Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 23:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe
- Size 2.0MB
- Sample261027-227hmsgw5t
- SHA256 8aee4b6b7260594a4811c0f88169984a63d4a3a80e42c5cf7ad6dbb14e4637ae
- MD5 ebe29a0fcf13f21fcb389d5acf8ae801
- SHA1 c66310d1e743266e2a0dfde45286219253ea6889
- SHA512 e214e4a0aecee19cfd3bab1c788e79b3be333c22ab94f4bac2542b938060dd01b23343e1c92447f1f20d67f2b0e6fa3ce0c7069babcd614fd1139a87b95a1ce9
- SSDEEP 24576:zonB0LE2zKV0ICMO//35gUKSJozCh9bEO:zo07zKaICN/3Hh9A
- TLSH T152A5AE16A69C7CE6C0729238A77387C2E33EFC054761C69F12D092295E3F9927D3A791
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5608 alg.exe 5492 DiagnosticsHub.StandardCollector.Service.exe 984 fxssvc.exe 5612 elevation_service.exe 3508 elevation_service.exe 5752 maintenanceservice.exe 5652 msdtc.exe 5844 OSE.EXE 552 PerceptionSimulationService.exe 4000 perfhost.exe 5576 locator.exe 5424 SensorDataService.exe 2288 snmptrap.exe 2584 spectrum.exe 2004 ssh-agent.exe 5316 TieringEngineService.exe 1956 AgentService.exe 1912 vds.exe 5928 vssvc.exe 2192 wbengine.exe 3056 WmiApSrv.exe 688 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b99703d74bb6346b.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DiagnosticsHub.StandardCollector.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DiagnosticsHub.StandardCollector.Service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023cf19b96766dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064905cb96766dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007958c9ba6766dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070cc57b96766dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068fd2bba6766dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5931eb96766dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeAuditPrivilege 984 fxssvc.exe Token: SeRestorePrivilege 5316 TieringEngineService.exe Token: SeManageVolumePrivilege 5316 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1956 AgentService.exe Token: SeBackupPrivilege 5928 vssvc.exe Token: SeRestorePrivilege 5928 vssvc.exe Token: SeAuditPrivilege 5928 vssvc.exe Token: SeBackupPrivilege 2192 wbengine.exe Token: SeRestorePrivilege 2192 wbengine.exe Token: SeSecurityPrivilege 2192 wbengine.exe Token: 33 688 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 688 SearchIndexer.exe Token: SeDebugPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 5800 2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe Token: SeDebugPrivilege 5492 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 688 wrote to memory of 1092 688 SearchIndexer.exe 110 PID 688 wrote to memory of 3808 688 SearchIndexer.exe 113 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_ebe29a0fcf13f21fcb389d5acf8ae801_icedid_mespinoza_njrat_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5800
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:5608
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5492
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3028
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:984
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5612
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3508
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5752
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5652
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5844
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:552
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4000
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:5576
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5424
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2288
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2584
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5288
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1912
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5928
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3056
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1092
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3808
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 23b9c262c5937bd4b681152e988f7df9390c9ceb46dbed51e58ee9c996465499
- MD5 0920a505d90d4b4c799b2202c510b320
- SHA1 0d82b83c3762adddb91e21595c9cd91b1fd41591
- SHA512 f35d3539b37eb3f8915998c69e03ad0656956e7eb7cf5e6ff7cfda9cff55d8cb544c2bf7a799d532084acb5e165f9324b2cd1e3a4bef8b0e58f00e4ce3e21b6c
- SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnICN/3Hh9A:f3q6HjB9CN/38
- TLSH T1A3D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.8MB
- SHA256 ab3a1dfbf9efdd770c08a5af86942b7601e781a99bf9ce10e1d52fc16e4b5dcc
- MD5 92b0c0a2f3992111106a28cae31db7bb
- SHA1 c09627c3e450707c2175a7862a3c75a1ddcfbc69
- SHA512 b7419da446bf97cc8470c9032f4cef7c2ccf8359598b8c54224d0a44f22c7d23ca2c47c809df4a26591c316e9b4d88a21dbcb8eb86a3068c0897a4e5b5bac516
- SSDEEP 12288:D1XLsswWkxy2lRq2czAZiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9h:ZXYfDtczAZCMO//35gUKSJozCh9bEP
- TLSH T15985022867A108F9ECA7817CCCA28415FB337C9547A4E79B03B499691F336D86E3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 2404fceb3f599a72bf0684184c094b8d4d1a78a9635d8a24176d21db8400c8da
- MD5 2920d4ae74dc47644ccf0bff986405ac
- SHA1 5199ec1d16ca40b09d1a2fb12506fef23b3fd07c
- SHA512 539f15158abea134c124c57ce11b2fe3e8a0eb1d0d4066445f8a6a5a8788c95208ddb0361da3b644417794db4c3c3ecb0f55cd34b38ab5223039e354ff0b5738
- SSDEEP 24576:l0Le5ji0hmxirMwCMO//35gUKSJozCh9bET:lPji0AcnCN/3Hh9A
- TLSH T116A59E25F6748735D073C0B9C5D2A68EED7130825B308ACB4296D77C3E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 c5a7ed4bb3543c346685611d14d50ee11622f894481d6a2deabc06d991714735
- MD5 378b301b61e772ac6b7a151a037cef45
- SHA1 3b2c96d3d63c5eb4eaa371cb4db2c1e691204893
- SHA512 b6442c6466c99b24c75a912e10d689ab65e05cf689228e58a7c05d5cbb793c6e8977b8ecb1f3b104d961b15e21ed3f85b7474a4b4349caf007afc428a87ffbcd
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuaCMO//35gUKSJozCh9bEk:I/ezSC6vUzPvxHjyTCN/3Hh9A
- TLSH T10F756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 382bee0295bfa01111d6465e5b891c9e3ee27d90cf3c5635f28e0fb1b618a91f
- MD5 55807098ff7348d006a78de583e61db8
- SHA1 0f21a5641fadda790c905fe65cf05a2786916fb2
- SHA512 1eb00bf3f085828dcf2b34620a540f8a85c647d8497131fb349f8bbbe91305e64eb4f6f9e21c2675898982386decb2e79172a6498a4a0a89fe36722998bbd86d
- SSDEEP 24576:zVbqPb88hv/l+6NCMO//35gUKSJozCh9bEy:zVO88hXl+MCN/3Hh9A
- TLSH T138559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E67AE5D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 43d989c0a01b92d6e61936745c00ab6394ef7a04e2da7b7b87bf0dc61cb8e8f4
- MD5 8cca373df2bd918c3c6ae4fb1498274c
- SHA1 16d2052092df3df2991b5f9faf6cd43676464d0f
- SHA512 e2a2db1fa222183bafeef9f7620eab119f42a80adeb37c687bdef16a35a9df0bde62b824932b95455fa89acd84843b10498d2bc3e424c21bb1bc5fff61ce1477
- SSDEEP 12288:HREiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9Z:HRECMO//35gUKSJozCh9bEf
- TLSH T1547523244A3118A7E5E5787519EB381A7A626FE5E9CE2E381C377ACD187BC70F13410B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.8MB
- SHA256 12afb20908dfaf6ef1d13a0099729ee51aaf1650e8f027db495be69a2226f8cf
- MD5 456af04ea26fdc7c720ee04fef485652
- SHA1 479c19831f5e6c6e29f923d504f80fdcc772773d
- SHA512 5bc594766409a26aaf9151e6c4b1f12024438934e5c5e01d188faeaf1d0e5a50dd6d81dc803430aa2925b52cb36806c7d9cb530d91c5ab7b87010b75c0d4d95a
- SSDEEP 12288:XeBNUbTVO86U1iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9H:XJIU1CMO//35gUKSJozCh9bEJ
- TLSH T10685C03BEE28FCD2C27A9DB95A918600E77278704F52A3CBD175830E9E235E05E79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 5fb80b56d51d2b0754e6a36ea50bcb54587e7eca723a42fe34ae4b770d6522a0
- MD5 2b5928c78c99394d0736e426d329a15d
- SHA1 6648cc9b84c332cfd00c00cac60ba0ad17c6e178
- SHA512 4a821a26c43a486bc31feca2e84430b61edef852611b88f92a063ef78ff40df949b4351e0d12e5361a0a7a46b513296fc1473aba8a3b378319d4b21b45bbef90
- SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:3QvGAdlCEL8c/yRNw5CqCN/38
- TLSH T142267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 6433378d62bd524e699f216766ad4dc52181e10827e4e52689002c1d675705e3
- MD5 a6cba25bab54cbbe00e79105814db563
- SHA1 3641e693372b406fa4303f933a0059011fefd582
- SHA512 311414b9a85e593253ddba7149acc52c35d09d4d5ed66c90a6fbb676cb2b98ceb231c93d536a979601c5340104315f75ccb7e3e7da90441fae4ba46644bc806b
- SSDEEP 12288:ZAwSfxL/2Dc34DLLmt0LDQewsAj3iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bevT:KdewsAj3CMO//35gUKSJozCh9bEn
- TLSH T11795E031FE34E436C2BB0DB61B36D716243D7A604B921AC3E3B89E8D59345D26336A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 1395ea154f214ae26a36c5dc26c825e2c86c42063ebd5232019ff5d6b4daf787
- MD5 a9665beeff5d59d669c92b29de746e8b
- SHA1 b14e19db31a5cbcc101bf2e67d94265978d53103
- SHA512 6399550b555cea423a9a145f379bbf191067bd328124a18e28b21451d08764331bc91f9735940eeae385b215acd92cd42036a78bab67a7af35e16d5c77fa1258
- SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvU/:FUEtQevvqc2W1cpV2EI32vU/
- TLSH T132474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 15bf9169d6cf2578f108c2508f6e61754c9e33e0b427a1207122e53f9ff24f25
- MD5 b8be7de32cb9eb809af59ef33bc0d201
- SHA1 32703c1e411d1b1ca5a7dca1a98e250c92065fa6
- SHA512 4d32f130311fabd05dbd43dcb3232c6a3e5be360730438e4e069e1b2d4582895b18080f1e638cd748482b6c6135251ff32782124969510d9833aa4adca03d9ea
- SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zXCN/3Hh9A:+oqtVjnmWCN/38
- TLSH T1A8D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 3347b0f02d503244be882eea01ea08983209f6a3678f7812d67ad2b644be4eab
- MD5 b113213ac0d91623021a8ebc43624601
- SHA1 ed804836b309b1a09db13d258ba0ea8c5b3c33c4
- SHA512 ccf4d143029e92fdd4e079479118453a6a6bcd5de91cdfe972d6a690b81edcedffa13188f2a4e4fa9a8f0f21f4272c88a3251744d4872c114538f9b25f36c943
- SSDEEP 24576:JAhGLJIFoiwtA5l7S532CMO//35gUKSJozCh9bEe:JAMyFoiq5mCN/3Hh9A
- TLSH T1C4359D80EBF955D4F5F3AA7899B69171EA76BCA65E31C20F2160910F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 9155eaa33d6a3c53e7a5a04bf9c58b3be29d79226b9c2909bb530f1b1e2ad51c
- MD5 e08ef22d63c29a8aa594054cb6c667a1
- SHA1 d4670f0b7be6d0d073033a5d4d131c39c289f3ed
- SHA512 2c3057d507a5eec3138e79d73eb7c5a79e6ad69663bcf2735c2bce2e9f23beaa7168c21efc02adefaadfa6e8e1c5d12d1bb12cbde86ea0be9f69192e604dbca3
- SSDEEP 12288:nmw5HEjsChNVBFgl0WDm+C6iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9W:mwuoOWzCMO//35gUKSJozCh9bEQ
- TLSH T19185F14536A40CF9E9A7953885979436F7F2BC122A25DB2F0770C65B2F37220BD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 691950c70c30005df8487b956ffedec385c4b088e64600a59217bd1027d4f83c
- MD5 cc4acf8cd16436a9e3de589731ff2647
- SHA1 172deb451fdef181266b41de607bfbb01b97b88e
- SHA512 45ebb8163fe73c86b5262259d2cd25b28158a47ca2b0d1e10ca51347ada58529fc22d2f82b0d29b880bb926053124c2daf4458781f44db0d8d23389c44655cbe
- SSDEEP 12288:bBZ1IyHiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9b:1ZuYCMO//35gUKSJozCh9bEh
- TLSH T1B175121927A020FAE1E3617C89E21509F77278A2637643DF1936569D2F33DD0AD38722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 339c6fe57a4eba51f219a73d0e27d1d045f7ef29a504bf7fb46c2b057bdb2ca8
- MD5 5c91962369042ebd12680a32ea689b67
- SHA1 2e2cc54669ffa7d705a5cec789100dfb4ed238aa
- SHA512 c38bfe6d2fa610aac94336bd8eac3855c5ee6874e9c7ef26bbda27ebcc3a37f38924687f11e2f500b3d4c6b45753ac2a980b7e5ff93fd2beea9a1e4531941f8e
- SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:hQRQyi36YOcPQLvw2gAf+PN3BCN/38
- TLSH T18B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 1fa6bd1c81ad12d3ae7a1a7ddafd3a49e3ea7a8a70d5ee0700b9aaa207035c25
- MD5 ba2ff7deff562ec42f520a550c83f56c
- SHA1 980a097c757e1d1731fe69db1d61dd63fa0b029e
- SHA512 5d7bc87672dedd20987be17f6bd0354ec69fbd05197038e499d603b7875f564d6508d01a59d36824f4042694ec6749623d36d7b6b6c190b47e6cb14ae43d290b
- SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:4QRQyi36YOcPQLvw2gAf+PN3BCN/38
- TLSH T1FB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 64326170bbd01fb8c1ce21e5a59a7a1bf3d80ebe0b9e43c8772b1db2c81bfdfc
- MD5 ecae93fc85ae73ea5b96beaf9ba0b0dd
- SHA1 3a1cc95a4f2758335e2a572f5ca83015dda1d8ab
- SHA512 79fe3280212df1dc2ae342f75fc922482a7898850a9efd5da0daf671b44a629c5fb399bc15a223e272c18e81bcc344d8fa052dfbfc3408a9ed83e0fdcbc93211
- SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ICMO//35gUKSJoO:768Qg55nhheWu7PNU3/nCN/3Hh9A
- TLSH T1FFB54A33B2F200A9C44DE1769F4A972196D17C75CFE1E3DB8511720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 bab9add5c879d91e7119e2303a33ce08384ee49aac30114bbafa59178668b312
- MD5 06c3adff7d73ab239025c94b2214ec6b
- SHA1 409525102e907616044b0f6afdaf09651d97d3f0
- SHA512 f5b77ebd68588674cd92f111de3f3b8a1807cc319f6fe88253cce7ea6953f6d90c45d8329455d788c5579804c1ffc9905e9307a57209d50a103c338b5dffb1b6
- SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:my5112gYy5azzVvL69nLKnhZECN/38
- TLSH T1C0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fa1de0234d9a940b5e7717a618abb345b6d35470a0c549eb8e3aa2e054ddd5de
- MD5 d11bf4b36fd0460ec41df71efc8301d8
- SHA1 17071e47947f6dbd65ed11369131a81f6daaf045
- SHA512 0379bc72aae292b6e45f32a7d92a39c447056c6fba016c1add8e24dc9b82eab0c30726c7de2af120790d6e7913d421f661ee79ec8e808de543ba22f921956e53
- SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJCN/3Hh9A:Qu6JmVxd2dJCN/38
- TLSH T12FD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6EF0A9073552E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 a20df0753c3d041811f04d2db0c5eac335951e80121cd1bd04d34bfd655704f0
- MD5 8b02dcb6b9b35fa8b8a076fffe46e8df
- SHA1 20c818927c68583efbf421a35608dd970d961dde
- SHA512 8cbf20eb8148eadbfac82e85026ed3bfbfe0950a4230372dcad9f947ce008a9f8e3e8433767eb0a7901d747e92e8e23954ce12a1e81099206992e3edca8d242c
- SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xVCN/3Hh9A:XmifPbRWCN/38
- TLSH T132B5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 93884d5686e998ef08e25720bb719d75558fe837f342b843e38c2cc5ddc1ff78
- MD5 d157c4cf11efbb899129063a3d115a57
- SHA1 6227b4b81a1ac0a6e6e7a4a22b3a745e02f4b990
- SHA512 83c16fa047d9164dfcead0086cab9109787349530061dbe5876ba8c72f57aec9d8523f38cfcba8c28a31d4a2ae6fa880e3b5d9593f351f69dcad6482cfbf4b93
- SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqYCN/3Hh9A:+5dKTi61YCN/38
- TLSH T1B3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 05bbbc01ebfdf1dfc26c02a0945fd3ac5c396cc7a927a1843183f8ae96ba3ee8
- MD5 ed40e302e29ceb9ab6b79a222c8102a6
- SHA1 f4a774cd491374a14f13d9391c927bd17043dc7a
- SHA512 2aae3f28608967ef4bf2ac978fa17e69e441ed3339db1883da5b4d68fb58bc66db42bcaecc15d183abcc81f5c5ec1da0309626284587ea0b8c75f90213398bb3
- SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wZCN/3Hh9A:4X2iyphiCN/38
- TLSH T12695BE13F2D900E8D05ED178C7568632EA62BC160B39AAEF0A50B7561F7BBE45B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 418ab3c1a392bf02daea83ca2157ba51d0fb8da0f7af00656443a10a9545dce9
- MD5 f6ad7df31b7d57978368011c4ea57a67
- SHA1 610acfe9aeea3465d4240f0674fdca77ffdcf0c3
- SHA512 4b16cf4c599eb52a528fe28632eba4a6fb46a72e401ee72b1a413baf6569573b188507799c9b2f5d297447b17746d5efcbb5927d981add0fe7ebd282892ea8f3
- SSDEEP 12288:aMiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9T:aMCMO//35gUKSJozCh9bE9
- TLSH T149752324493219A7E4D0B9B509D734097A617FE6F6CF2A382D3B368D296BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 56f4cdeb930f24171002919592b87d0946df8dd214446af950e00343401bef90
- MD5 fb0885fa7ad3a30e8340c1c09f60c6f3
- SHA1 7005ded1b1ff10dff0d3c2e16c781e2d6b217b56
- SHA512 2c84cf80df4f8a97dfd45adbd6e93df553329cce501e606b179cc084273657d6c55fe1d0a146d60139c87342f34cb783754e24ff325a987f92ad41bca101bf8e
- SSDEEP 12288:KLiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9T:KLCMO//35gUKSJozCh9bE9
- TLSH T1D775232448321DA7E4D0B8B509D7340D7A616FE6FACF2A392D3B768D256BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 98d917f1e444b235e432de0efcfc338ac260c15f7c76ceeb498f2c4e9bb3f296
- MD5 dec0524d746722c6bc27504c8be5e78d
- SHA1 d5d27cb126445a412f5d177732d893342715a992
- SHA512 a11128ee7753ac3538e0a54f28440b2ba7cc2979f9ab62fe9cde01dff7a054d81d6814226629bfa78528622175ccef81a0dac70839580c54b1c03197d0515b04
- SSDEEP 12288:f9iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk91:f9CMO//35gUKSJozCh9bEf
- TLSH T1C875232448321C97E4D079B909D734197A616FE7FACF2A392D3B368D296BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 955b30727f3372f6699c75bc8adf856d14c324f3e6955279aed4d8d537835831
- MD5 742c3c34bbb0982e4043e49f111f049f
- SHA1 4be4ae79ce0a572c9c937ac5570838dfa5772a11
- SHA512 af478decab6e2d848b7615535eed04ae297862f22c808c7b004d09166063d42aebf8e2b066e64da7b242938e48a769b6a46127d181c59bcd316819510f937c1f
- SSDEEP 12288:TVWiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9K:gCMO//35gUKSJozCh9bEE
- TLSH T14E7523200A3204D7D4E1E57849E32409F6B17EE5E7AB2B7F1E22298D1D77EB0F534A16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 e28c49e9bfe45e534feac5e79f1eef4d94a893fa13701ffc5247ac962c49810c
- MD5 d0eff73ef194889fd3b77ea3ac8a01ad
- SHA1 17ecca5909fd7ea31914ca400a5ac8fef7ef39bb
- SHA512 0715f36d77f73a32e4dd0471100b4df81962134c4414283b5be87e38b8aab0a843f62a081d05e15e4d7778a8af089300500035003985fd4df043aabdf577ef86
- SSDEEP 12288:TuiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9U:TuCMO//35gUKSJozCh9bES
- TLSH T16475232448321897E4D078B909D7341D7A616FE7FACF2A392D3B368D296BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 bc5fd77b57796d618e5546638a4f55b464690275393c94b12a221f6d6737d5f9
- MD5 85941e26fd1c19729e6f7651b041fd49
- SHA1 ccae53b6b1531ce6d2cca6d14ec826c00f926a35
- SHA512 023ab0934f618f32748df23f90487ed0f004cba850b1a8d8f7e39488a1be70ab0f669513539b0747052cc175ab284fb0eab8303171fd74c2044c17847bf29692
- SSDEEP 12288:0/iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk95:0/CMO//35gUKSJozCh9bEP
- TLSH T10275232448321DA7E4D0B8B509D7340D7A616FE6FACF2A392D3B768D256BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 d75c8490fd5a0557b52e9120ebc4a661766a3378fb140e141e293576d7cb93a1
- MD5 f0630b7ada8d00637e92b5bc8934a69a
- SHA1 34edc085709455471f9f5bd4772c0508e9f4363c
- SHA512 ad3872beb1469bab007f93ec2ceb714869a1ff92be7797ae43756276084cc622800483f88812a0af87feb3d7baea78e7d74b7389ab28bfd29516c49d0bd12eec
- SSDEEP 12288:HjiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9t:HjCMO//35gUKSJozCh9bET
- TLSH T11075232448321D97E4D068B509D7341D7A617FE6FACF2A392D3B768D266BC70F13841A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.8MB
- SHA256 0c570a5a345ed4824b0f14b931c9c3d494e9bd1e13c6530e2b2720ed10f14025
- MD5 2240ea36d40003342249441a82d308d4
- SHA1 d68355065f3dac04b05570b827585649d9043f0c
- SHA512 92071ea08bf5e3d88c99dad5e406ec178b508c197d1ace6da989d9b33d718482d68d640efcf8460e213f35001a24b20ca794b8086cebf79d39790aadf9fe414b
- SSDEEP 12288:ZiZwb6zzFEoS2cPvyriiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9n:cZMSzFVSOrCMO//35gUKSJozCh9bEZ
- TLSH T1B485026473601CF9ECA3813ECD565806E6B27C6A47A0C62F07B4365A1F337A05D3DB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 5daca050f6f7b6abedc174de734b858585fd4142666abc8646353324e88ff605
- MD5 43080a2b073abe50a450186fef363e25
- SHA1 851be1edeb2233a2fd6e30d693ada58e71ee2d95
- SHA512 9abbe279200c6702f0d558e1805fa8504d4997227cae7d2a93b98b0362c2d9181eff14bc5c92a1a02de8123d21da111ad573f118cadb76721833250e1b8e2bbc
- SSDEEP 12288:uoiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9J:uoCMO//35gUKSJozCh9bE3
- TLSH T16475232448321CA7E4D068B909D7341D7A617FE6F6CF2A392D3B768D296BC70F13841A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 e8265c100dcd59cd799a37f02e3750b6a6c6b33c393bcf3c170a7fd6a267df6f
- MD5 cf6081150a740768e0a9f9e67c350041
- SHA1 273efcf3fbf4ba5761d1483c943df22e1e3c75bb
- SHA512 ccd645d787376857cc76686d5b005ac7b89180d5656dedfdeb9abae30ab56c12f1dbfab585bf35c96ab8ec253fa7f2e84a1d62db0f28759ab243b8cb7e5ca892
- SSDEEP 12288:6UiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9m:6UCMO//35gUKSJozCh9bEE
- TLSH T1D675232448321CA7E4D068B90AD7341D7A617FE6F6CF2A392D3B768D256BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.7MB
- SHA256 831d7c711835cfbc1dcba65b531ec917bd2738a7c08b9392f81bdea7eb240cbe
- MD5 cf2a5370f461fcab5b90e64527c5279f
- SHA1 a96b456f811a1e1930e298d466201fbbc47cb1cc
- SHA512 92add9db1e46d16dfd50cd416fd792210e1e6b273ae3a926b9bf381d036eee8e948dfc47f6a8c8af33fd3c6f321f9941897729262789d6766a4f634f31afac54
- SSDEEP 12288:hyPz5L8HiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9I:wzyHCMO//35gUKSJozCh9bEK
- TLSH T1C0851217677130F9D0B6913888A21906F772787257658F7F1760077A2F27AE0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 d3cd56a3df2819a72019017c22b599c144b890516cdc8243ed4d1e01ce32c958
- MD5 385fc322095e7a227040ed58cf6340b0
- SHA1 486e4965d7b9fe8b5c9e80b451df69b405c62ec2
- SHA512 4583ca208abb25c7febbb732af731f161483fb729afafd866cdbe531ee239570cb800252ce60d3b8fbec575b30c39d40831871d02457d39b20723dc1b9e34de9
- SSDEEP 12288:goiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9t:goCMO//35gUKSJozCh9bET
- TLSH T14D75232448321CA7E4D078B909D7341D7A616FE6F6CF2A392D3B768D296BC70F13841A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 21031651c5f873e368568552ca245a472ae3e3ca5061e83aceb08906a867dcf5
- MD5 0e216de7090a5cb0e86526a815f3b85c
- SHA1 d9226cbe3aad038748ef9c38f99e03d7c91c3920
- SHA512 02f8386e762146214328d11c30357f25ed50558b41ca77a044cda6931924e3afd02f47fee064a9a0edbc95d4fb7a2800e4504c7dd127612ca504949f3b6ca5e2
- SSDEEP 12288:ioiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9t:ioCMO//35gUKSJozCh9bET
- TLSH T19C75232448321CA7E4D068B909D7341D7A616FE6F6CF2A392D3B768D296BC70F13851A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.7MB
- SHA256 4edeb44634115ba1a7a82738d40bcedcff31c298fcff626bf478e8ba67b0681d
- MD5 e5b7516d21a37c41fe3d61ccb9d6a13e
- SHA1 1657e5277b972bcbd03b2edd6e116d2c6eff5fb5
- SHA512 9de1c409f7ee01a204b51adc829d0f967d35497a9438524f2c8fb864413d2972adde4f50a5145fbeffb6292121c56bcd25fc1f034067a34440c83d65ff67c650
- SSDEEP 12288:ZyPz5L8HiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk95:YzyHCMO//35gUKSJozCh9bEX
- TLSH T10B851217677130F9D0B6913888A21906F772787257658F7F1760077A2F27AE0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 f89eab303f2d2000a356e11ce08bad498bcfa583510526b2437b692cc18b3671
- MD5 63cd7d94ce91ac8352d82bbf97082cd9
- SHA1 64aec80b0f0380b17584385d0e5693d21cee3994
- SHA512 893abf6473af9a85ff30401f7b2bd46924ab82b506bf23f264180280c592229caaa4a915676a2f75cb8264ab7edf8774ead5f2d71c036936b2c887e3dd0e7b5e
- SSDEEP 24576:UcP4mcvIjkGOxhKP2l71nNKbrh/8KBgCMO//35gUKSJozCh9bE1:vP4m4IpOO67W8KqCN/3Hh9A
- TLSH T1A565AE2DABDC0096D0BA917885658A49FAB1742A2F3286CF1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 a29ff09ea790e9d21674295ccb1a0f022f90e80b3f80415168558129bdbe8217
- MD5 196d8f9c69944e8d6ce93ce29c8839b7
- SHA1 be2d3c8faf608347015bf76ef97892836b0d6eb8
- SHA512 6d2835793f599ed6a948699a35562cd43feeb32a6e434408c4c11eb7bb0c35e1ddae036dc10145b2b2e2dae60dde45eff565de52a25290923a5a18d8b3094338
- SSDEEP 12288:ENsfYiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9b:VYCMO//35gUKSJozCh9bEx
- TLSH T152850119C26402E9C0AE6179CB965A01B3333C6593E2D3DB16D1F57E1F369A0ADF9B03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 e86f38392db1e297ce155f5fd72a6600ab9c512590ea184a34e72049a0da4421
- MD5 f7feb324ec8bb5304d2efb5e45309092
- SHA1 269b438c99b74b045f0bff9ba3cc360a12b91d1d
- SHA512 e556fd0fcc69f7c57fbc534ed0d9237fd5cec7c721fc4b3c26754dd8963e7c870e490009d865926704d5f5cc2284d300b15c91a03f57d7f316dfee1193f64af9
- SSDEEP 12288:G4iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk97:G4CMO//35gUKSJozCh9bE9
- TLSH T1547523208A351C57E4F1797409A7642936267BB5EF8A5A3B3C27368C247BCB0F93460F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 6fb8a2d20321b03c8bc5cedaf2e4e0c2d1b6d8034e453aa988bbee0bf8442be6
- MD5 7d92033948d915dfa2b86df303bd36e3
- SHA1 270a29d925de384ae278878aa9d633e35f541d88
- SHA512 5f63256c58d0a77c6c981f81604e10e516140e1e9615f60a4d63922184be7fa2fd8e2aeddbd31dc9a0043bd1c4a324e2123a04d080ef8aa8ddeac5b4b9c51a00
- SSDEEP 49152:1a0h2GEkuAe73q3pp46zwwQuCN/3Hh9A:1a0hNYG4JwvCN/38
- TLSH T1F785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE48E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.6MB
- SHA256 bf722858487df6603eda65df8a8c924b2860c30db19e70bc911f17b505ea7ee8
- MD5 116451cd70adf70c6efcba17678ce9fa
- SHA1 6ed1afa0430f8e105dfd9cff687d37871b6b8bee
- SHA512 af90825b9d96b21da4e99412a5daea2cb369afe8520b0ffa6483dc32e9f2be4dd3970b0b4110d9bcc8e6660f26c9e7ee62a81161b2001e15a7a1dccd5e26c5e6
- SSDEEP 12288:GhbHjfX7iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9T:GhbHjP7CMO//35gUKSJozCh9bE5
- TLSH T10E75123D166C20DAE0B1E17D4596540AE731BD66171667FF26A282BD0F3BDE4AC38F02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 175d1904f05f58ad38ba9640d321bfd26f4c9e3f536866d8c67f761aa77ffb70
- MD5 09ee06a6578e4cf6058784f42a2235a0
- SHA1 80702d42d8a86a8e8a9b8c5b6157912d552cbd7e
- SHA512 da6a8829184153e70360f447364af57f1d32bd8b362005f96b88ad322c30c438c5d15e1e2e5220c3b0761793c8a037b4b564f4ecdf1b7b7762c55e58244f4cc0
- SSDEEP 24576:X3YgnJcRTk4yti+R5dBR/zCMO//35gUKSJozCh9bEB:XIgnaTk46pBR/zCN/3Hh9A
- TLSH T1C845BF2DF2B910B9D8A6D136454147B5FB71782D1F209ACB0170C538AF1AEE89E39F1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.5MB
- SHA256 a868fd51a619b62db5a344316121054f144f9203e2da46186e11132617a70c30
- MD5 6bdaaed4f3dbd4084c1294aadcc784d9
- SHA1 38cd97eb8998841c72391e60bdc7233517ccb44c
- SHA512 217aa63a1b8dfaf08ab590e487a76fd1a6be174d47dbfafeb91af0d4c05df56d38ab2786364c1d1ad0303f48a6ac90db0f6202471d7402c9abda9801f14fa951
- SSDEEP 12288:MkiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9f:MkCMO//35gUKSJozCh9bEF
- TLSH T11275232449221C9BD4E0B9B909D7341D36217BA1E79F2BBB2C37768D266BCF0F53450A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 9fd8cd3a6a2901da2d1c5894b6be22bed0db43f225004400ce62329035c6be94
- MD5 244f8b8bb5314a3dc5d7270be981b2ef
- SHA1 f1bb5d0db421e06ec65a975180192636a6aa9686
- SHA512 2b30731705492c24eb7155a79665416d1cad1a9147f97629eff45417ed345a3f7ab525afc5f77c3f70c088a9253df508a5ad34d4e37a28475077456d7ebb31f6
- SSDEEP 12288:BOb9A4LWOsvAYFTZiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9N:2pL3UTZCMO//35gUKSJozCh9bE7
- TLSH T150950114E7A400F9E8B7D13C89A29916E272789D0364E7EF07694B591F237E18E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 b0ea6001d8159a4bc34e6ae59db66b3e4399c5394d8c510e4b54ca89a4192959
- MD5 635fefe9dbad81520a2f7d0a3c3a6a38
- SHA1 a82da0feca4160ab95ca9b3378da4bbcfd5f7bef
- SHA512 0a8fc24d48b8351c500973c13c3591e631facc3875bde299439c5d488c7263d7476c18a20132746229266349eaf94939a3f488074c0a05260484636304c413ee
- SSDEEP 12288:+pFtpOViiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9R:UOVCMO//35gUKSJozCh9bEX
- TLSH T19A75122936AD10E5E0B5A13C4993520DF371B8B6575217FF06A081AE1F67EF8BC39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 446d025aefef9dc2e4d60acd6538fd87568d085afe28bdbb952c29304d63b5d2
- MD5 f54e15da34e6cf5b45b51dc5fc7b1b39
- SHA1 33197814e2b5022b16ac98b07e1893d99f8da9ae
- SHA512 09895e79345bfb67868eb22c4acf0f24a4ddee58cef1d2e3b3b546be12e629071671dde6a21dce78a37c6ee19ee878894a9becc147038c6cf4d79fe53813cbab
- SSDEEP 24576:67NM9YqZqmWMUkPjZM48Mv6bEhsoCMO//35gUKSJozCh9bEm:67cBWMpPjN8DbEhbCN/3Hh9A
- TLSH T1A765AE2E6BAC81E5D476D13DC9E28205F2B2B4611B318ADF1162833E6F37AF45E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 59b327d98680a3fa58137c019dee384380afd1a6b5d55f71bc4e9d852636b023
- MD5 8bd932a98735a708c01ae95e20c33ca2
- SHA1 3667116211027b589c654f81ff192e8458a5afb2
- SHA512 d3162e7cfb554dc967597068e5cbad89d6c54cd432638876296f5a13948cdebfca9bfb70e1163ae75a71ca2d7a0e0a10560ba8ee5fb8d81e1b40a82076834b38
- SSDEEP 24576:mW6BApg2YuyuNDYTabvcdvNYf8km1SCMO//35gUKSJozCh9bEp:mF2YuHNETovAvNYf8kmICN/3Hh9A
- TLSH T1C7857E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF45D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 37c78b95ebaa83901c2dced342bf85fb9f5fab5ebca4928668cf6f69ef915bf8
- MD5 440ddae163aa8b9a39798590b96e18be
- SHA1 eea44f3e3f5e0e1c9da9274e57f2aa9a3c3b1754
- SHA512 31a1f9eafb39be93b55946af21729fc66103e96386580892ea168455693a104ebffbd60335d563453b922861ac26fa105fd34a3b100a1f918bb02736346d5822
- SSDEEP 24576:QAFs06+Omlf3NXEbTohCMO//35gUKSJozCh9bEz:lFs060lVXuOCN/3Hh9A
- TLSH T18965BF3F62AC00D5D07ED17D8A97C91AF6B1746307256ACB0160867E3F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.8MB
- SHA256 66112a660904fbc57040d510259d21f9d1f89ff6524c6598eca8af4c88e65828
- MD5 13c7f8315efc3d6d0885820a1a26b52c
- SHA1 bb898b192dcc4e66c9636fe5042113f60206e977
- SHA512 351fcdf916a96df21c3a57abd8bce23e5736ca6e19a685bc15100eb7161ce28539858d98e48a086bf6b515e07fa4190d26e441455a9a3d14e88aefeffcea3b7d
- SSDEEP 12288:pCJnJ5D3VkrDzxIiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9a:AJnJ5D3WXOCMO//35gUKSJozCh9bEc
- TLSH T1CF95D03DD2A810E9D4B7C274819A2656FF72387D2F226AC72874D5353F12EE0A979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a4c759839a89f2a25cab34bb056445fc478e28d592642f6f91c8e9d21f3445c6
- MD5 88f356b9e25c47e819eeb052030362c3
- SHA1 76278ee5aa97ba4c1332845c92615c95e766884c
- SHA512 8efb2283ca04950652ecbbceca50e2667e6764e46d1c56e79d17d50fe1444c3d911d634b3caf19cda1a52160fd6c721a33610883d037e2d80e11e3a548d68e2b
- SSDEEP 24576:4EPghm6/7IIXdwcXrif7qQncjlP65i3VuzCMO//35gUKSJozCh9bE+:3g06DIKdwc+eQnSt65aVMCN/3Hh9A
- TLSH T11D955C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.6MB
- SHA256 737288bdd1a81e737ee5b73e91c0581d53208b0f6227daf074f13dcbd2117eb7
- MD5 2d1429dc868080ee4682f04112050644
- SHA1 975eb8cabec5462c4cde105e159581a0f2373245
- SHA512 e48888c5002034c772bf795fa37c9c0427e1f46fb9087dd8cea1dd377657e9b82512400e1eec088740722e25bb12716b19d1e21c59c0fc04d6f42c8d809948af
- SSDEEP 12288:wEP3Rn6iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9z:Ln6CMO//35gUKSJozCh9bEd
- TLSH T10675122D1B6D70EAD0A6A07D45928509E372F0B16B562BFF19A2C27D0E37DF46D3CA01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.7MB
- SHA256 e1189224c9cfd3505964e2f8501b152e57697730eb69c59f02efb77747e18e61
- MD5 db34b72f969edcef3c13ac4a19e613b9
- SHA1 2f01b661636f751b8e6dacaa6dc104f1bf54575b
- SHA512 9201b579a2627691ad84408c997882ef30bde10b7b6668cb57341f78cd7751fb303418be6a53535d48835995750ce8124705df5594c689fef5a9b61d80c7048a
- SSDEEP 12288:mjkyLiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9g:mIyLCMO//35gUKSJozCh9bE6
- TLSH T1DE85121413646496E5F556388AA35054BA31BC70AF2657FF28A1F73E2F37EE0B834B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.5MB
- SHA256 1590c5e6736d7e007b8523c7291d908ddf40ca7b6366842b6bff261ffa5e5bdb
- MD5 0e1e4f44b28077bc148a6c1faf93e15a
- SHA1 34af1f94e0291538ec967dcd90b81fb68bf2ca7b
- SHA512 f49a24d4f44748db0de4d12fad9357b8350b22816a5402605e5ed277c92b6f8d5001db625363f23d655abf3c1981abcaa5df8e24f4c919ff6b3b0f9ca5045800
- SSDEEP 12288:UyliiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9g:hlCMO//35gUKSJozCh9bE2
- TLSH T11975232805322857E4E165B805E7280976713BB5E78A3ABF1C77B6AD1A7BCF0F134D06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 8a559600b760a3a855d12bf3719bfe981f6b40a4c72cc52a9714a7285e685152
- MD5 969a28d0a4d929182ff2ab9e5a2bb773
- SHA1 4a7af74837da847a28ae472124509a632fb12163
- SHA512 102e0249db06fae8640ae1fa01d7cf39dab001439ec80813c3e61047e7870a6d5ae365c688d7676134137512bb6374cbf42bad63194662362f8decf80fddd550
- SSDEEP 24576:yQ9MxZKdcz9dw3QCMO//35gUKSJozCh9bEo:yVKZQCN/3Hh9A
- TLSH T1A6558C2DABE9099AE173D27595A250C3A633B4311B35D6CF2448D03D4D7BEE8AE34F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.7MB
- SHA256 ef5a56a6dba5475407de1a7a953898ee602186753f0edc44d70618e9ffb9041b
- MD5 bafb1af0a273247bb431b0af3556cd58
- SHA1 8f1f4b966ab87f1e90f8602cf5732b6e6bd11a07
- SHA512 fbe9f84f0ae96a8c9d6cf73de77c4985d0d0182daec800543348e48ac951c46a26157a8d6e8678934d296c35610191132511f28dbcacd394386d3108140d9f32
- SSDEEP 12288:vyoKo2JRple9p3iiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9b:vyocDAp3CMO//35gUKSJozCh9bER
- TLSH T1DD85F11FBB6A40E2E0B6913C89868605F773B0705B6257DB6592C33D4F679E8BD34B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 2444bf8dd12f9cbffd6698d38790a4d9e04fac01e0b7adcaf422c28a7e4b2fed
- MD5 f06926a6889636e5ed93368311136007
- SHA1 bea1710d1a776c24c3a1816798c7b4ffa1c9c475
- SHA512 b7708077afda51645d03021fc434c951e68cccc09038b8d17202156e5323906f6db12b046f36b10aa44973c77708bb4f0271a8d19aa64e757a215df2f4ea2311
- SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK3CN/3Hh9A:r0zuNIZCN/38
- TLSH T148A57C3DA2BC00A9D9AAC375C5461366EA71742E3F2055DB01B0C57CBF2AEF19A38F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 2a7e89ecdf1a6a64b491bf3d4da023dd1568cb8dcf98dcc52bfc44b0d16850cc
- MD5 7b0e1e4ea1577afda2572beb70c3f0e2
- SHA1 99a2aab29dc7499c26a281269392c38e1746ea7b
- SHA512 f625a0d2dbf03518cf768a3dd1b882c272635193ac5bd48caed322c2eb91baed0d5ef0fb06816efee254ae99b94b2d37c05f0f217e80a31ed996f33987df6e63
- SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYtjMqb6CMO//35gUKSJozCh9bES:jTDxR+N5YzTfjM1CN/3Hh9A
- TLSH T14D55B02EA7F815E9D1BEC5798A23C512FB727821033193DB4260C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.8MB
- SHA256 e34d0353766f4234983f13cd830cd45d81731fcb2bae2c620d825114fbb8809e
- MD5 79ea6a0240f848c8bcdea97f8f7c30be
- SHA1 dc8f1920860586402b6e4c866a483069621969ee
- SHA512 4aa2d7b8b695d26fa0ce63715f2947aa0d3f228e2e451fbf9d050fd847056d3a5a3fd0f14fbeb6ee66b09a0b19d5321fe6e95dea66395d5f5eb44f924db9c9d3
- SSDEEP 24576:lTMdOz0FFS+imSLWCMO//35gUKSJozCh9bEb:/0K+imSLWCN/3Hh9A
- TLSH T1CC95F13EA36D14E5E47BD17D9A439906F672346203226ADB06A0C1BD3F5BEE4793DB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.6MB
- SHA256 83636f19e4986daaf3df2eadb1c3c7c6caab01a1f1198413af44c34bcbff006e
- MD5 4c110147448b4b362406eb203c39bc9c
- SHA1 97f42214d55dbd94be4e3268f380b0fe39c133e3
- SHA512 e80633d3900ed8859e2ae5f6e4872d83effea02b07d76791365c0b8abf1e14246570194381d9c9e3b6bfa5f81cfd57f575cf539c93188400371be35bcae7879f
- SSDEEP 12288:l4KZiiwnMvOlqYHC0zL5g0QGGYwbSJozC6o9bev2Bk9/:hZCMO//35gUKSJozCh9bEB
- TLSH T16F75121C17A834D5E4F1A5784AA71009A630B97263592AFF38E1D6BE1F37DE4E538B02
- MD5 SHA1 SHA512 SSDEEP TLSH