1/memory/760-630-0x0000000140000000-0x0000000140204000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe locator.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe ssh-agent.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe ssh-agent.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe locator.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe locator.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe locator.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe locator.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe ssh-agent.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe locator.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe ssh-agent.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe locator.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe locator.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe locator.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe locator.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe ssh-agent.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe ssh-agent.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe locator.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba5073e3a050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ca8a8e2a050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d03455e2a050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077d1cee2a050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0d090e2a050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f3736e2a050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e1cbee2a050dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 4304 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeAuditPrivilege 1876 fxssvc.exe Token: SeBackupPrivilege 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeRestorePrivilege 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeSecurityPrivilege 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 4584 2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeAssignPrimaryTokenPrivilege 3388 AgentService.exe Token: SeBackupPrivilege 3256 vssvc.exe Token: SeRestorePrivilege 3256 vssvc.exe Token: SeAuditPrivilege 3256 vssvc.exe Token: SeBackupPrivilege 4024 wbengine.exe Token: SeRestorePrivilege 4024 wbengine.exe Token: SeSecurityPrivilege 4024 wbengine.exe Token: 33 4544 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4544 SearchIndexer.exe Token: SeRestorePrivilege 3488 TieringEngineService.exe Token: SeManageVolumePrivilege 3488 TieringEngineService.exe Token: SeDebugPrivilege 2648 alg.exe Token: SeDebugPrivilege 2648 alg.exe Token: SeDebugPrivilege 2648 alg.exe Token: SeDebugPrivilege 4988 locator.exe Token: SeDebugPrivilege 4988 locator.exe Token: SeDebugPrivilege 4988 locator.exe Token: SeDebugPrivilege 4304 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4092 4544 SearchIndexer.exe 113 PID 4544 wrote to memory of 3572 4544 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_07066b37b9f175d0f6436cc003c0d7d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:732
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2372
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:564
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4772
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1724
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4500
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4012
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3860
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4392
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1940
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2952
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:456
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4772
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4092
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:3572
-
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2508
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:760
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f793bb249cce2924fffb851daa105be1cb76e56f81b81abf198982d4560dc7c1
- MD5 851b5faee9eec4e2616487b4e6abd354
- SHA1 38992b8af91fa172e9fa0b56e69942b3b213e5e6
- SHA512 3c3efa8a362c0a8c7c22c2162a945016bc82bf6995f4c543a163040bf67ce939af15ec6c0787e820d22f8f00ee87a472196c458dacd8013ff070331afdbb489d
- SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyA9n/TDbXNKd:a3q6HjBufb9s
- TLSH T1CCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.4MB
- SHA256 155e6844b175ec2424f8ba22440661b7a98104a35f65b10e5e8e1fa9e1082517
- MD5 4300c12892073d543adf255506722a8c
- SHA1 b41ad68540489fdbd6c46da8c4b2d1e680fa73eb
- SHA512 b33c2b9e115264d4ded501f3b12e75adcb6f0ed7d3b832ae010f48ab11cc6b248edefb2a4e52a786d3e1dfe16dad6280df1ad3b105f431fcc1b647438f003369
- SSDEEP 24576:KXYiAxczA9UeA9n/TM4NZYeNm+9MhUwdGUTDWG6goHD2LwyKTPxEDev7uvx7S7:ZxcIA9n/TDbXNKdvslFyKTmCDu+
- TLSH T139C5126567F408F9DE67423DC8A1C505EB727C4A43A0E7DB03E866251F236C85E3EB86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.4MB
- SHA256 bca4c2f5460508b258060c9a3f5d3fcb0be07256d7c42f89845b5016ea26e6e8
- MD5 09e8e65d5d033a56b34bc25f9a7da387
- SHA1 38f8fc0643df3e2acc92771d9d232b345d8d9e77
- SHA512 067e0e5b031188a3fef24ff4e825897362c3f0f5a80cb0eca780a1074066fc650f176552e2478142ff77890106fa96ef369e8781f1ae3e29cfd6dff700fa52a6
- SSDEEP 24576:oXYfDtczA9UeA9n/TM4NZYeNm+9MhUwdGUTDWG6goHD2LwyKTPxEDev7uvx7S7:/tcIA9n/TDbXNKdvslFyKTmCDu+
- TLSH T160C5126567F408F9DE67423DC8A1C505EB727C4A43A0E7DB03E866251F236C85E3EB86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.7MB
- SHA256 a0855eb92f0259a0821cebaf6e3635ea675a4305c57135e702ea02dbfd6316d3
- MD5 a4d105c546dd6ac5bde06b1d9ba04f37
- SHA1 1d476a885346bda57af875f94ec63d7533ef3774
- SHA512 c7c1ab471c19532a5f1894c4e31fae92214bfcc3c3b0d0cde9ffea7b93dcf2b07e4bcf2b0e5e6eb5a17b6a04ac445c06157460dd84d4aaa074c08ce44b258d77
- SSDEEP 24576:a0JeV1r0awxbrMYUeA9n/TM4NZYeNm+9MhUwd1UTDWG6goHD2LwyKTPxEDev7uvS:ap1r0b1zA9n/TDbXNKdWslFyKTmCDu+
- TLSH T1A5D5E056F6748771D073C0B9C5D2A68EED71308657308ACB4286D77C3E27AE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 2.2MB
- SHA256 87eba81ee865197534bc046019588cf8028646047aa5114f3fe7f762de98f6ad
- MD5 13e4343ce00d4f88b929d0e4248a2eaf
- SHA1 0070a0c563437c5a9eaabbf5e541c061ddb1e8d7
- SHA512 363bb850e2857d2d0d9f46b362295884ab475ac983efe5353e1df4c4d9d7d8b2c17fd0bb823beb7df4d641a051ab5852ee3d24888e354c783ce5c57ae05832d7
- SSDEEP 49152:e/ezSC6vUzPv/HjyvA9n/TDbXNKdKslFyKTmCDu+:6ezSC6v2X/HTfb9sKamC
- TLSH T12FB5AE25F5788333D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 2.0MB
- SHA256 ca48f311c8ab7b2d5d81bc08ca8ad52483490bd7f4a77db8bfad44d9082e8f75
- MD5 d5de66eb002b98c7f0277a23e888eabd
- SHA1 16038bf71bc9dc13c54baa965adbf5f4be4ea3a0
- SHA512 1c5036e6b04de6758e93cd6a684737b79d68957ec0fd5c986e7d86a77c13cd4519b55769e4f526819d65f70a5cb4a840b64d2a7fcfc6ade86e748c09cb48f3b3
- SSDEEP 49152:4aiXYFXl+8A9n/TDbXNKdUslFyKTmCDu+:woF1+pfb9sUamC
- TLSH T1FFA5D066F5748331D073C0BAC4D2AA9EEE7234425B31CACB0246976C3E676D6DA36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 2.2MB
- SHA256 1e67e3d76f1017a22ab73e726380580d4671804a5afaedee79a1f8d64574f760
- MD5 3e25dc1095c5d0e378922ae063929279
- SHA1 f2578e9f9dcbe507a50045f8313c852ef039c494
- SHA512 cad43606a00b1192ae0defd3891986b8f8e06309bcd1b2cf5a88f6614c806eab034fcf6750191e9f0620f42e02b5736738cb0fe6385f202529dae78b1a3e6059
- SSDEEP 24576:e98UeA9n/TM4NZYeNm+9MhUwd9TUTDWG6goHD2LwyKTPxEDev7uvx7S7:zA9n/TDbXNKd9sslFyKTmCDu+
- TLSH T1F1B533E24BBC08F6C7DA0635E4E0965CDAB07E0F71C883EA476E37196D344459D6A18F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 2.4MB
- SHA256 1b64e6120a3a37c6b7a1c8a1131b08b9ed63956a6fe01362c6e5ee3d1b712f02
- MD5 eef3e1292fad2f0fe98e5e1a714bb192
- SHA1 5d34ab635c8c36b80da6c2920fa7c28c440d170d
- SHA512 24964c9eebb0dadfc80390eb59245a7d6f7d35f91d401cce1cfea0aaaf051980145bcd316fcced3926a114515623581259632894aa0fd32be323e54d29dcea72
- SSDEEP 24576:DJIUpUeA9n/TM4NZYeNm+9MhUwdFUTDWG6goHD2LwyKTPxEDev7uvx7S7:DJIU1A9n/TDbXNKdmslFyKTmCDu+
- TLSH T134C5017BAE38ECE2C27A4D795A91C300D7B278315B5193CBD279830E9E235E05E7AC15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 5.4MB
- SHA256 b515c9f1275a940cb942f27df197bb02115273d59ac3ca98e50a5a7bc2b96a6c
- MD5 8815fc947e57f250478aa7bd552a2a7f
- SHA1 baba7c3df23582d662c9035fe163e0a84609b62d
- SHA512 b03435d216cd31d40805bae7a2050f499bac723c3e1a6546b5ec88de8cfb31c854e61e53fba4ebc85e8fb58017159a7a2b9e125dd3e0d37cefe72bc6c799792c
- SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJi9DN5J8NRV3THr:MQvGAdlCEL8c/iRNw5C9fb9sSamC
- TLSH T1B2468D656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 3.1MB
- SHA256 3d8aa62f52ec42a65ee1eee6b3cec47baa27d81456d924f3a1e9b1276af48a9c
- MD5 c067614d4c75c333f23785193c2cc652
- SHA1 a10ddb40bdcbbad4483dc0951dd1d923cc2c6614
- SHA512 10b10f25fa55d49bbb6def1974d4845c1171963388794bbc6f169dcf59dec3b75ca9fe9e9e69a4220e9e9f1815b437a9f8164a4e3cbb010a2eeef3f56a011836
- SSDEEP 49152:pljDA9n/TDbXNKdOslFyKTmCDu+IA9n/TDbXNKd:gfb9sOamClfb9s
- TLSH T184E51271EFB8C432C3BF0DB61B65D7099878BE104B911AC3D3AC6A5D59341C26B76A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.7MB
- SHA256 5e9d03a97d76bf44512a8205ffeb5d6bad03d6007a71a3830f20020068c62fbc
- MD5 38f071ba3988ccb83b8aec54250b565b
- SHA1 3639cfe764a109d3cfa8a2bf9bb0164049fb8bd9
- SHA512 d108bd8fa0e4acf4046b65e7c0d183c061c1307dcf302251e3ec775aff0469ee876bafe3556a5706eff35f522b6d9109f4481aac54e90cc5f176046c15ffad3f
- SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEJldPlbuJH69qamC:vUEtQevvqc2W1cpV2EJ32+m
- TLSH T1F9475B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 3.4MB
- SHA256 9cd572515b1e9646f530d031a6c3de39e278c913a944c2803dce517be29e80a0
- MD5 c616eee293c5716867c763a8b29fb8e7
- SHA1 e9e8141162694bcbc0ddcc3d84466c3e7d69232d
- SHA512 98e2de3f00c3a0b4ca75e9cdb0192efa28699c55a05da21882f10a52762104a5063fe81d090ebe640fde22222325e551f85090de4f8e80061709f98c5a1fb96d
- SSDEEP 49152:0UbRquA/m2yL5zUfFiV+XenmE3/zjA9n/TDbXNKd3slFyKTmCDu+:boqlVjnmRfb9s3amC
- TLSH T1FFF5BE0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 80a8e4505bf3f7868d8c1a9dde0aa1c609fd76393734e11b4b61e642a7921b50
- MD5 9524d0885fbc14f10412192b0eee88c1
- SHA1 ad4f222f8787464352f378790e1be3f8f6c63cf8
- SHA512 9f23ba1a4d3267a36037db4c5cb38228459cab2c2549d266c7f86ec8f8075f33c76bed1b50f3ff353bebfd393f932f76c28013f958465f0c189a7bc0d0d4a2c7
- SSDEEP 24576:uAhGLJIFoiwtA5l7S53aUeA9n/TM4NZYeNm+9MhUwd:uAMyFoiq5EA9n/TDbXNKd
- TLSH T1BE359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 c49c7a5c8c45aa0d2a7f36e0f64f4fdc6359fe05f8355d4fd77e478ba027a3d9
- MD5 cb236fb3814430205b3852be126da856
- SHA1 8a503fbae9f688b8da3a9bdd1df59f4f394b338f
- SHA512 ef57d4c0551739d2b6ba3733f7452800e9ffff113aa8d6428f67f63c0e2638faa4578ee2422d0775e262f8788ba6829d90ac3bd8c52a793135ed5b91e43e7e1a
- SSDEEP 12288:Jmw5HEjsChNzBFgl0WDm+COBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dj:EwuSOWLUeA9n/TM4NZYeNm+9MhUwd
- TLSH T12585F14637E80CF9DA6746398597D635EBF2BC062A21C71F0760C61B5F37261AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 e6a7dc8e158638e9e36aff5f0e3f345d56b9d2b8c8a21e56bda488ce1440f916
- MD5 bf54a3d36b4aad6c13d481ff6273e9ad
- SHA1 96f2c656cbfeed48b8005a059b5d92474b95f14a
- SHA512 35c955e67cd76acc0986ace29e2aac12b41c4a896c2157160741433d5144d09ddef3f88d5752e9b11aef0645433ff412efb2acaaa23f19b3d75cce9da603d27b
- SSDEEP 12288:8jZ1IyfBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:IZuAUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1E975128627F814F5C397427DC8E56B08DBB2BC5A637543CF0625526A1F32AC28D3A727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 3a5742b6def8b6fa826a5161f0cdc3941789641216192f9cfce26304ac0c3d6a
- MD5 8314b76ec01dd5e49b860366f8c3736a
- SHA1 9235a99d73089daa3b54a324acfe2292290bef00
- SHA512 a29c570a9ae4ba9355836583d48a5f9d74242ecccfbec1d90be8ad98990a2e31dd7ecb5fc4b004eb7c7e5d3a4e0e8b89273909667d91a309b4ca49a261540713
- SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:pQRQyi36YOcPQLvw2gAf+PN3qfb9s
- TLSH T1CC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 023219d2abe62636f6930f6bbba87a6e4ad35d86e9c4810dec8b55b0f1c87124
- MD5 c6445aee39dfbec2646b1224997c7432
- SHA1 fb645dffa4590e83cd2890135ed8a14511a3f09b
- SHA512 f803317ecd344e58e1f4b20dbc2e981e5254053cb50d3cebc14e01a6c40733ae0101d6aadf3f1fcf41e862bc8fb95cffa6fac67b3f5d46a579326e849573d1d2
- SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:pQRQyi36YOcPQLvw2gAf+PN3qfb9s
- TLSH T176666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4aa6c537e3acf725279029e1cfada310b93847d0584e4f103f98aec7b01b4df9
- MD5 e9307c0b0b5b56659def710282abbb14
- SHA1 de8c7b391dc0f18b5224c3055f66154589b64932
- SHA512 5c6b1e84362d6fe786457ed47f9c1205fd8f56494b67fa6037fcfe657a6578848cb19cba265c626a84061fb9091f5309caae286ee614749bffb78ae7c258b7c1
- SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0wUeA9n/TM4NZYeq:868Qg55nhheWu7PNU3/zA9n/TDbXNKd
- TLSH T1E5B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 b16781b6e58c590bfd86545b00a9081043b29dcffc8dea4299c910436cde9f96
- MD5 b3f633bb9ac77ae082016b2d466ecd7a
- SHA1 1752e24e9debaa29f42f39fdffd0cd260fa42744
- SHA512 9b3729663b8ab17dbfbeffa3d0144a51177cecdae4982eae9a6e5f68e70aa2dea90e367fd9a9364d5e3aad861c99998711b83778b7ee02d7ebfba7aff453252a
- SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99h:6y5112gYy5azzVvL69nLKnhZnfb9s
- TLSH T10E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a9a05c2c80f6aeeee2f1d4f3b0d82bdb599127be95a6613b47490139a72a0bd8
- MD5 159b1147d1085c36f4884efe75317e71
- SHA1 3c676b71e5cd0a2e1aedb0dc0d331f0f4c9badbe
- SHA512 19ae1ed1edeed201627a324b8dd04afcf5054dcdfa9210557da0adf1d502135b1fd80e0b0cc1a4b4ef8feb66a1c566d9188ceae94974606d4da0b6cb095fcb8a
- SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpA9n/TDbXNKd:Tu6JmVxd2dCfb9s
- TLSH T101D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f32c3897a19b41242c6f27b9462f054c445c273d79fd15d24a120852d4544d66
- MD5 894e5f1cb192ac306a810f25d9596e77
- SHA1 3e3a6218a4e65484ada4a84c4886c025faa60be8
- SHA512 c79f130926d6e2739db32d1e5310965f07104ece395e9b172eff8f63e70b003b337420ba05bfa93e816f56c4062151c8c67f0b2e1b6a3d49c2653b90c2292610
- SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xVA9n/TDbXNKd:ymifPbRRfb9s
- TLSH T1C7B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 61088d50586103c87d17373c976f1b1c33ba3f83407669e360a05a4d78460696
- MD5 090c438672efae68626598fa98d4b1de
- SHA1 4c7b593b25057b5add8d0f9a02fe1aad6fda3592
- SHA512 7c42abfed301b76a54954c6692f1e8123872b83f47c67f392719a81d0ad2a33900c08bbee456a989f214df623ca4038787c88e85782b8637c8553a7390379305
- SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqCA9n/TDbXNKd:45dKTi61Dfb9s
- TLSH T187C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 d677af27d1e198c0a89f2328034c19f1d30e518e401847e832d871d64461dc5d
- MD5 df4bb81a2d11ca03b3c7f94ff2b99f97
- SHA1 03fcfdd63ce76e1cffa5512c4a7d1b6aaebea34a
- SHA512 b4036a2080ea81e69cc24cc3cbb80faa503562dfa5eab52118735a851528bc5c6283675810a4fb1366380b4f8825a903c04816bee97ecb8e6057973816f7463f
- SSDEEP 49152:fhtSn8EApI0figngiDn0AP5w5A9n/TDbXNKd:OX2iyphlfb9s
- TLSH T1FB95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 485b5ac105cfcf1922b8f5ef3032e05442aa2743dea4ec5351e532aa218d87b0
- MD5 db626bbfa94f73bf22dc9c6c6a6964ae
- SHA1 83420392118006905aa275bce4cf48447fd39591
- SHA512 67c90356ac6f7a87aec889f24a0927d06f27b3ea5db19246e606efb9ae1b75ce5bbf2b29617cbf8c5b3744898e4861dda250bdc03713532acf21a0f1534b79dc
- SSDEEP 12288:okBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:okUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1516523824BFC09F5C7490AB580A67B0CCD92BE4FF68543AE471E722A5F385C6C9564CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 99038aa9e9585923667d637c1e26caa1890e75434c5a18490e0f47ee743195e6
- MD5 c7003dc247077afe45e62ce3220d2c73
- SHA1 95738ad0892d9f2d0c65339e8bf0435b7c8500f2
- SHA512 0a04c332dd27f6a02c98506ee9074af87f9cf0bd7ec73982311593233cc45fd3ac7ad76ca90e1066456456154f65068b9d74ae4459ec2c92b45be7b86a9a4762
- SSDEEP 12288:UjBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:UjUeA9n/TM4NZYeNm+9MhUwd
- TLSH T16E6523824FFC09F5C7490AB581A6BB0CCD91BE4FF68543AE470D712A5F385D6C91688E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 8894a1a8b60721122962c93f75b17340e35a2e5636e8b7766a86b48770fc2205
- MD5 d1378d66a871c141b21fb02ba0e8d1c0
- SHA1 ebb2cfc6c1c829055aacd8407e602b020775e75a
- SHA512 888d5e419d85212b71783f56100c9b05783ba44f2fff34e10d0507ebf1417f5d7cdfc2899fc793ab2e32a193a9e9598556932020829cee05b455d4712506915f
- SSDEEP 12288:5RBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dH:5RUeA9n/TM4NZYeNm+9MhUwd
- TLSH T19A6523824BFC09F5C7490AB581A67B0CCDA2BE4FF68543AE470E712A5F385C6C9564CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 3a55b2b92ab4ce81d6b851196a5b13cf95fc903ee642c06441644ce6eee86c55
- MD5 7a5dabdff9dd470a4cc03738d93786c6
- SHA1 144b0c2e326c070dea05b0265b39189bafdbcd6d
- SHA512 928065186a1b1dfc139b2c85be9244b5f216bd393c42289b807d89cf1b16bcc29dbe7f1ce8df87a3e74395e83e1bb2f2d22a25d92931abf099767e6d9e5cecfe
- SSDEEP 12288:FV6BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:6UeA9n/TM4NZYeNm+9MhUwd
- TLSH T1136523821BFC04F1CB4A9675C4A6AB08DAB2BD4EE76183DF4705361A0F302C5CD35A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 b1ec8cc2b0a71e5a83ee7e830d62388cd731f8b53da934cc39822bb40bff4b00
- MD5 1924b3f5d38fd0836355bb62b1e4d62a
- SHA1 85aeb7c137c1f73f48b9899c817c40bcf8019f99
- SHA512 18f4ee9275c431320dfbb3950e51e13682eab26d240b497837f32ced691721b3ff385d500bfa86829f6eb6e38390d2fd4458b62e19a12392731243e9270dbd9e
- SSDEEP 12288:myBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dr:myUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1B86523824BFC09F5C7490AB580A67B0CCDA2BE4FF68543AE470E712A5F385C6C9564CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 f4a2f7188f62613f6051c4e6dd9fb2ae07c81f0dffde1606d034395ff5bf46dd
- MD5 78b08bc07290d3373ff43a848c0df1b2
- SHA1 dce8e7c1d5937fa4c027a7490dd49221f4e28a6d
- SHA512 16d9ee35103710c8bdd453a72be1507424b8ba01d4eaeea3d3c7b0f01aad0e7171a5a5e6b000902021caf56b883ae2b2d02e11f2610b68b6fd42605a012fa5e3
- SSDEEP 12288:yXBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dS:yXUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1C66523824BFC09F5C74A0AB581A6BB0CCD91BE4FF68543AE470E712A5F385C6C9164CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 2.2MB
- SHA256 bf71bf981e821de296673af75b7a869a1ff27f4c11850ee205e17766fa9e8c87
- MD5 bdcd4069a16250ade24c719eb2f86e72
- SHA1 2fca6debcf686417b9685f232701cfe257295237
- SHA512 85cb001ead2006bff26ee08a152ab40d7298576c963a6e283f4702dd78ccfa07a9c211fccdddfe04a11973a1544be97505a041e3aea70fa1405f3abdc55fb1ca
- SSDEEP 49152:3P4m4IpOO67/8KoA9n/TDbXNKdAslFyKTmCDu+:1ppOOinfb9sAamC
- TLSH T1ACB5D02DABEC0096D1BA913485658A49FAB1742E2F3286CF1160933C3F77EE54E35F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 2444a8331cf46bd6d232747094a5af733b57434bea6dacb3d386f62ae836290f
- MD5 29e60658232835a6eb29ebb3a200c9ad
- SHA1 0046eb5c4178f5b564d6aa57a4de1b13963a4f53
- SHA512 3d3affdc48450cb5cda639d052ed4b32f30184f7f26f7e1a82c17a639e4a0aea663994de15b5f5ab838f7886a95ba5e9703bc8fe7d8c6944ae17bdd7176d7174
- SSDEEP 12288:5zsfABqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d9:AAUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1C975F04AC2A802E8C16E6279C7565A04F7737C2993E1D3CB43C0F53E1F366909DEAA47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 9a98fbf573e324aa57fc1d2e06c4fffc858a9d28f99fbe1d8142729eadce057b
- MD5 87e74250b3325959783f2288d536267a
- SHA1 f2aeb15dde50382e21b43a860f5684f38d61ff01
- SHA512 6538b89a88d2feefdd3b9d2b57de90750676dc7687c6556dfa38b89c6c99197e1a2009ebe7678ca534cb276c0efab53ac2200bde618bfcaa6b4c0397a4391143
- SSDEEP 12288:hgBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:hgUeA9n/TM4NZYeNm+9MhUwd
- TLSH T11C6523824BFC0DB6C79E1B7044A6AB0C9D66BE1EEB4483DF860972295E345D2CD3644F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 b4b7007383604bfa78f6b56802dc7173b15ede38227d426fe73d3c633143ee05
- MD5 0c15ddb0b0b3d3a9d3ac5c41618eb2ba
- SHA1 f6026fe967e2ccdc8a3766c11034ba615b6f83ff
- SHA512 d742a8619dbe4a1c199852410afc0c07e15f78d1cdbf140c8b7135d5e41200e5faf3f5957a3fad6a2e1f88703349a9798aeb58416d59814412418579dc5e0e61
- SSDEEP 49152:Da0h2GEkuAe73q3pp46zwwQsA9n/TDbXNKd:Da0hNYG4JwQfb9s
- TLSH T1CF85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 588dfc0a58c6e67430aa8951927a61de585a68709d8fb484fb56d15bc0f43e1f
- MD5 2fc46a16ec6a234142532e6413248433
- SHA1 42077af9c29539a96ad01a489688dc9b810c5fa3
- SHA512 7801fcf97857c7079cde3b2acaef0a43682998077b33253cf129e67dc469d272cb43f6d3e1a16585788662ebe296d91cd2d25fcd37cc0cc43dfd3d4f63089717
- SSDEEP 12288:1hbHjfXTBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dw:1hbHjPTUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1EB7512AE17FC00E5D276A27D85969609C771BC1A271193EF0385923E4F3BED58C36E82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 87ad80badaa201e82d20a94fa225df978f1dbc7c179ddc6669c9eb6d0dcf8a8f
- MD5 fa27b21cf93a35f24011ae431392d771
- SHA1 ce82289e02a897875628c85366b83b329929a4af
- SHA512 51b3f690f75b4f2efcb3b2ae4604a73b7182bb0ebe2114f04d0702a066309a3446b1f2e04fd227956b25c722829056146e9df51f15244a5e524c4b38eb75a646
- SSDEEP 24576:+3YgnJcRTk4yti+R5dpR/LUeA9n/TM4NZYeNm+9MhUwd:+IgnaTk46ppR/PA9n/TDbXNKd
- TLSH T1D445AF2DF2B910B9C8AAD136450147B5FB71782D1F209ACB0174C538AF1AEE89E35F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 de0bfeb9e042e3659d1c4a8e37c696f5672a8d9cb37b0bf0369af01de5fe275f
- MD5 deeef3fd3ae87028f0508b7fae83a1fb
- SHA1 9ba30f5d9105b7663aa47cc1cde6f80b20fb0059
- SHA512 4d6efa6e6fb9736484a3014485adaa2f6dd5e1a57159bd5ac57ec6270ca031b563fb58df1dc3e8cd211d7c2454aaaed51a61ec8083a827256b732a2e4ada73da
- SSDEEP 24576:0tL3UTwUTDWG6goHD2LwyKTPxEDev7uvx7S7CUeA9n/TM4NZYeNm+9MhUwd:0tL3UVslFyKTmCDu+IA9n/TDbXNKd
- TLSH T1FB851251E7F804F9D96B823CC8A2861AD6B2B85E13A4E7DF03AD0B151F136E14E3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 0ffecc601f47ec9984c116de7c8af626f7723cc735c234864d408c0b67d6dc91
- MD5 51b8614afd6ea9f141a8fc88a93d7e2c
- SHA1 0bf9548846d63eb820a1df44c6fde742631e0b58
- SHA512 9a3597e404fbfc756fba782f6575514b1b0457f541145d5dc47273a2126f606ae7289182872756eb07e1d470a801d7e8b1d22d38cbd9c5d1b36d222b2bdb526c
- SSDEEP 12288:jpFtfOJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2:JOJUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1F075025A37EC00F5C26A623D8992930CD772BC5A571253EF0290917E1F37FE89C3AA56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ff6abf0817f7674d07ac7e7babfabd4c2f223b5b334dcf6139c7acc3d423f3cd
- MD5 80249670a31da5bac71fb5ee696fb2dc
- SHA1 88c0f4ec508ea106a815b1390d6e00baa776b9de
- SHA512 9d20eb123c2681c81d45d9419c7576fc96fc03eaab7fb64ca0c22ef76c85c6c45a0a9bc43c57024c84b8170aff362e5706c76d65ea6fa958d121d1903e73691c
- SSDEEP 24576:L7NM9YmZqmWMUkPjZM48Mv6bEhsQUeA9n/TM4NZYeNm+9MhUwd:L7cBWMpPjN8DbEh3A9n/TDbXNKd
- TLSH T11A659E2E6BEC81E5C577D13DC9A28205F6B2B8651B318ACF1152833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f6ad6e00776dc958b4c843da7fb37e73d13caf7b4decea27ac271cc28b4df259
- MD5 0ce86c4625cc79635ef74bcc3e3c4dc2
- SHA1 c53b4bce386475ce6b1ed6caef06bba81035d807
- SHA512 3501d5d2deb113069419c0ff3a117862077017420d2c7373421b95dd72b352969fd55f14bfcac85feced94f510ef2615443606006e052b84a71a8dc91bb1abb4
- SSDEEP 24576:mW6BApg2YuyuNDYTabvcRvNYf8km1GUeA9n/TM4NZYeNm+9MhUwd:mF2YuHNETovcvNYf8kmyA9n/TDbXNKd
- TLSH T17E858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 2.5MB
- SHA256 89fe3616e59ea3ea5b81993bdea48de9f907989c1a13568f7977179b07d98d62
- MD5 fba10314fc1c4cec979bad985f127d3f
- SHA1 cf08da643af790ddc0708d5177cbf57ac0afc14b
- SHA512 7ea5cd23a48a9e36024870c93d12516dea55b61b12ee2877a055d97651a40a47b076bfd518a2ce76fe023b4a495f9479b4bbf58048c29b3fdc00bab379fdd2d8
- SSDEEP 49152:mF2YuHNETovcvNYf8kmyA9n/TDbXNKdxslFyKTmCDu+:n6tCf8kWfb9sxamC
- TLSH T11CC5B06927EC80A4E0BBD27D85F6D246FAB2B8551B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 51e4fc5c77ce201b5740b25b58fc55ea195768338a8a7ddd925e9fe378b743d9
- MD5 87c10fb00d0e622d4a66772e2d2d495a
- SHA1 a44c9925c424ff6081122056e5433664f46def51
- SHA512 6786362dd23a605e1d421e08ddb97a5cdc66ffb97a04ae1f603a9254e89e96a88280c701c8dd764506f078ad661f4a44b463dca98b3436a6396fdb3fdc7852d4
- SSDEEP 24576:bAFs06+Omlf3NXEbTolUeA9n/TM4NZYeNm+9MhUwd:UFs060lVXuMA9n/TDbXNKd
- TLSH T17365BF2F62EC00D5D07ED17D8997C91AF6B1786707215ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 240bf297d22ba365617c6a5adef51fb3cc4226516f705944b3ead22b2a7d9549
- MD5 2c4abc468ec9216faca2dfb4e0520f2b
- SHA1 f617ce9532ec183b4c00ca70cfacade67ae45416
- SHA512 2a0399d086e0c9c96c160d7972884940b57f7de64bf80e04c4835c85c8621893f4ab8cb15a0c45d6fbafc6e73be4c3d3f4a8bb197e0875b701eeea792e0d53e1
- SSDEEP 49152:DJnJ5DGS8lslFyKTmCDu+IA9n/TDbXNKd:ulamClfb9s
- TLSH T1DD75022DC2A810F9D4B7C274819A5759FF71382E2B226ACB14B8D5353F12EE09D79F09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 af4ec210d31c43001628ff035845e99f9d9f3c88733909971dbda3609d0916b5
- MD5 6db1a8aa914f78c038b8c09957f112c0
- SHA1 569ed446f0a5d83b48840363932d8c8817ca1ebb
- SHA512 263bedd126f405a1aace246c659e0940f4f6bb7f1d69c82ba2231713007a2a9a9a16e076c2ffecc9f41a5248108f73192103a745caf023b7ed2afca4a0619175
- SSDEEP 49152:Ro06DIKdwc+eQnSt65aVGA9n/TDbXNKd:G1fb9s
- TLSH T122956C06B7EA5294E9B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 0cf482a90e4c6612c629cbf8fbb2aed84453645d4e81aefc4d40709ce226bf6c
- MD5 06e779644ac3d0cba0823546e576efb0
- SHA1 53653ca30b049d245b6d8d1684337ad726079b6d
- SHA512 c3eb666a18d1740bdecf3d326c79863b069a29ae61492481137ef0a338928861c87615c6eb6668b3a3ad49e7258fec20448966504a05c7e77237e94eaba944e2
- SSDEEP 12288:3EP3RBOBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:8BOUeA9n/TM4NZYeNm+9MhUwd
- TLSH T18A75129E2BFC10F5C22A917D81918708C7B2F869675217EF0291D23E4F37AEA5D3DA41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 8c0289be04854c2a967fc98977f562da56f8599d49d46e5233ba29d603f32831
- MD5 68746d62ad31cb1c7cb7645881296a67
- SHA1 efc236ee92d75ab76e40d477b3a8bf3ffc5689d4
- SHA512 3d74051aec44165db8bd78a2114fa559fbc589f449d5bafb961aad44aa6d02bb0297233c0f0203e1f9a49908ac5e14e0d6551935529e6cb3de593a31f2cfbebe
- SSDEEP 12288:djkyjBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d5:dIyjUeA9n/TM4NZYeNm+9MhUwd
- TLSH T18775124553EC44E4C7AA067889B39348CE71BC25AB2183EF4180F63E6F36BD59D35B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 a50d72974cc1c90824448a06bd3d5b91210039f23c3d35e864b9b5f98acf03c4
- MD5 5797a051e4b4cb16c9ef966bcb228490
- SHA1 1e8614af0ff81e69809bb36b769a971e6ff5f1ca
- SHA512 5a77ec9c6aad4e8bd0451d09de3bdab777016dd2181e2b7ceddeeca704c2110a2cd4432f25c1b5527a473d9a7cb6b036a8d9b00cc963ece4353021cbc9e4a076
- SSDEEP 12288:erZBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dY:CZUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1D865238A0BFC08F5CB4A06B541666F08C961BD1EB75553FF0299B23A8F355C6C936C8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 2.0MB
- SHA256 d10bf2bfaccf28db1ac07020fd68437465d811639a8e198b2324a36cd6e3cb5d
- MD5 409b73a9b9ae8eaef3e8d9322fe2badc
- SHA1 49746ca1aec551d0235217028eb21deb5007683f
- SHA512 41bdbc8dc1a17525ab1ad22c1efecd065aabdb5e8ec8853bcec6f60a42e9c503d0eacf20a90163d02a443ef501549e64f9360001935657b530bada9c62f63262
- SSDEEP 24576:PQ9MxZKdcz9ew3rUTDWG6goHD2LwyKTPxEDev7uvx7S7CUeA9n/TM4NZYeNm+9M3:PVKO0slFyKTmCDu+IA9n/TDbXNKd
- TLSH T1E8A5CF2DABF9099AE177C23594A250C3A673B4311B35C6CF2448D13D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 7483544fee9173fde6bffe3d802a1bdd8741940be62f49f2212ed81629d8ef09
- MD5 24e8c346cca7b2b356bfe555ec4f4cef
- SHA1 4aeffef79fda8d877e3d0bc58a08c94ede991d4d
- SHA512 39f0678a487cff550dd461ed36637a53003ebd5adafb7951b1c5477c55534b0926c1de2ac38cb3e394d5f99e0e31d653cae92e4d13edb25046c6dc4d6e5bbcda
- SSDEEP 12288:9yoKo2hRple9pPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:9yocbApPUeA9n/TM4NZYeNm+9MhUwd
- TLSH T1E585E04FBBAD40E2D166813C89858704EBB3B4346B6253DB5691C33D4F27AE9BD34B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 c5a0ca71d85d65e8614fcd30d0cbc6c69cdb305f604fff60fd43914e79333879
- MD5 207667a35b5d581a0986ede94bd01b7b
- SHA1 bbd694ad0d37863f7a1781120252c7f9e7108b82
- SHA512 33b1dc734573dfe555536067c3bc8f071ef27ba431bdefc7f31c1f70fe0e645484121099a0eb31b30f080e6f8e9cf5c459bd68e8bd375792561ec28f35719976
- SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKDA9n/TDbXNKd:L0zuNIcfb9s
- TLSH T186A57B3DA2BC00A8D9AAC375C5461365EA71742E3F2055DB01B0C57CBF2AEF19A38F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.5MB
- SHA256 1bf4b56f780932cba8866dd11d69c81edb378b7c9fff813b40da8f60bdee0206
- MD5 17de70924efb23bee6ec9356ba36bd3e
- SHA1 3c9da921b99f5be75a48cbb419ebf381b267f3c5
- SHA512 cfc23c2d317765c6de2296e746569e7999477d588d81bcf0dbc5360bb49ce6ad2e3b21def71155be5fbfe47d5d9c5fd7aa74e2cdd746e2a61319c9ecbdcb892a
- SSDEEP 49152:Da0h2GEkuAe73q3ppj6zwwQsA9n/TDbXNKdislFyKTmCDu+:Da0hNYGjJwQfb9siamC
- TLSH T104C5D01E67EC82B5D0BAD278C9A6814AE6B2B4261B3157CF0151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 2.0MB
- SHA256 dce3b39419b3d299ea618664b9a973c079e73ee063c0e9c010c0ae4bc13a9d81
- MD5 cb7a517bf00fc3a826ccd1c9c3295dfb
- SHA1 38c35c55150b77b8b149ab1afc3a3eca1346c8f5
- SHA512 e152a3250903826ce8d71a0aa6987e7a512a8b81d122826efba20b48acb4a3af548d55e18e3b5b10a197a761f69efdc88f43c16334b67eec447441efcf57016e
- SSDEEP 49152:3TDxR+N5YzTljM1A9n/TDbXNKdgslFyKTmCDu+:nu56fb9sgamC
- TLSH T1C5A5E12EA7F805E9D1BE85799A23C516FA727811133193CF43A0C13E1E2B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 157611fb5521143fdf8482ac33b223034730570429963a06cdc4f7fe851c67ae
- MD5 77a688770eb8718de52ec0694cf1ce3d
- SHA1 b0af1ec18d713a4b9cfd3c35aa47723cf09640c3
- SHA512 be04beeb64d291f8ac511d8874da5aa0b110baeac087cfbd11f61420f0d1a19edecb9b14827449ce7b84f1daa6dbcb56d67f7a3274fd643a5749e1c7d1d03795
- SSDEEP 49152:40K+pmSLZslFyKTmCDu+IA9n/TDbXNKd:NpamClfb9s
- TLSH T17D75127E53BD04F5E57BC27CD6438A0AE67238661321A7DB06A081792F5BED43D3AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\4bb05179288da564.bin
- Size 12KB
- SHA256 b23180b26a92babbeb4381bd45b09e856e9201b1c32be41b1e9b14a98d10781f
- MD5 a2feaa375c24da7fb426028299118f15
- SHA1 917872178e1077447093a123ebd43226d74ef6bc
- SHA512 349ca8b205d7f9519411d7605788d1bb8654a6aec20dd241e6f580b842b198c416df23164311dc4ebac8d09408a9455a1aceca5c85143d9206af0db3a276d643
- SSDEEP 192:n0bZ0dG4fTlA5awGyM/RKBqOdr/sJeqjO8eqHtQnDHpLN/kBIJJOQboOMgizy:WZ0dG4K4wGyFkO1QtTNenXkB8CiiW
- TLSH T19842CFC48E501E7DF2BBE0B3AF62397545AD8F48B224444289667826562D78C2E03EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\fxssvc.exe
- Size 1.9MB
- SHA256 44dbb6d93ee2f78cebd312dcaf5c2446d712bf3a9ec05e2c7b942fbbab3f6141
- MD5 30140a5648117884442cd03611cf827f
- SHA1 56bcd1d59b7e8a4152bf1cdd2d04b350fac6d2d6
- SHA512 f40f5afcf4ab1dbd55c212fa1b7dd931101fc57c62d38d2f18803dd5d35df69a1371fb8b3d7b3c1dc1f5728b6a94af0daa85d62ae50425f52f88e40b2babf8ed
- SSDEEP 49152:6+gnaTk46pqR/PA9n/TDbXNKdEslFyKTmCDu+:6l9fb9sEamC
- TLSH T11395E12DF2B910B9C4AAD236854143B5FB71782E1F2097CB0174C638AF1AED85E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\locator.exe
- Size 1.3MB
- SHA256 275b3a172aed55fd87d480724477ee4d11134f262e21d87ff858fdd8ebed0338
- MD5 75b950b37cabfaf16762031142788d7b
- SHA1 36a411cc370c06ffc5bd277333a9cc8c4677f2ff
- SHA512 5d0d5247b405ee7a7cf578a4717a0e20b11e4cd4a473217bc5a2d7a20e8d013dfedd690e1839a9147fbc6b8ffa3af7c08cfb3bf220cbe6ae1f9e435c19aa5bdd
- SSDEEP 24576:KcUTDWG6goHD2LwyKTPxEDev7uvx7S7CUeA9n/TM4NZYeNm+9MhUwd:KNslFyKTmCDu+IA9n/TDbXNKd
- TLSH T10B5533E247BD08F6C79A0739E4D0931CDAB07E0F71D983EB47AE33196E248955D2918E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 2.2MB
- SHA256 8737c1a6a010eb8f024eb718b67b691e2b16c30af51a344069c2f30698813319
- MD5 2d1f9d466a79a0161fdbe4ba92d8b756
- SHA1 de96bb28d8140e2573bb9498754193e2bb6895d4
- SHA512 0f7293143a9035544202c8982d700a63a8f358eca8def1e657aa12dffb2b2416088600afb44f718b65064bca478048ccf64f20645a8cb1221fef92bef283950f
- SSDEEP 24576:I9UeA9n/TM4NZYeNm+9MhUwdgwUTDWG6goHD2LwyKTPxEDev7uvx7S7:I5A9n/TDbXNKdgpslFyKTmCDu+
- TLSH T1E6B5239907FC24F6D6A60239D9A1820CC6B0BC2B339593FF06E9673A5F359C48D39746
- MD5 SHA1 SHA512 SSDEEP TLSH