Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/10/2026, 16:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe
- Size 2.8MB
- Sample261023-th4cwaez2j
- SHA256 036dfd78ff26d5a8f070f5a4730740a9c26649e0b5aa251d905208e754ec0a3c
- MD5 e38a19f5a8f143695e9d0a0c3f7edb91
- SHA1 b9a74a6a8717a26fe2eab221c7e88db4c4cc9cc1
- SHA512 b5f0fce3194e5ab46d29636e6b43375c43f141b1ccd9a8d7798216f3476ff38d57ff4c8e9ffb4df23dadfaa996e9bf53e0ac4589bd2f561fb28be67f83888ad8
- SSDEEP 49152:VA6TJHeYhORXVKHuPlk8OsEqYQVrarSj8RoTCCHDmg27RnWGj:tebRXSQlBRJTbD527BWG
- TLSH T1E9D5BF4773E801E8E0BBD278DE67950EEA7278460B3497CF06904A5A1F63BE14E7D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2516 alg.exe 4636 DiagnosticsHub.StandardCollector.Service.exe 4232 fxssvc.exe 2804 elevation_service.exe 3780 elevation_service.exe 1760 maintenanceservice.exe 2880 msdtc.exe 4692 OSE.EXE 3472 PerceptionSimulationService.exe 540 perfhost.exe 932 locator.exe 1320 SensorDataService.exe 2896 snmptrap.exe 2852 spectrum.exe 3940 ssh-agent.exe 3144 TieringEngineService.exe 4212 AgentService.exe 4652 vds.exe 2460 vssvc.exe 2956 wbengine.exe 2256 WmiApSrv.exe 736 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a6a911c6c665fbf6.bin alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c77ef33a0863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a838f03b0863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d94c83a0863dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3f0653b0863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e45d93a0863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df289f3b0863dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049fdf43b0863dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014a7fa3a0863dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044cc203b0863dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd87df3b0863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049cd013b0863dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4636 DiagnosticsHub.StandardCollector.Service.exe 4636 DiagnosticsHub.StandardCollector.Service.exe 4636 DiagnosticsHub.StandardCollector.Service.exe 4636 DiagnosticsHub.StandardCollector.Service.exe 4636 DiagnosticsHub.StandardCollector.Service.exe 4636 DiagnosticsHub.StandardCollector.Service.exe 4636 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4708 2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe Token: SeAuditPrivilege 4232 fxssvc.exe Token: SeRestorePrivilege 3144 TieringEngineService.exe Token: SeManageVolumePrivilege 3144 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4212 AgentService.exe Token: SeBackupPrivilege 2460 vssvc.exe Token: SeRestorePrivilege 2460 vssvc.exe Token: SeAuditPrivilege 2460 vssvc.exe Token: SeBackupPrivilege 2956 wbengine.exe Token: SeRestorePrivilege 2956 wbengine.exe Token: SeSecurityPrivilege 2956 wbengine.exe Token: 33 736 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 736 SearchIndexer.exe Token: SeDebugPrivilege 2516 alg.exe Token: SeDebugPrivilege 2516 alg.exe Token: SeDebugPrivilege 2516 alg.exe Token: SeDebugPrivilege 4636 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 736 wrote to memory of 4184 736 SearchIndexer.exe 111 PID 736 wrote to memory of 3560 736 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2272
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2804
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3780
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1760
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2880
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4692
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3472
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:540
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:932
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1320
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2896
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2852
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3940
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4376
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4652
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2256
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4184
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:3560
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 6151a0ebd4874af5e6c4be2477d105e3c40ed225894be3ff5975da2013f1673b
- MD5 6de0ae357c12724136909b84893ff0e4
- SHA1 0afc071ac5b13d9e54358aebd0a2137a22471664
- SHA512 5020a5c3d1e2d69f762f625b6f37c7bb7b6fb89969e908e76efce67c0d49a76fe7ea8c87d26ba9e5d8e36b20e55bed856019397ca766308f24776f46e47b99d4
- SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmDmg27RnWGj:g3q6HjBxD527BWG
- TLSH T122D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 636e49d23a5fa1f454c86c721e06fcaa9332b9716d75442c763ddfee893dca76
- MD5 afa5187654e69d863bbe3652777e5e65
- SHA1 da22980fbab379e6c7193902de6abb151b88bce0
- SHA512 d405ec3c25a7aee3b9c70562369f6321f1d41dc8c65a26f5a8b7a3729f8dda7b14456ff36fc2c57b336f02013c4b4175f7348a86486fabdca6112eaa5326ba2a
- SSDEEP 24576:nXYfDtczAJsqjnhMgeiCl7G0nehbGZpbD:ytcQDmg27RnWGj
- TLSH T165850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 10fa9fadf3aaef5b9ed3f308d64a732745776ab5479a26a15419f841099aff6b
- MD5 15ad115a161f16623a2be15732f6d9f6
- SHA1 7385e8e18b83199033f9faa594974463cd47a1d8
- SHA512 ac09f9a3ace5d52948f3103da5d00d8e99aee167d6ba5ffc313f936086d4f40438f49286794ba776864d003ebbe2fe624ec427fdc1a53618d0f4c8a01b97aca6
- SSDEEP 24576:V0Le5ji0hmxYrMqsqjnhMgeiCl7G0nehbGZpbD:VPji0A27Dmg27RnWGj
- TLSH T133959E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b06f3fe326932d73278edc44c17d0d04215a6d44542eeb41e3fe30538d47b9bf
- MD5 38f8606b4c927eb94f8e4c4b145f4fa8
- SHA1 67ab6298cbeb6903993cb7eb9a659176c23a821a
- SHA512 89abf9a469372d51407caf9849cd3261b0e2edc48c19711cb7c678eee5237a6a12ee2d150d2310ea3f4ea59eee0b9c1f46d571c00ca8cf86f5dbd8f6b1fce823
- SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuksqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPvxHjynDmg27RnWGj
- TLSH T14E755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 197cab26762cbf6248b96f154e5adf5b85a1bd3041ec953092b269e724e2828e
- MD5 0e0d471d298742baf9137c84c21dd060
- SHA1 fc52237a6f21c22fe9d13a6383550c9b99d419b4
- SHA512 a633b6ce65bb391dac5d218c58a00fab776d2d993564a5c81cf5d799d1e5ccba068d02cf7027bfc1a563fe0528b5e63df5673c9ed24cd7efb6f42019237e5acc
- SSDEEP 24576:wVbqPb88hv/l+69sqjnhMgeiCl7G0nehbGZpbD:wVO88hXl+qDmg27RnWGj
- TLSH T1F1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 9a37e1d18b0908b40432e9febc20c822169ba80f8ef76fe3dd089c5183a52dfe
- MD5 6899bcd44436785f8dd2c75cfa4860bc
- SHA1 5fc2c40330db757605e635b9ebd03bd893271d4c
- SHA512 31a2e7c8c1177e8621558b19fd0e17f8ddf6f6753cacc8ec321850ca43713e399351abf4af278005a609c939ea11695776da41d29fe29d8e237146f258e88b3e
- SSDEEP 12288:uHeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uHesqjnhMgeiCl7G0nehbGZpbD
- TLSH T1256523BE834C10CAEA7B09B5C3E9F15EAC177D56D82008526AA37CFEE5B5454CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 9d392337e70bef3e43ad55fd04773e06ef62ab2be428073de5e66e8bb683b85d
- MD5 0852220be9819b9c343773fd94522d77
- SHA1 7070bd735e8b17481aee30ac2651ebf590121129
- SHA512 92df83a0030caa85f39c33dd694649d59ac538b13ae1ef8ce1000c48bedb65bb4fe5d4479d5da18881a5897e8e583a16182774e64fd3e00666fb09e01886e1dd
- SSDEEP 12288:jeBNUbTVO86UlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:jJIUlsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10985CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 87005252268d2b0d5b6ae593b0d30bb33e67d88c22bc9fedabad1e88e46c66ae
- MD5 a05b3ce1cb383d3649371de7b70995c0
- SHA1 8e1b111e653e68cba111f2eda00bb00c1094aef3
- SHA512 8cb8b070b9c74de1c37f1616cb760a7077934ad2e1aa9f41b522c4bc7975093fdc54e1db3b1a0b7aacebc21bd9a1717d437eb75ae28054515bc87ce2e79b7299
- SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:yQvGAdlCEL8c/yRNw5CwD527BWG
- TLSH T1E5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 048cd3cd684a7c32ffe071075de6d66aaf475dba850942cd64a56688d0845519
- MD5 d2b4cba7833ba5b4831efdd6e29b31c4
- SHA1 2b8019f58bccb62a3e5ea07b572d95d17ecb25ce
- SHA512 2bec41d95ebf1521d2f6875539015eda2a8607cfa474e90769ac46527e03600427e6759e6f57f7fb503d3d5f53e189021432feeff828f7c84292d7e8ccda8487
- SSDEEP 12288:iAwSfxL/2Dc3SDLLmt0LDQewsAjXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:n7ewsAjXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19685E031FA74E036C27F0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 14b0c74267b67d7e64ee356ceecb676763018d26a62e2e644ffe6a2739d129a9
- MD5 477e91c69d0ade2fb9e01b9a2d047d8b
- SHA1 ad97cfc6a6a5a0a2494ce9f52149a96be1cb38ca
- SHA512 c4038988c6b1154d53c646235364e72c9a44e6bd49996037397eda34fc2c37d0f043e926de41306370cc1c3a17f7cbac04ae90a69435bf2571f297c8d75abefe
- SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzVQBWG:1UEtQevvqc2W1cpV2EI32qB
- TLSH T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 138358712963316cd23131bae8f2fbede184592d96e9518f1c21a87539d08f98
- MD5 221eacc489dfa200b5d71258be03dbe6
- SHA1 c748091a5a77e62adc66ad3250d0a1557893b1b2
- SHA512 c724a9a3ec163404493e556631de3f25fdda6c5f5eba7cdced5cbb38c9740309396d826a21b1c57ae643cdcb5a445315da868f96db0b4eb42a78109ca698203c
- SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zLDmg27RnWGj:MoquVjnmcD527BWG
- TLSH T15DD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 109253b10cb3aed784abd06fcd4465c49b5d3400de07aa0f874c5dade88a8269
- MD5 8807f045ab74567704ac765a2ea030bf
- SHA1 8dd8870126b12e16d9daa1136b869890dc32caf9
- SHA512 4cf631be4c8990f884de8bfc1219c5bcd0bc06968404ed2bf966c45e03efc9d0ce265636bfd2fbfbc1162a5e23e790e29a7bf9a5a60266beb55507f0ee072c1d
- SSDEEP 24576:fAhGLJIFoiwtA5l7S53AsqjnhMgeiCl7G0nehbGZpbD:fAMyFoiq5MDmg27RnWGj
- TLSH T1F6359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 ee2f80fff2fcb77db6107c452b98d151cf992f0fd89a43c74f4ead07c3fa2b29
- MD5 9e3ce999433edd6dae8fda91b459a9c2
- SHA1 0ff926532b77b7c301ec126d83b2c5ab553aa21a
- SHA512 a53b8d7da4520b07fd39c13d5887e841e5ba8421dd9c13567f5d0767a0f0e5e4d9b552c89dccc81fe19d4b201f14b0ecb4c3ba12bf2b91f9e9d0ac63b816f99f
- SSDEEP 12288:gmw5HEjsChNzBFgl0WDm+CEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:9wuSOWDsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18085F14A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 7ddd1fd7e8ae9e8ed9f71d9f0f6fb1afee5e163e84dd85340368c70cdbe049ca
- MD5 90f5c4513b8365c3e845827bad4c631f
- SHA1 9089680eb2798601e0206f93fd1b3d9f533559f3
- SHA512 14e1b64b0bfe71515390daec8534a61f54721fde1b9d3bb6e265d14b4dbb1b41a1ca9ef066fc0dd66263df4298faa9066f2f2ab9fa5138b9aa15be143ac513a2
- SSDEEP 12288:qjZ1IyHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GZuSsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B77512AE239820FAE1A7417CC5E5D609E7337C62673003CF166656AA6F739C44E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 29537240ad98f76677426c78bd9d01c9c2b4d4fb51b923fbeb81f7d2fefa458a
- MD5 7c4cfafd2e831583ae31d7032e4c6826
- SHA1 5cf9442e2fdb3642575b56a3bcc19982a2b3461d
- SHA512 714ea01d20e7cf61a873c884f15ecc7cfe81069178c13cffc9cada9d533aa1238a4e0834ea122a77bdf88f1ca75ef736eecf4cfbafbd1157f11368dfaac7de78
- SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN3FD527BWG:KQyiKayX+PNVVQBWG
- TLSH T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 66902ee17908877ac58cccb353f83ed2e7498eadfdfef4e9918672d0092f75a0
- MD5 0c0cdc9dc07097e6f333ad030f4a1162
- SHA1 9b0ec0cb73008e8290fd5575281f76381b458e11
- SHA512 a545b7304d5e90495a8b75c226b7a3d6e63d329c6d66d6e148e8ae544566be71144104b49c6b5352f6e6518baaa62c3ec2f7528599d8511323cb9da9b7cf18db
- SSDEEP 98304:DQRQyi36YOcPQLvw2gAf+PN3FD527BWG:SQyiKayX+PNVVQBWG
- TLSH T1C7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 42718243732d0d34e5a834b713192084b1f47a6af0a8c4ef9cdbb01fafa6806a
- MD5 a7d438fe0e8fcad02b523e9da37a0f38
- SHA1 0c5c0da1afea37ec84891218735993d6bb60d440
- SHA512 b6475602b4c06e835c7f46d64ea9623f4fc30817f10611f7f5f133bc3ce764e7f585ce7eb3088027eb492d39738ff0a293a7c4b7f778a4a62f4c3d2e9319ea03
- SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0isqjnhMgeiCl7Ge:068Qg55nhheWu7PNU3/7Dmg27RnWGj
- TLSH T12DB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 75b67ad6849972f5306ea75c00e6681d86af781b7ff20f6a2541497c80f978dd
- MD5 7f55e213338644f731bc496279a88b83
- SHA1 b7407df217237ccce7da6d28de98e37c7a0c9948
- SHA512 ba6297ff17c51e656b5234a00dc96fc3e6ea9111d6f7e90e622d26c4644183986ea8c6860644b3aad7cdcb2c6eac5588b89312c911b292a230559b088a80bc21
- SSDEEP 98304:zy5112gYy5azzVvL69nLKnhZyD527BWG:OLIHmWhkVQBWG
- TLSH T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ad6a1d390855f2b43f6f54a1314568f809b129b39a8d0190aed07be88492c606
- MD5 f5d5839147f90b902ce9164145ba58ae
- SHA1 0244885fa296fdb4043b9146d106affeb46fff30
- SHA512 d94c02a95bb84c6e68f9f1879285f850f6b436f986b645570499ceaf6b955e5ea154db82b4fc2070cecb0003b1fd1ec2cec6d35459fe744309e0c5a9e8a811b3
- SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gldDmg27RnWGj:Ru6JmVxd2ddD527BWG
- TLSH T1ACD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 84a6ef5ddf7d2484658ef791189fb660d423eae1f8a4bc51bfc0a53fc68059d6
- MD5 e6348ff2881deda5f7889a135c1edd8b
- SHA1 9582630cee3587541325f4ac04be1fa2319c9114
- SHA512 6af275033bac5e38a78e122f23d6bae1ca593efc19772c3b5f45cc444b8f74d850c93ff677752638f3888cbc4a9e9423207fba88938050928acc32f88377a06f
- SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4x5Dmg27RnWGj:DmifPbRcD527BWG
- TLSH T144B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 904a9e3c5a12cbc2ab4a934bc4eb8e753b4be63a83a877983795d488a161c059
- MD5 e4efad755c1df72f50f093d92b0942e4
- SHA1 099edc73d6180c41378187fa586e7631322e0bda
- SHA512 e05ffac1bfc14653b4e26c8eaa207905a1ded5da0d1cbe6ac7b5422b571f11221872d12b681846f92c08b36111fdbe82ace31f0c6c8597595b85baecf5e9848a
- SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqWDmg27RnWGj:Y5dKTi61WD527BWG
- TLSH T192C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 124205c86373c241e8b883cd0c66c0b7d6dc25d170d9cb70da9145d31deb6101
- MD5 2aa0b2e66e6d655bee0792c31f724b55
- SHA1 77034adffe41ffe80ac5e8860ac5839e9ced949e
- SHA512 8608e80b054dd8f79b89b0b43095d1eb7ecefbae3c4fdcecc814f1de609c83f936064644e5d9ed735aea10d142c2a05831ae529661f365583b2fccf0f6b8a73e
- SSDEEP 49152:shtSn8EApI0figngiDn0AP5wNDmg27RnWGj:NX2iyph4D527BWG
- TLSH T19E95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 652391c2ec4249754fe25cacf5273ea7f050ff0ffed77669b08b56b73ef1b1b3
- MD5 368ecf2b8ea7e399473c2723d5fffbcd
- SHA1 e50b03879c500ba1a07ab76ec29b030358a6e1dd
- SHA512 79a12dfce19f81add3690717a6fa83d1f3c7694e813f4525f66bb3fce12637b3ba959572f7a6f98de2c612a6d12a18f622564d73b94499f3f9e5504490c9f52e
- SSDEEP 12288:imXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:imsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1766523BE964C01CBE52649F5C3E5F14EAC073E5BE92004937A9B78BEF7B14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 fa7c02b5ac540296983ff604946e5b06682b8e2c42f4281c5379d78f175901b6
- MD5 df9202e3e6f2ab67bb2371f2d93ee6e4
- SHA1 fa13d40565a6f826a5e7df772f0ed4cd2360fddb
- SHA512 d6e89799e6023f79bdac4dab83cf379ccad214df608001b51fe8d4d2a514422fa3e16459de10d82b2feffeaa00356704c3f34846c23915d990c338406c0a7ec5
- SSDEEP 12288:hbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hbsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C06523BE964C01CBE52649B5C3E5F14DAC073E5BE92004937A9B78BEF7B18584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 5242727fb197618e2fd9650b658884eeb28dbd1a189d1162ac435dd7a4eaf193
- MD5 ca6aff1d246424e0b26a5c921d353f88
- SHA1 d3fb07f86340a23da78e759bf744808a2e38f7ed
- SHA512 92ae68331fbd31612532f7bbe918e4bafa4d1d8acbe1a4d1a56ef4b20881c5be9aa5b29cf1a19d56954b81ee4f8850fdcb577845b88ffe15b7323656f0f170ae
- SSDEEP 12288:aNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aNsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1CA6523BE924C01CBE52649F5C3E5F14DAC073E57E9200493BA9B78BEF7B18584B38462
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 69a9bf06309c0d9895fbbdaa546129df29ce7320feb32592a308394e24120968
- MD5 34fe1ba9af944e7429ce11750c9389d7
- SHA1 9d8c6997e78df1ccb4285c8993e5035db3748e8c
- SHA512 86a6214436fea63453ec82f0039399ec0243f3eb03734eb99c9b09e1bd12ba730b0469b1cdf27385bbab47fdc15bf9ca9eaf8c60913fa568472a475b9b727c8d
- SSDEEP 12288:BVgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A365236E535C00C6D83785B4C2F5E11DE8237D56EB30059B6B532CBEAFB16944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 3aeb7dda7a2d19da6127d4ebd091011c0d97a63886d89cc36a97d02a6f6e6c56
- MD5 1ca05e384678b6ac80551d84d2c3cb44
- SHA1 1b199c6a44720b1364420363c08a0b5a02da1c7d
- SHA512 d2b6f757b020866a96f8cffc8451ae48d4126027e2f82fba9be88d4af6cf4bb836225d4d2fd9685f5a9fee2bd8ceb630d25802ebe92a8984a82259067f771010
- SSDEEP 12288:dYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dYsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1886523BE924C01CBE52649F5C3E5F14DAC073E5BE9200493BA9B78BEF7B14584B38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 078af01c68a2fa2673bd242c143e9d587f5e067b2acac8dc6443aa86ab82e33e
- MD5 57709785287173ff639f36c7fd1db20a
- SHA1 87514441358dc9389b3729a21fb37fcab4a076ad
- SHA512 7beee36ae62ced47cf294311f81850c5ffc5fc02d5d0ab37d24f918beb16a198ecc8593a6bd9148fb1df01f1b220ac8bebe6aaa98ec03591870c02fa6aa69c2b
- SSDEEP 12288:o/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o/sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D96523BE925C01CBE52645B5C3E5F14DAC073E6BE92004937A9B78BEF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 e99b755a3b9bc66d7ee4d949f7aca7bf1c1df0fa1668e7b4fd47ae14a379f086
- MD5 ff585d34ca351b7618359c25c94b0b41
- SHA1 ff27928148c9426f18fd7abfe1eeaf5c065e8f35
- SHA512 baaaacabd6287a77d6e3b8af917830ad0ef7d95700e3e1a7f0b246fc76e58268ac57572823022f7d2dd6f73925e47b591824c0af03bd1cee861bb2b7260e323a
- SSDEEP 12288:oTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oTsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1626523BE964C01CBE52645B5C3E5F15DAC073E6BE9200493BA9B78BEF7B14584B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 aa2f63c38054d49667b82158250e7f4193a78d6ceb2857c05ace897eb22c9d66
- MD5 8875f9414966d10359c8d9acc008a918
- SHA1 06c47e3a457085c4b0f2461ce71de60d4515c93c
- SHA512 08a22e8ea7117fd1b059a4ed96d4410832219c66c3c2d0de7e28b70ce00b1a93519795b41fb9397552dbbb0e1c078ad677aebdb98ae32dde9def8b7b9153eb15
- SSDEEP 24576:9ZMEzFVSO7sqjnhMgeiCl7G0nehbGZpbD:9ZMEzfTDmg27RnWGj
- TLSH T1F68501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 738126c1b59990703f1fff56fabf6756ef03672e6c2f4c96bb86eb96ebe6c616
- MD5 9ab958111914217d1dd39a3835c84230
- SHA1 ecc729ab00663fbba4befa75b287b92768b93b92
- SHA512 837dcb51a7c55746db3e01c19adc63552486a453841f07b6583897c69e7e54c9f6f3e33a75e46092d1cb49da57fd54c205340d247b6b3ad62f0195e1fff39666
- SSDEEP 12288:TCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TCsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1606523BE925C01CBE52645B5C3E5F14DAC073E5BE9200493BA9B78BEF7B18584B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 340d5af743a7843354ad4348fe1ea20bed4c4f5be79fbdef6cea9847b11e7cf6
- MD5 b207ad3820532ae5b5abce3b62e06516
- SHA1 a367a1cd4f5ed34b739337d5635ebb8ada6ddaad
- SHA512 11cd95cdc6a9564ea3f8db5da8ed6b137b83583b9c447a0fbc73436007d0f25af3d0cf5fa3ac41a3a2a3afe0b0f3a37b9a489a3bf00854d6e16cde58472a382c
- SSDEEP 12288:QOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QOsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E56523BE924C01CBE52645B5C3E5F14DAC073E5BE9201493BA9B78BEF7B18584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 cde93b986674fc16945802a791e1742c7e62fb1a93c2504d3ee916bf7e88e40d
- MD5 8823ffb65d9bc6d296cd8af403869636
- SHA1 8a4323946ee01fc6fb87a5cf30853d97c48c7360
- SHA512 320bf17766a77eb4c22123817675243a4b958051fd959ee158e5546967d5a68d425bec043df89d84214f40847b87a3c7f98bf4ed26530e27cac424b866e04f37
- SSDEEP 12288:ZyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YzyHsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15B75125B73A530F9D1378138C5A29606F7327C3647204AAF17A516BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 cd590639c6b4bede1a8752f41d1037fbd65e08a4ff9ca47379bdf796d9b3829e
- MD5 7cba58020d8c788d76ef2fd1f7e62065
- SHA1 8ec0f0a3cf2da90ca75d0248d0d1195892cea749
- SHA512 ab8935362d63008f99ce18705a314f8bc4b94327b308f8e827f8f6f3b062074fb83e1c3685d629ddc1fe9a9700b08619003914b6de3fef137a890ea600dd4f33
- SSDEEP 12288:vCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vCsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13B6523BE924C01CBE52645B5C3E5F15DAC073E5BE9200493BA9B78BEF7B18584B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 3c6ea56e0040b979c5900edee877ad233961b1129467a9940db1d640686ceb18
- MD5 c7a658ec753980da05bc7d6bfbb95b00
- SHA1 75e22c6dec77f52df1622a51c0f3ebff5f5b1fee
- SHA512 434aef33d56a322b3863f2501cec9c2be63b9e72057eaef423a86c518ad0d00234148357ff82b82453b59b012c1fb1cbc126a78de7ee9a21b310f175fba54f1e
- SSDEEP 12288:ACXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ACsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1736523BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BDF7B14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 0369bdc9117cca6dded37af5550a564af3b189fecaebccc53caee0b2c0e82fb7
- MD5 4969ba5aef93120d8ad17ccdf34f9edd
- SHA1 49609225ead7e5f8b4206cf3a30751587b2facad
- SHA512 c8e29777389cf18f4926b1111816cec77dc18046cf6839cc73f1bebe812641d1775860b1738d17e9617166c473c672ea434bf0aee9130b6c6bc5e6f85acae79e
- SSDEEP 12288:nyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzyHsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E675125B73A530F9D1378138C5A29606F7327C3647204AAF17A516BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 e8361234496ae6c3e9b2031e38bb5fd197d51e785d078433398debbdffd00e40
- MD5 908e900f757ecb16d30269d0f79f8137
- SHA1 023203392e387f2c45326ab973917329dabee052
- SHA512 bb907fef2cd74299e4ff83230d5aab0bd079cd1f317aad0d190c6c1f06d0a4026d99c29008468dc8b621b3a6cd6ea8a48c7b9be83ece6440dd91af754fe82085
- SSDEEP 24576:0TdaLl3z0zDdsqjnhMgeiCl7G0nehbGZpbD:0TwLljADmg27RnWGj
- TLSH T1AC8501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 dd5fabf5e04545d428288b2ec80b8ebc690a9bb9aa0ea7aa46f4cce7ca169deb
- MD5 39cccae3d9f230a8200a182253b5bdb9
- SHA1 6e62cf8434184ec8e9139edc38967e04c83a9d89
- SHA512 a690899ed20b451e86da710627c4529bf308275beef9ed16da552589014643e1c52269396cd9b51112cadb1b0d6d8c36151e103a2d276bd74bc6cd71f23205cd
- SSDEEP 24576:PcP4mcvIjkGOxhKP2l71SNKbrh/8KB6sqjnhMgeiCl7G0nehbGZpbD:EP4m4IpOO67N8KwDmg27RnWGj
- TLSH T1D265BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 f48b5b129abde49f40b7d5014e20b136d5b048f8e4626e3cb301b837f16b5d1e
- MD5 cb42d3e5b601e9f42eb26790b8b65300
- SHA1 d5fac865466186d4ce25483bba4e78adf5710241
- SHA512 b97da8f3069fde491967bf26c2fe519ac974ddd4fe7060a7228fd074fc7cc57c1b3c375ac0b2afc5721bcdf6813156a8d69fa57002d4d2533ee5a1776a3c4676
- SSDEEP 12288:fzsfSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6SsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C175011AD29802D8C06E6179C396D645F7233C2687E093CB67D1F87E1F766908EF9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 76f130038391bce0e87129ee80efc29beb924a24a862b662c82e6d8eab065159
- MD5 b236c4cb4dc349944d60cb988f3d0d70
- SHA1 3784a5849d39efd248de7fbc198f895f5aa3999a
- SHA512 0b3145f2d37ae0cafb2f6789b646897e9c638067bd099d97f53586c6234b77631d33f8ce482674e0859389f4667e365f51c3339dafcd2e40492f9d9806ae3156
- SSDEEP 12288:4yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4ysqjnhMgeiCl7G0nehbGZpbD
- TLSH T14865237FD34C118BE57A59B082E9E12D781B3E669E204483B94778FDE6B08948F38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 b5defe95c55c4920a5c5221f2a5717b05a4272c7fd9c987804fce878418bad3e
- MD5 3411a905cdf64897041c875c62668a10
- SHA1 0a01c0bd74690d06beee38c56f04aec0045507b4
- SHA512 2c2302139073f0e334ee9a9c17bbe955bc069d18f4bceb56e607b27f5f757247cef28a90e03498c43751f07ecddbc315d50d90427353a3fa4c95168ff86780c7
- SSDEEP 49152:na0h2GEkuAe73q3pp46zwwQEDmg27RnWGj:na0hNYG4JwzD527BWG
- TLSH T1F785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 8c8f69846de269f7b614892ac9c5df9473fc497cfb543bf15bd32dda5ed54dca
- MD5 6a8350338eabbcb30d31d91d73d540c5
- SHA1 8045304226898719bd3c8ad8bcf6ccd5d5c1e630
- SHA512 870f8742118305c638203050196909cf9d0b3aaf44e205a3f65098db5593f7339f1c59c2c0e90c47d7b9fc81687c308fadd17027b9fbb22ca8664cbfe3d7dfec
- SSDEEP 12288:thbHjfXrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:thbHjPrsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17275127E12AC20C9E572A17D8295D10AD632BC26172053EF27D281BE5F37DE44E39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 93871b47b50ac8b1cf4465e139c6d6c5d78eb271783dd2295e9cb8aff77f39ac
- MD5 9a50879b832513db249856e03d03b4aa
- SHA1 4493a1a49772b275ee1240df90efcfaa66d85e80
- SHA512 50c04b2b57f08986f2354d67e33cb007689003db80f8446b9795b96d51e8fe65b0d8108bc4dbf6d4cf31ebd1a40b4ee181ab8d8ecbccf28657f1c731b88f56c4
- SSDEEP 24576:P3YgnJcRTk4yti+R5dpR/DsqjnhMgeiCl7G0nehbGZpbD:PIgnaTk46ppR/HDmg27RnWGj
- TLSH T1C545BF2EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 ed61a8b301f65ecbaeb6aad65833c0b2a1b334b2436918214f765d14b3a52752
- MD5 8e29d876b186f2f85276ddffd723adfd
- SHA1 4f408516ccce21023d75fe8c4857c84271e803ac
- SHA512 6f5add5343dbc89948a482e2aaa65e58ef29cc5512467528d36c01568e16f3aa6361cb8579e30686348a6fc5a51f9a22b92bdae269caade908533ca29c004406
- SSDEEP 12288:O+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A26523BE924C11CAD93649F5C3E5E11DA8073E669B2004D379A778FEE7B18D84B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 01bec9684fddd7de6b0a45f09dff1e6cbc6f575a3f511fc374fddce30829ba2e
- MD5 dd541c799753cf6b20eb64a21a698d38
- SHA1 2474ad682b97d4f68b2766bdb9dc3382fe1b2d24
- SHA512 3b0096c7faa2768973ab9b56aaf71c14d6bd5cd1013c8f3d012a2b6c40a19975fa1f32e57d43d151e18d27f8a6a6b7905d8a5539132f10f058c0dc7de3365bd2
- SSDEEP 12288:EObrA4LWOsvAYFTJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:pfL3UTJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B8950159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 7b0b1ef8824be96e7879d78a7553b60f0b405063c32db4b6a06ccf1bdf3002f1
- MD5 dfa596ca0420f9469e80a9e84e26fee6
- SHA1 614a2e3f822e6bd7d9a3935712bb33f08fc898a1
- SHA512 b1ccfabf0c4fbae06fe65fc44f446f5a51be1725be8fec5eff6a043768eb94f4193af33e80f4c245e3fa7df6886899da708872f527eac73074750f9e7345957b
- SSDEEP 12288:/pFtfOFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lOFsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19675026E33DC10E9E536A17C8692D20DD6327C660B2117DF06D180BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f22a3768f83e70686a3b2f572d4da0f1638530bf8c8234e4eb70461783966364
- MD5 e2d27feb033ebf6e2a5dd74dcece0789
- SHA1 b958ea487bc6aac785a265831da72a07eb95a4c7
- SHA512 6fa7522318539b4037bb094adef4adafb43bdfd8ff3bea5f5d37bfd9293a1bc4359a7712db6bfbe0d54fe532b62f52dbc9d9c803979bf8a371e9fb9f2f292926
- SSDEEP 24576:X7NM9YmZqmWMUkPjZM48Mv6bEhsCsqjnhMgeiCl7G0nehbGZpbD:X7cBWMpPjN8DbEh/Dmg27RnWGj
- TLSH T1BF659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 650574531aa2443555d7cc2f14cac8c11c4db232be6c614ae7ddf7adff494c51
- MD5 b897238365f3e5fd80c04229520f9fa0
- SHA1 8b1de837250d9825b8d8df027b0028ffa8a1a127
- SHA512 a35e0ae7d7e22a8e44713e0796b3ca5c01ccc5ff65310f0aebc660e5892257b8a09d3f561d08151f6ec0a75e1257789b7b06d39738b3468cb9e9855cddfae0ec
- SSDEEP 24576:gW6BApg2YuyuNDYTabvcRvNYf8km1csqjnhMgeiCl7G0nehbGZpbD:gF2YuHNETovcvNYf8kmmDmg27RnWGj
- TLSH T1F0857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 f437f98fab5b73d84047edc0594a634a996f401365c186c9eb4e518b2b8336bc
- MD5 685f08ccdaef61c3bd3b57d0c9e9f1ba
- SHA1 d3c5a91b39d4b14d132e004083ae59b9bbac53cb
- SHA512 e5d4ae79418457024e214eed4dde65633ad6095db959f3fb62f062e9c12bc04ff9c4d77bfa9b8e5f152dee08d9b5ebe62fd35caa59aaa0eaa17ab0719090177e
- SSDEEP 24576:SAFs06+Omlf3NXEbToRsqjnhMgeiCl7G0nehbGZpbD:LFs060lVXukDmg27RnWGj
- TLSH T11265AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 6803efb4a1886b97fc0efc5eb119117c7476285d11489fb48345f4b0b5116998
- MD5 1b5f3b18199964c56384df4b832a0129
- SHA1 cb99965dfd3a6e5ee293c536f544a24c3f8e8d24
- SHA512 f3cc547f30fed3a09247f26e9f6c07e49d874dae4c08dc9c08f09f853aa1a9fcd8b0ddc56f60b5371d680bd2befb1118c74205c714ff324653e1408a5b20b089
- SSDEEP 24576:4JnJ5D3WL4sqjnhMgeiCl7G0nehbGZpbD:4JnJ5DGLkDmg27RnWGj
- TLSH T1C685E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 9157b554dacf1358b609b68edeb5aeab0d438b7e16496ff7584e09bd720dc0ae
- MD5 1f04c78f765b1c435bbde05f4772f856
- SHA1 f572f4f29c6dca3f1fb6640852fc1024417d6966
- SHA512 2cf8c0ea834c389f2cdd5bc90a2001ee7e942bc455182ca530ad4bd48867af59e772b4570bb08c6a619f77f2107b9e9e5a80d063201254037ab0a318232c172c
- SSDEEP 24576:zEPohm6/7IIXdwcXrif7qQncjlP65i3VuDsqjnhMgeiCl7G0nehbGZpbD:0o06DIKdwc+eQnSt65aVqDmg27RnWGj
- TLSH T123955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 099174db4a45fa2447645e87bad03e169bcb30dbfb65219b2a7f669a0247b571
- MD5 14d34f438c6851cc0aac24b823e703b3
- SHA1 2284f0bce67284d3a34bdba9fe9744708cfa221b
- SHA512 f4c0ebab02bc4516737ef44dcb527e07a635d8898bf18a142e8f79d615082d5e1f8bdfce98f88c87a431a974cf9b9db963b062d4bd82b88abc0952ca4a401496
- SSDEEP 12288:TEP3RBEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YBEsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A37502AE679C60DAD136907D8291C209D733F4716B2127EF6692D17E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 75da79b1803ef43d0980c91a83d09b829cd4fb74374a7d008747120a74957b46
- MD5 0c034f92d88901964cd64bfe40b90d97
- SHA1 59575368342c7b4f100744f04f5b81a441e45fbe
- SHA512 9ade62dfa4ad6c5c69b816c4a2256354e74bb249646fe83f0b52f260aa758a8f0366af12cacf09bc38016f3b2f105f47418b14ce9e04ebece0498f944dcba9c8
- SSDEEP 12288:wjkybXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wIybsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C3751219639C50C9E9760678C6B3D1989C32BC319F2056DF61D1FA3EAF72AD48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 12c5c5127edb4b46e7c8198c37a0f60a83a9a57139af612fb9e70acebace07e9
- MD5 6ad535f8698c1d793869594cbaeadb32
- SHA1 70392d91c6c3ab46ab98e565b755297e3fe7934c
- SHA512 a79fecf31ccfdf6a1658e7d9298d17d1449e3a8cd7f40057db68afaea4bcdf35e7ec221f59424eb21ca9e0544ee194c7418466d06ffec292d1bf2766318bcb1c
- SSDEEP 12288:6r1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:21sqjnhMgeiCl7G0nehbGZpbD
- TLSH T12D65237D525C20CAE93645B8C3E5E24DA8133D369B2014E779D7B8BDEBB24D44B39812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 6e2757e394b8f0dcb2d21d514eb06d1ca40963a6316ffb8423857f1de4341c28
- MD5 46d914714457680282a3ca1f263f79e2
- SHA1 8f3eb26e7bc7ea995454b5be84c113800d1016bd
- SHA512 e3451d232238e3be385098d06cf1e045ae3212275f5bf1bfbc1cca6e56638e1465e8a340b8631a352c0170f68a97bf93fed22e2aa0f1c0431ae1edce3f325aa3
- SSDEEP 24576:HQ9MxZKdcz97w3KsqjnhMgeiCl7G0nehbGZpbD:HVKXeDmg27RnWGj
- TLSH T13B558C2DABE9058AE177D27595A290C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 44ec216de634ba94f3fce078162117edf4f7550b1ae55f4defdeebfaed29a784
- MD5 57ec36f035892048bbf1a6d03f1003d7
- SHA1 7f89584062100804bb82f8d686203d0d09e3786f
- SHA512 54ac87ab172e96ca287bbd009aacdab9646bab8f0b5282de7829885978873e0935bfed58fcffe1155784c9bfe66c598878979020dc98f7f511bb74f9ff26503e
- SSDEEP 12288:zyoKo2hRple9pXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:zyocbApXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18C85E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 eedf67b146b3c797ac2bf4d3cf6f0100af051853edda84c06184ec84f8b458ce
- MD5 8ec55875788fa2716b021d039c23d865
- SHA1 13b41049140c99a914c42d6516ca70503897b73b
- SHA512 89c5524536398bc89ad438b7c8e186dab4cd2d23c28a00b6d2a5bd767d16cd93a8e61e7132a72d1cc679fadc35d04dc0f9ebfe853bf97fd0c72f78951cb829bd
- SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKrDmg27RnWGj:10zuNI3D527BWG
- TLSH T16AA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 24980c64cc1cbd4fa23fefda6c0fe5b4b3aeb747bbc83edc91ba6c91e785467d
- MD5 2346d94427c19ce0e639d9e82bd119e9
- SHA1 d598342a8a41958fad85ee5baa34c6a602abe385
- SHA512 47b10eb1134c2b6ef994da0bbe3900d1227ca6c094ba816f0466b6ec812889ce58f226faea5df31e6e49f727e4a8384e719d6611d50802fba763477f4604fef9
- SSDEEP 24576:L1QT7EcpfxR+N5AWAz3ooiYtjMqbEsqjnhMgeiCl7G0nehbGZpbD:2TDxR+N5YzTfjMZDmg27RnWGj
- TLSH T1C155B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.7MB
- SHA256 3dd42bef1505c31f442716864f8d813b9b029877464d6eb1a3cd877d093845f4
- MD5 55e8041e4a20c1a55c16591da377f54b
- SHA1 33e97bb1b0794dcd8f04c7d2378dfb73625d5daf
- SHA512 e640ded1b0e4928369eeb4f8f6574400b51fd6011c5d359120bdafd5452d2b870d4c7f8b10330d16c671709c189ddbdaa082dd1ae19f164885f204ceeebbfe3a
- SSDEEP 24576:0TMdOz0FFS+kmSLgsqjnhMgeiCl7G0nehbGZpbD:80K+kmSLcDmg27RnWGj
- TLSH T1A385E17EA3AD14E5E47BC17CC653D90AE9733862032166DB0691C0B93F97EE47A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.5MB
- SHA256 9938d3590223771ab9914ce7466c80920e764e95e210611f77d7e4a79b1dcf13
- MD5 1f68f3b97a709f203ab319489c9f2f94
- SHA1 55b080a26e5ce1add21766dc833df848d2cfa6d2
- SHA512 a6c6b32c1c0ce8aab19d4bdadadf968b693431c938d2db9006d8da8e36030ad6504f1b0c1bd9efd901636cc03d39aeaf77a80cf42301ab87aed3192fdc9903f6
- SSDEEP 12288:D4pJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13875126D63DC30C9E4729578C2B6D1099432BC36572019FF39E2D9BE9F729D48A38B12
- MD5 SHA1 SHA512 SSDEEP TLSH