Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
- Size 6.0MB
- Sample261102-ntabaasyhs
- SHA256 d93d6a037b4a9d44945b2820489327bd70d126c57445926fdb3e2fc47cb536f2
- MD5 af9195da3dc5184c1002df6106c84f79
- SHA1 5c54a693a04b6d24cc56022c8359fabaf3affafc
- SHA512 7ed6a30e67122a700ea8d5fbc6db1f4f6326b67f5f127e0547e6e6bd84b77f3f49d192cb08025cae51eb3d936698f03304a80d4ce68ff0e62bd554debe2f995c
- SSDEEP 98304:GCW6lpZfgRld1LiOsZfgfPuIw+p7012zS7rPuIw:GMbxcUODbwNiobw
- TLSH T1FE56BE13F1DA01D8C05DD1B98B4A9233EA71BC494B21B6DF0A9077612E76EE4AF7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4416 alg.exe 3224 DiagnosticsHub.StandardCollector.Service.exe 4608 fxssvc.exe 456 elevation_service.exe 4136 elevation_service.exe 3108 maintenanceservice.exe 1232 msdtc.exe 4968 OSE.EXE 3192 PerceptionSimulationService.exe 4672 perfhost.exe 212 locator.exe 4084 SensorDataService.exe 332 snmptrap.exe 972 spectrum.exe 5024 ssh-agent.exe 1576 TieringEngineService.exe 2792 AgentService.exe 4232 vds.exe 2444 vssvc.exe 1060 wbengine.exe 4308 WmiApSrv.exe 2504 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\vds.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6ce59feba26b1277.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc59ff0dbf6add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000556de512bf6add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047e4db12bf6add01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000176d0413bf6add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030799313bf6add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3224 DiagnosticsHub.StandardCollector.Service.exe 3224 DiagnosticsHub.StandardCollector.Service.exe 3224 DiagnosticsHub.StandardCollector.Service.exe 3224 DiagnosticsHub.StandardCollector.Service.exe 3224 DiagnosticsHub.StandardCollector.Service.exe 3224 DiagnosticsHub.StandardCollector.Service.exe 3224 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4280 2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeAuditPrivilege 4608 fxssvc.exe Token: SeRestorePrivilege 1576 TieringEngineService.exe Token: SeManageVolumePrivilege 1576 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2792 AgentService.exe Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe Token: SeBackupPrivilege 1060 wbengine.exe Token: SeRestorePrivilege 1060 wbengine.exe Token: SeSecurityPrivilege 1060 wbengine.exe Token: 33 2504 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2504 SearchIndexer.exe Token: SeDebugPrivilege 4416 alg.exe Token: SeDebugPrivilege 4416 alg.exe Token: SeDebugPrivilege 4416 alg.exe Token: SeDebugPrivilege 3224 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2504 wrote to memory of 4248 2504 SearchIndexer.exe 110 PID 2504 wrote to memory of 4256 2504 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_af9195da3dc5184c1002df6106c84f79_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4296
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:456
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4136
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3108
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1232
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4968
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3192
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:212
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4084
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:332
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:972
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4676
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4232
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4308
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4248
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4256
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 0b9999faa997292a23c6fdc4ed165102cafa8c4c1b39c7e9cf59619f646b9a32
- MD5 91f66f6b24d42423ade9dd4af7a15bc2
- SHA1 aa12b3743a8f5a748cf7921470a1ea51fe14cc44
- SHA512 a937ac2fbbc7c41977f5bcdc894b6c7dc5a3c231966733e4c747e52935988530b816cd3ff1e664d0047980273fc23edfabb1e8830b3087432a752816a85931b9
- SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbWPuIw:S3q6HjBtPuIw
- TLSH T143D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 c20ac8af4b3e38275968e7b1937a5cf167d072b072b6d1f759d5eaffa1478ba0
- MD5 3b632151b5634092caa7869bd56f7cab
- SHA1 be96da8cbf5b4089546601a16d8750469c9b3fe9
- SHA512 b79e717a5bfc0ff7d51a1309a68a688618e98dcd96657ef9a3460372f406bdda86e5c579cf7d773e6d624d185f6b4923232ee6e5a46a05921dc685cdb779f2eb
- SSDEEP 12288:U1XLsswWkxy2lRq2czACkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:yXYfDtczAutd7mPuI7cpctubZ/
- TLSH T14A750128A7E408F9ED67827CC8A2C541EA3378554764E78B03E4D6661F333D85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 f26f5e5b2807bc1b542f1e7d2e3f5f9157c68b618d56549b30315c029fa13a45
- MD5 95a4981555e8081603678a1a19bafe1e
- SHA1 1073b60574d51721a67970496a8fc791a3ec2854
- SHA512 7c02f33e0abcea004a36c5075b67daed3253bc5c541f9d57acfd49e3cb709d9c7fdfb71bdbd296daa0648ec240dc832d932b80525396007abdf6e83c6e672c9f
- SSDEEP 12288:RXZNYVLeyUji0h90ZD0wxpGZIVuprHsxkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWW:X0Le5ji0hmx2rMTtd7mPuI7cpctubZk
- TLSH T1D1959E15F6788771D073C0B9C5D2A68AEE7230865B308ACB4286D77C3F676E68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 3c1d98c6a155bfee31437228405cf12b56ee44bc0ecabba9c957eb3ce4485c54
- MD5 028d2d62ae40636c8429092fa2796a4f
- SHA1 7814102f9b8e9aaf1a41a62b1fee7b83371aa5b6
- SHA512 be3dd9e93ba3f567607a1a1372969d3b2612d399d904d11751967bf8ef2ffa9b404d3da87de9ba083178defc0729c276904449fac1f116cc611bafe095e8bd83
- SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuJtd7mPuI7cpctubZ/:s/ezSC6vUzPvxHjysWPuIw
- TLSH T16B755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 55fbb4b60a78c7b5ec9e0a9083fccf46002662cf08cd26ede05fba8bbe0ccc9d
- MD5 53ad05e7010aae9f3323b1f4cd23f2a3
- SHA1 552459ebe5eb6205576790d740ceb86c9b0a64bb
- SHA512 9f68da45e9fbef7e0946760b5d7c4ed9378ec23bf5a1bf8a674afa161fef3e7ce455146872905bde707fd7011b0a74d5a73c947ac6e0ccf0c2bf90ba67ca517d
- SSDEEP 12288:pVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98ukt2VtKqbUb4mNdonIwsI9Ec7tj:pVbqPb88hv/l+6Std7mPuI7cpctubZp
- TLSH T16E559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 c93e3a1bf65ef3ed8524b4c473da51be6dfb1d19e20e4e183347ff841889c535
- MD5 0efd123e9cfd8e20480f33aa24b5db64
- SHA1 b0c84e2dbb270e914ff5936d8e93ef21929909f1
- SHA512 f14de70ab27c866e42d1af55367d496447f0abc14b894d3bc167e21704d39f8c0f1191c989d8e1c7e62c10ac31589dc8dc8c69bee416da876faf75436460b3b0
- SSDEEP 12288:oQ9kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDy:oQHtd7mPuI7cpctubZm
- TLSH T1355523188B2D8CE4FBB7C1B0F4F2C9D27A174E5858AC5352C647F39B1A7913ADA32191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 0ca974ad83ef50b2604e1808c313dc4d915f094ada94823c024bf7fb9a7833b8
- MD5 d13f4919a03256d594ecc9a9e0f70410
- SHA1 f4bfd8bdaafdcca4f769f85fb1345a8fdb40110e
- SHA512 b61eb4ebc3880e716ae5b70a758d306ab786c42f50d413f1aa4ce971249fb8c7947c24a3c1341709be7e03e1ff672974ceb9f07a4e823017298eec5d1a502ddd
- SSDEEP 12288:GeBNUbTVO86Umkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDB:GJIUqtd7mPuI7cpctubZ1
- TLSH T16675CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f2a07d4a3cebf6749d1d005ca1fefce24797ffa3d765470e6942b1736ee02768
- MD5 0b6ab634f641d1ebea14dfb7892b7500
- SHA1 6af6e7aa03aecdaa4de73e40f6f2fba25d4ed430
- SHA512 56e2d9c7b74648015985960eb620a8ee66a79aacf5d5b4f1af7264e2b1af9f6bb1373b565a7415f0a6f8902c0d2881f5c1a92fdc97ad9444142ea3d632ea5ffc
- SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:eQvGAdlCEL8c/yRNw5CEPuIw
- TLSH T18B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 44fdd098daa604a795fbcb6e7f4d5c9a1cb6a0e8e0c056fd81ef605c53041507
- MD5 b24d43afff3199c72699b6cdc900cd12
- SHA1 ef7385d3435a80b915d99dea711b4e9da8df5829
- SHA512 3dd2b93cd7b93627c86341707178d4768b58bd0349130623f17a2363a2b04882c7c19aa21772ce992980e91e2a58c33366c7dfed5246993fc734337c87edb3ba
- SSDEEP 12288:GAwSfxL/2Dc30DLLmt0LDQewsAjAkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:bpewsAjgtd7mPuI7cpctubZr
- TLSH T15475E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E59302D26776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 2e186ddd9909a84d9bc1d875b3734659f6d76d73e64c8c2fce4ce0a4fd53a14d
- MD5 ba77b147ec78c833d660a7d5f643f0cd
- SHA1 71f74550ecea8a9ae4c6198ff40d40dcc18c7e1f
- SHA512 27d5ecf4fc012bd53b03eaba0c72b3455ed0870715e1630a716118b2610e308d6f30d54324e064c7e0357a9d3f49c66da1adc601de88fa3133febcb94bcb7a34
- SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvbw:fUEtQevvqc2W1cpV2EI32v
- TLSH T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 2999cfa80a016188e76f8d6d2de1ed374a6ac80dd5be491417b63936953acc5f
- MD5 61801e1ed54f7d0ce5e3673a07aff234
- SHA1 3a7e291356bf068263cc3236036b0e9b8fd9a8bd
- SHA512 d9e20e371a63286e14385faeb4d3fb3cd3a6f69cd51bba70ec4035d4bf36d2791cc4a5ced01518a8f35e93f4ac13fca03d4ad5534d156517db5e0195a883e47d
- SSDEEP 49152:lCbRquA/m2yL5zifFiV+XenmE3/zAWPuIw:yoqHVjnmAPuIw
- TLSH T1A9D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 4ee7020953ce95820724638ae2cbd576bff94637aecd6338a0dc4a9153cb491c
- MD5 2a1a7404c075b88ee541b078b2f12def
- SHA1 cafd08414e6b4c1fc1866e289661322ec1370910
- SHA512 6a04ed88c585113fd0538364b5960ef718f2446dc758d83aa96d134f794b06786aefce826fafb43c12f6d08562699f7ea30bf90bc289f17f8515786263da857c
- SSDEEP 24576:oAhGLJIFoiwtA5l7S53ltd7mPuI7cpctubZV:oAMyFoiq5VWPuIw
- TLSH T16D359D80EBF945D4F5F3AAB899B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 2372a9c8955e20bc102eebbaa51e680db185f30c3cbc9579b1f0fd8a9294e78b
- MD5 a675202851c7493b71477791f190d0bd
- SHA1 2a5e26d1ef21a7780159f7bd6bd4907fae37b725
- SHA512 35840cdd10e9bc469b970ac8be96323b778b3db7cda499bcd82381afd4d44df507446ba5ba23a9e2d0ebc2ee16fe5ac819df52be52c8e1a788340321140f4f88
- SSDEEP 12288:7mw5HEjsChNJBFgl0WDm+Crkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD2:awukOWMtd7mPuI7cpctubZi
- TLSH T19C75F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 55be5df2e5ca68b20a3b065f0dddcb1f54716807e0ecb2ac834919d5b5fe38c1
- MD5 e7bf9ea3d784fc8382f181fcf04802b9
- SHA1 7de865920e83bf70adc9996b902c7c555eca6979
- SHA512 20ebb50360484459966aef56c09fcbea488da36747cb5dd780dd5efa7e0fc4018373464ef16b54a036a323c67af0216f56c7e91011598d8abeedcbb0a9b49922
- SSDEEP 12288:vWZ1Iywkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDV:eZurtd7mPuI7cpctubZR
- TLSH T12D65124823E864F9E2A3C278D8F1CA81E7337855277943CF4616935A2F336E69E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 ecbad81d20f2fb988df349913c3389cff3de310dd86158043ee988e85ac11f5e
- MD5 ab5056b83e15e4945870eb86808f7b4b
- SHA1 296f7e08143ef4bffccfaffa2e2287212d0c3470
- SHA512 521b828061fd45a067d40a566b957ab380de0d334df82e59d4f6d168e4bfe67b7a65b48e7310dd5c64a1b9acb235ff3f2bed0db49d56d45d28f0a40e7f765ad3
- SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:jQRQyi36YOcPQLvw2gAf+PN3xPuIw
- TLSH T1C1666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 076589f6372c5e9f0285c0f9244e475ce44410fc46f176b34d18d70885d512d0
- MD5 a7ca188b8a9f896b21816b305ca9dd79
- SHA1 07f4c191d5c9d4ae2ccba4dcd0a8202175587e93
- SHA512 a308d125625e34ce48e84be3e604e24e9da40ddb756ee41bac6aec8e0a017521d9d0818b25b2f128f55e34b0731e50fa027b88bf0abacc03234fa1e679346119
- SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:wQRQyi36YOcPQLvw2gAf+PN3xPuIw
- TLSH T1C8666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 5a6948f8f79df3c27b3288cc68fc36b0739f2befae3372651e25726cf391d126
- MD5 6931d45dcd76e56a548ffd94d604bda4
- SHA1 13dd8f148adef96e2241ee54684b052d2bc507d2
- SHA512 b41942951c32c1bbf12bb0526e4f1364b0dee4dd606ce6ff550c3548a14cde6eb1898a39e1a9f873be48531b8bf081d440234a8cabb00f788033ae38bd269f30
- SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0btd7mPuI7cpctuQ:y68Qg55nhheWu7PNU3/QWPuIw
- TLSH T137B54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB850572161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 9989b83bf94274d4599ef9fc8ecd3623aeff5b291dfa23754df4e3c458c77735
- MD5 21582194894649de7adaef8fc8e7a6c8
- SHA1 ef29fcee3e26291ebcb854829134c88991a1603c
- SHA512 fa0e172e712778bba66ca4508b3a1fcbaac68cec2c9b82ecf2f8ae575512d665572ed51ee3d32d3ac26cbb763f421a1238e5afdbfdf68e4c7bc24e03f3a9f737
- SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:Xy5112gYy5azzVvL69nLKnhZ2PuIw
- TLSH T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 12b1465b2ea6c0276f86fdfc65c74514c55944bbb94a95decf59ca3c603a99e0
- MD5 13a7f44e4f61e014c9432d36dfa085fc
- SHA1 2850ac384e3a0ba4960cdd9ee96d00acd92a956e
- SHA512 3488a48df51dd78fa9d66beca6c41ea981fd8751e1a5441d2159cad1797c06ba79e572e50f8615f308915b00416067366a6e9e2903904bf265f61ebaa204c5cb
- SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleWPuIw:Uu6JmVxd2dJPuIw
- TLSH T1C4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 b3f7bed477a9779899e3997a862f93d2d1ab61c306d1eb79ebdfc74f1c897558
- MD5 1e7ca54ddb29811152451c9d607724e9
- SHA1 e3743ab0841b5e7a13a11124c2107b073f340abc
- SHA512 56cfc642d1b532de15346a0491a9c7565812aa51479fb72586cf18125e1edd379d0908ad8a6775c8555257756ab33526e0f27cb34dd483d4b97f2a182166ad37
- SSDEEP 24576:6hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3atd7mPuI7cpctur:S1hpsNoJpF1A6UU44CwH7R4xKWPuIw
- TLSH T1E2B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 11be50e958499e0ce504f5e014b8cd5af1d675ccd7304f205d755e555adb94a6
- MD5 dbbe3248d78ac406e546d091ae500582
- SHA1 be973a367e5c3988bd18d24924808e6cb64e6e7d
- SHA512 a7d731585ceaa714e7909bfde9776fbdd4c3e4f4148176af9cedd5520fa16da216e25cc48692a0a994cddb9da48dd5f8b2254fa3cc15be7a261782619b5fb4ff
- SSDEEP 24576:e4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqrtd7mPuP:iSuZQIY0Be2KRRVtOnks6NMHqrWPuIw
- TLSH T14DC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 2d5b493d7446e517e66cf840336b9cb9f24a0ea0cb86a3e8f906a99dfabd217e
- MD5 866c72984078940cabf11da5608ccd95
- SHA1 b598d0a00ef4df67989216190cd2df6cef7c2348
- SHA512 4f31bb2c2ba41f4b6d62459f484ee43275f8047f68703e967f9810da13a85c2c4a120d327bf0ae80e1269fb94ad4f3b2dc603efc30895834d608b763a1db95cc
- SSDEEP 24576:fhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLatd7mPuI7cpctubZu:fhtSn8EApI0figngiDn0AP5wuWPuIw
- TLSH T1E395BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 e53fadc507782efb410df73b70c5e56c5df27d6ca43eeeaa96cd40b6b92448a2
- MD5 1f278e5c14aba5af809a843f17c96e61
- SHA1 ae0437d9531cd935899244059169d65c781f91bb
- SHA512 a3c8e4ec0ac7d9ab03968fdda4c3bcabbe3bf8dba5e38b32e4243b31e69c9b13b4b78e0444c1f0c25d48c3fcd06890cdcb8db15e717b120ff07b34e627fce386
- SSDEEP 12288:NVkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:N/td7mPuI7cpctubZ/
- TLSH T15E5523089B6E8CD5EA63C1B0F0F1C9C1BA1B4E5DA8AD1352C74BF2172B7523E96325D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 dfea5cf023b21f3c0dfdf9edc90279a30ed57ec02365bb1ba17968a2760ef164
- MD5 e2377eef7b3bff15979950a39662d547
- SHA1 db8f34d810620b3f59a26795007bb8d9c4f483fe
- SHA512 6e2de60ff50f24104b45d8e4d9eb0ee39cff6287c557c35c95a687fec1110a68bd07d15b41ac31ac4da2b7daee8ebc45d8b9b6908bf18a2ca70d84082f2feed8
- SSDEEP 12288:/8kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:/Utd7mPuI7cpctubZ/
- TLSH T1085523189B6E8CD5E667C1B0F0F1C9C1BA1B4E5DA86D1352C74BF2472B7523EAA324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 bdd5433bc83e8bbf0b45a919b1517e84eda25a3d62ed43a1b4bc93b9207806c6
- MD5 130f69150deaf84f6fc6e233627561a4
- SHA1 7fc18cd99afb2c20bc3fa52a2aa5860c05a7fa5b
- SHA512 aa954789151aa11f4e177f95a0a1f9bed190cabd6d943f9a1c31acba2b8a28545c975b07af2fed9fc8d318e64985ff152146ddd6c77e58ad93055aab9c6def25
- SSDEEP 12288:i+kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD4:iCtd7mPuI7cpctubZc
- TLSH T1C45523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E4DA8AD1352C74BF2162B7513DA6324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 fbbcd22180a784eae49ce1995eea78572c4fc0a05e15b32c9377a472d89d89c9
- MD5 4d07e215ff88e18f6a72e523a8c83545
- SHA1 7d7b38d6eae40aafaa8ddcd19008cd80d38d7fe1
- SHA512 2f3de9bdb2b3f76b7536c620e2db67c5636bedce9a01edbe48b2d04d4c71057d81482b3990998c656d4c7b42c8178494256ac60a1af77d74eb95a2cdaec39b4f
- SSDEEP 12288:iVPkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:8td7mPuI7cpctubZJ
- TLSH T19B5523045B6E88D4E973C2B4E4F2C5C1FB377D98A939539BC702B24A1F71379A931A90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 ccccc609c94bf3c453d639231efa3960f619170d0cfcbfa142a5c4c2dcf08d14
- MD5 076f9697ad5052bbd084d45e3fc0aca4
- SHA1 4e220dbb84a3f2c218698b523c53ca054cf788db
- SHA512 f0dbfdeba2d02fac479012f51152a5dd97afc0ea5388f1eab163da14228497ca4ce63856a262c6c0a49f33f5b16fbee4af68c78f6878ec4d7601167376f44ac8
- SSDEEP 12288:zXkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD/:zttd7mPuI7cpctubZD
- TLSH T13F5523189B6E8CD5E667C1B0F0F2C9C1BE1B4E5DA8AD1352C74BF2162B7513DAA324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 5dfe027a4b4384472a8366cb25b8b6cf2e0a940e0dfec3d56e6ef945a4425477
- MD5 bea9268f72ee50d2c9120bb0dcb1cfda
- SHA1 c674c180100d3043e1103015697d57346129a592
- SHA512 1109f78b6868edf3b85b45ba8a36dbb21ac197d6b3b2fd0ce507a0bd1f4b43915dee713704009befe9e6d85b79c4d6d147064321bfe22fa74694e30fe92116e6
- SSDEEP 12288:/Ykt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDV:/Ytd7mPuI7cpctubZZ
- TLSH T1525523189B6E8CD5E667C1B0F0F1C9C1BA1B4E5DA86D1352C74BF2072B7513EA6324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 ffd70c01a5bdd2d33de226aad4b836e9a596b900d9ebaec7752a8486fdf9c413
- MD5 ea4b145301ddceba9ec8a5968ca00c31
- SHA1 9e712fce4e660f27662f4059a09c5b67b9778db6
- SHA512 c439e4b8c1a537617787e57bdbcc6aef9d4413df29fb036d983e694b8ba7e1bf5bea985cb1871686294281ddb10842ffb418fd9af88ce840f4c47e76998c191b
- SSDEEP 12288:tEkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD9:t8td7mPuI7cpctubZB
- TLSH T1C45523189B6E8CD5EA67C1B0F0F1C9C1BA1B4E5DA8AD1352C74BF2472B7513EA6324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 80f4472029de85d85ba7e3fbac00d803b16a3756f6120fafcb1856467f349a07
- MD5 fd294355ab637a30d04a7c56e5b49750
- SHA1 2959c11a7fa9d97f380ecc05904f25ba27f3caa2
- SHA512 ec4291443a8719f56d95484027795b4fe5ca86106f6b063dbf6199b467e92c9b0fc1e3c2da6262b067469ba282ac2073040fb4f1f80956b1d01e7d48fcd5893d
- SSDEEP 12288:IiZwbGzzFEoS2cPvyckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDm:LZMGzFVSO0td7mPuI7cpctubZy
- TLSH T1F8750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 5b9f500fd1ee290f1a2be7477f9602da7a9012ec34130dfa48ed1f81fd799105
- MD5 3197ffecda8f30fa9c4f893d776263e8
- SHA1 2e56fef5dbf2c046adddf84297c149c2f04315d1
- SHA512 7a0cbda58a84af91b15e6b942c170c40ff9dfa5c3c6aff47bbd651508352eacefec069a5b3909a35f2ae5d8c108fbe14d0bb245005616aca743ae9f7da8e87e8
- SSDEEP 12288:FZkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:F7td7mPuI7cpctubZm
- TLSH T1B45523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E4DA8AD1352C74BF25A2B7513E96324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 d0071426e4e460e5356c4c6d1001c37bdf18f283fddb2a95f496b29eef66dc06
- MD5 0dcba4ca1dead52d621d3c5568b0ef17
- SHA1 d90343285b9ab09e15695215e5f4147469ddc942
- SHA512 5b0aa4142d757888555b9f7ef238acf238394833c6d21677f6a460f2cff13eeae77985c362fa2ab370a84ff3050b86fec25b84e77b491ba37120945e45e3eabd
- SSDEEP 12288:Vtkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDh:VXtd7mPuI7cpctubZ1
- TLSH T1515523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF2472B7513E9A224D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 f103f3df5eedd5a81c5314a432aa5e5dd1a369e828a9c1d0d1a8cb1f896b4dcc
- MD5 278582ab876ce30f0d14ca2abe5e21fa
- SHA1 06a77d4036359087d6c77f947c858c98fb866a5a
- SHA512 f0ccda1267313f5595ef5af77122aeb0d7694959a202aa85685be63409667b1f3d24cf3f6441fad74cfa57bb7b05ffee79c788165e2829c42675577220ff959d
- SSDEEP 12288:dyPz5L8wkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDx:Uzywtd7mPuI7cpctubZl
- TLSH T1C965120777A520F8D177C274C8A24A82F77678354B248BAF479453772F332A59E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 8702dac0feca1fab4506bb4d7da36f0257e7e7523cbc9dab5669e7c497fed05f
- MD5 f535e36492373f4e3583dbb8451f4fe7
- SHA1 41451a5945b0862641bb218e5eb1e47bb007160a
- SHA512 c7f047ea9e646ab147bcab54419e6a7298aebbc52d23982c70920f040da468d8c8885ff5618422311b01154d9188c4f98eda69b084f77a83aba9c4c770742388
- SSDEEP 12288:oZkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:o7td7mPuI7cpctubZD
- TLSH T1B75523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF21A2B7513D96324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 89529dc04163f87ef0075237020e3f5a4c3bb670a20fbd1c0bc931c9e25f3f5f
- MD5 9f8c258ef8f3836be402f5ed880d27c3
- SHA1 614cbfc7d8af64f72821a1d953992b11aac24108
- SHA512 63152916eaa57c0237e212f10d9c83d22beb6123864451fdee6900722bdbabbf9cab30a1f4936c7cf005085524dc7a84286353b487e6e97043b66fb3a93cf7b2
- SSDEEP 12288:6Zkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:67td7mPuI7cpctubZD
- TLSH T1D15523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF21A2B7513E96324D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 59e12c14bc3af3de72c5a79a8ca5ba9b91b4c8f307efd76411d1d97075aa5fa3
- MD5 ced0f0d05e6c4026fdd5b3ad2c6f2ee5
- SHA1 6d6a8bd1f7945e2f2a2acc84411cfce93e55b929
- SHA512 159390f61ab185a6eeaccbead118aed29a8c7b9f3e53ccf31bb32bb344ab8f4dcbaba90c29b8f7d35db1119c4db5f685fb77fc88bb918137bf8bcc2e1e898cf3
- SSDEEP 12288:0yPz5L8wkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDn:tzywtd7mPuI7cpctubZr
- TLSH T1A365020777A520F8D177C234C8A24A82F77678354B248BAF475453772F332A59E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 42ae602254a8d78813246336f58b2cab69a4c952f57f3df5f24d08b58cf3bee3
- MD5 538a796ff3c65220b3b1f2d5943c7d8b
- SHA1 ad9e11ec4469655650c963801eda9b5a45c67e89
- SHA512 f209a25dd6bc958a17f30658ece08de76c52b7e3fa3055e2ebf69b0a077fd92fa39048eea90de82957c2a651ecbab8927ca52be19f975351a5639240f0f9e41a
- SSDEEP 12288:WCd9SWYoaLHF3z0z04PDvhOkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDj:3TTaLl3z0zDytd7mPuI7cpctubZ/
- TLSH T13D7501A4B3504CF8ED67813EC8658942E6B27C5A0B74C71F03A9366B1F333A15D3AB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 4e93662ed31ca924e4b3bea6b84b6305f434f857019686afca048b02ab8adb0c
- MD5 0c09316bf6bba41fc034f5e8bee0ba8c
- SHA1 2e8b745fa32136b8668e041d622055bf45d6adf5
- SHA512 2ecf2da6674c1838ebd099970594a8e9a153ea5de94ec8ba720c272c8a6ed8feb8c4886f7b7b29ccb980026fe6dedbb02084a4434d5f0b3d4742e8500113f2e9
- SSDEEP 24576:gcP4mcvIjkGOxhKP2l71SNKbrh/8KBDtd7mPuI7cpctubZH:rP4m4IpOO67N8KZWPuIw
- TLSH T1E365AE2DABDC0096D0BB917885658A4AFAB1742A1F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 c414a4ddbd7204933c9314a948ef062632dd3ef1ba6bbce38d3ad0a25211514c
- MD5 5d97b1ef3244967090c3200106600265
- SHA1 1ceb29e2f0d777cb4829ab713d22e122c1b665c3
- SHA512 b7315cc33e994024d88bb10e31020c607ff2ffbdbbfc7e939e4a20c64dc272f36f23f9f19fec1f31ef980ed9db0de6abfc20eef1e0f07fde672cb027bf1dfb2c
- SSDEEP 12288:C8sfpkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDo:krtd7mPuI7cpctubZs
- TLSH T16965F109D39841E8D06F9275D7928A81B7337C2597E193CB43C1F23E1F762A49EE6A43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 4efb6d529da98eae5fa146fe7f9e54d93992311e4c9de954a4dc4cc9ee90f427
- MD5 a61b253098adc9755b0576b1b9ebd11e
- SHA1 acf56eed763eb73bac291b0408548daff3dcc3c7
- SHA512 09084351753526f5644c7bbf9562cdb9f7adfb00e155f3772914db0b324dc73da6c67f391ff80fe673f3bf364873673766da46c6cd14507d50f2017dca66b3fe
- SSDEEP 12288:PJkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDu:PLtd7mPuI7cpctubZq
- TLSH T12B552318CB6D8CD5FAB7C2B0F0F2C5E17A1F4A685D684283C607B35A2A7417ADE32651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 0fdfb0ee68b47b8e98860b19978aea4205180bd58db8ff44ffce2b678772d4bc
- MD5 d97f00d2a89f492d015ef1ae40347bc9
- SHA1 d1603ab65606d6e4609b9b364b86dc3e7635a8fc
- SHA512 743765e89c3a357aae2470b215fadbddea06db6c6222a820495f646de8b9170210b59078c0350ed52af015c8429feeea5ad9d3137d00b8fd310844c481a7aa07
- SSDEEP 24576:ToiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bJtd7me:Ta0h2GEkuAe73q3pp46zwwQtWPuIw
- TLSH T12A85AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.4MB
- SHA256 d9b9a12b48bae9f913fada0644020568689d56af1a08ef244f83791d39b2f1a4
- MD5 defdcf62093a3347384c243443860dac
- SHA1 76574312a7e0eac26c845105d2a9fe10daf047b4
- SHA512 77e879b84c94da0c22d670c5c91b2df9c59502534e6fa2e840595323d8a583a80f33a91eccdc53fbbc0085daa948396ca8cb024282c849b4b811fce3e68e4a3c
- SSDEEP 12288:phbHjfXMkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:phbHjPEtd7mPuI7cpctubZB
- TLSH T19D65127D17AC14D8F572D2BC95A28582D732B8291B2593EF4382927E0F37AE85D31F81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 c1f27cd6ff056105b6909e2fef04ff8fe5c8c807f122583d265914e9746f4db3
- MD5 948297e702a4bc0a07064f12ae0e81d5
- SHA1 c902daae95f27b766cebe2fd660ed04e21776fec
- SHA512 f6c0b4f552669f4a27f1d597af1c2b3fd04887ac7efdc02a507c2cf656fc77f21710c305b3836574a967cf82e2a15800f13e41fd3b0ee7db5d119609e911ccc9
- SSDEEP 24576:C3YgnJcRTk4yti+R5dpR/Mtd7mPuI7cpctubZ7:CIgnaTk46ppR/MWPuIw
- TLSH T17F45BF2DF3B910B9D8A6D136850147B5FB71782D1F209ACB0170C638AF1AEE89E35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 f8aa6d0a0b18e1e7d20ae071d4bcc708676b90f985368c5655e5a31a8eec7d3d
- MD5 5457557b7cad75bfbf0a8ab19c3bb3eb
- SHA1 667b004795ab8a0171460aaef73fd237e3fec766
- SHA512 3ff19216dd8b6a8c325f95184200d2c75b52f29a6222cbfc61cfb33ee4826ab17817aadb3046bf0af29b43dbd1e75f79bf017412ea3b70e1fca14644e835281f
- SSDEEP 12288:Hdkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDs:Hntd7mPuI7cpctubZg
- TLSH T1DD5523088B1E8CD5EA77C2B0F0F2C9D17A174B485A7D13D3C647F25A2B751BEAA32590
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 3ed82c857e07bcdebd70bead85fa7a5773bed9bbdf84c6a885f143ee885dc5de
- MD5 25f189fa2fb0fbc9e03cfda2c177e318
- SHA1 492c0a339da1a3285455f80398840cad8ac3667e
- SHA512 999b88d54d2cb2a7c50f1a6bc4f1d69850a82539714169beace4d5c62fe93116a723fc9949f9af524d74f76a0e8c58bb2ca2c379d0af5baaf3b6a0d5486b19f6
- SSDEEP 12288:UObpA4LWOsvAYFTCkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDq:59L3UTutd7mPuI7cpctubZG
- TLSH T1D085F154E7A404F9E977C13CC9A28912E672785D0764E7DF03A98B661F233E64E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 916a04a113160f62fec572f0fc064f107163d214bc4b8fea40951c59e9a8256a
- MD5 c0a0c98441f526b5cd9917b518e4e1e6
- SHA1 feac7de6fd6e497680feb4ba4ffa638236613abf
- SHA512 426a01159b5008fc1e894dec32df47074f9497c780629f848ebf8499f677dcccfe3df8547e60cc203a85d083b50ddcd2fc2795ed6d44fb354b22d0adc991de13
- SSDEEP 12288:qpFttOGkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDG:MOKtd7mPuI7cpctubZy
- TLSH T11B65121937ED00E4E576D17CD9928289E732B8650B2253EF4281D17E1F73BF8AC36A91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 d4263e3655be5496363889d5230b77bb7e1f461272a9320e42b8ef3e5ac6613f
- MD5 84f41c08c93e89abcb2378d0aae6b3e3
- SHA1 62581b75112051cb106addfacbc93b3b79f929ec
- SHA512 423daec9aef56af3769bcab79d8051c32ccf9a764b567fa4f1aeec6924854d1ff5b6f031a9ce3bce61ed00232627d0cbe3c2e18119be16d1a3de370de21b8cd5
- SSDEEP 24576:R7NM9YmZqmWMUkPjZM48Mv6bEhs7td7mPuI7cpctubZ6:R7cBWMpPjN8DbEhkWPuIw
- TLSH T15965AE2E6BAC81E5D477D13DC9E28246F6B2B4611B318ACB1152833E6F37AF44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 8ec0b1f97b3afaa1ba93c511a38f6679642ce3c5bb7407fee26820e2a14df6c0
- MD5 0b8c2bf763c0ee4b818ec1f760465e59
- SHA1 69bba0867f2a85eb30250e5355ed2b5fc9a567d3
- SHA512 c82313e810970242d6a56f1e581c4eb72c01d2ae8f715f1f6823db66b6b887134ffe7547fa2321cb1dc0141853963e5089b65bbae5401cee86bb2a5a7c9a936c
- SSDEEP 24576:LW6BApg2YuyuNDYTabvcRvNYf8km1xtd7mPuI7cpctubZ3:LF2YuHNETovcvNYf8kmbWPuIw
- TLSH T1F6858E2927ED80A4E0BBD27D45B7D286FAB2B8511B3056CF4255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 57bbb1a9acdcc25104364e37e0051f666845b2b36fe83528891735794520a65f
- MD5 7a20e284809819b645572a659874086d
- SHA1 7a71dd1a24f2a9b7a49c2b66e29e885bb7bfff17
- SHA512 802c2855ad620758748e6fd19ab6cc53e33af7f222e02789f6d924812c6ea2f3f865f3932aa3f44b931521be3976fbb526ec2470ea52bb6b0546ce732f46ebec
- SSDEEP 24576:zAFs06+Omlf3NXEbTomtd7mPuI7cpctubZx:8Fs060lVXuNWPuIw
- TLSH T1A865AE2F63AC00D5D07ED17D8A97C91AF6B1746707255ACB0260863E3F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 f77aa900a0ab372dfc3f5f09583e82e30a0ae05196a7ded624e9ddbf66d72a5e
- MD5 3fd65be37449164397c59f1449d66258
- SHA1 f426513da9204a8961cd5d482d3a2f900a4ddd34
- SHA512 6e5aa513e64d93b39762f7bd0bf54529f90a67bef7aa5a8036e8de087a50549d2e9e261ba14aa2940dc2a5a8b93ffbfadae6a21e3fdb580e3bb374a95545c7c9
- SSDEEP 12288:jCJnJ5D3VkrZzx5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDY:+JnJ5D3WJNtd7mPuI7cpctubZU
- TLSH T19E75D02CD2A810E8D4B7C2B4819A5B96FF72383D2F266AC71464D5353F22EE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 65e9b6654e6d2a37f13bb9ce9016847090016e84d2851be132ceee29ed91c0a8
- MD5 18042cd2846b57a59aabd7a93c04fc4b
- SHA1 04605d6721f17d599d635fc2db6dbd5bda25f71b
- SHA512 4f8ed2ad19b89420f1fe96e24ac01e489f4f02fabab690036b54a2a566895bf6d0a281a8d9d5df0eeed2ab848fca3a0af8181e8be9368af51ca6a0a82e2dfc36
- SSDEEP 24576:jEPohm6/7IIXdwcXrif7qQncjlP65i3VuMtd7mPuI7cpctubZe:Eo06DIKdwc+eQnSt65aV/WPuIw
- TLSH T1FE956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.4MB
- SHA256 e1433809ee1334e2ae495a3912e136221b902970016d81b24997a336ddea33fe
- MD5 2c6d1e56268b6ec15ddca0e169b3adb3
- SHA1 70e0582658303d6677f5da36b00bdc3a53336969
- SHA512 202ff09574ee66bca4abd8abeb4222db805e26888db8a4447d3bc7f8bc2926949518e531f3846e6d9f89659c45d7d60784865361521ad0590835557e0ed8b889
- SSDEEP 12288:PEP3R/rkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDB:U/ptd7mPuI7cpctubZ9
- TLSH T18E65125C67ADA0E9D127D17CD0A1C581E332F0642B6623EF4682D23E0F776F96E39A40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 fb86d36efd5157c496385c67f484f7c37a26e03e8b7dd3d414f65e4286014e98
- MD5 84a5f43bc551cc8102041c307bb0161b
- SHA1 f4cade5ae12d7d7a97e4528c919050441f84b1b2
- SHA512 9b1653a22285e3931d3851ff4e82b315afd5ed78919f87730a290bf431b31dca8d70b8a157755b9f8cc8f5cdaee2d37b307ffbb421a4851c0cd457baecb50ad1
- SSDEEP 12288:Pjky8kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDJ:PIyUtd7mPuI7cpctubZd
- TLSH T125651208539894D4EAB68278E9B3C1D1AA36BC205F2553DF8181F33E2F767E4AD31B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 391e6fb3fe9506c6be234fadbc7299fbf212d6b15e3e3d18d5e5bb0851129299
- MD5 07be2dc9c38e78a345c0ec9a9a3569e0
- SHA1 47ea337fced96ce2aca0f5441df574ac9211ca0f
- SHA512 977f1d1077ddb38c8f8eb706cbc6d0bed0b4f903ddaa2768092502dc8ddc83c6b8be31fbc11acfd8fea254bc88c6a98111a5a8d738bc1fef4f10d67159e2b616
- SSDEEP 12288:Ds2kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDW:Aatd7mPuI7cpctubZa
- TLSH T14955231C572E8CD8EA73C1B4E0F1C9C166274A685B6823F785C7F2761F751BAA6329C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 db0f7ce6db080dc7d0e836dd2a8470b7c59e12537b0a832378259e8afc7ed1b0
- MD5 e1fe13011ccaf8de1bf556e0f2806521
- SHA1 40306402d45133b0baefaa356ff5c87312b60b84
- SHA512 621a75dc1c37fc6cb54afe169557181f0a1d376c7fcce6b12791419fce2e97c719b0ad89aeda6b9b65e65a8c5686ff7eb6941d2fe26979f979a2547ce2125547
- SSDEEP 12288:1LQZb3C97GYnZMv5zBcKY97MD3Rkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDx:lQ9MxZKdcz97w3ztd7mPuI7cpctubZl
- TLSH T125557C2DABE9099AE177D275D5A240C3A633B4301B35D6CF2449D03D0D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.5MB
- SHA256 e5d1415ae7a37f70281ff95494ad487a7e62d0d5c58bedaabb730023c74d0ada
- MD5 940b41c9c54b9c61611c26e00d39a1dc
- SHA1 dee608025c4b124ebe68277797273f7a26efbb08
- SHA512 f73751c8a3612d01e2217dd5aff4bc6b058fbd52a75b030abf21085a989394a58a9c710a1726d464f3f637005d966f860058e09447b9785d71b093034dc41db9
- SSDEEP 12288:ByoKo2TRple9pAkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD4:ByocVApgtd7mPuI7cpctubZ0
- TLSH T17B65EF1EBB6E40E2E176813C89818685E773B0345B6253CB5682C33E4F77AE9BD34B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 9e72425c4ac7fb0ef70b205a797b0fd8df763d76212fcfe90936d716a9819caf
- MD5 aa2b81a9b94430f866479e72ac01dbf8
- SHA1 0978ed2415d6dbfc437df7517feae2d6876cf316
- SHA512 9b8cfca7d9348f1d1df2b0cd5674879bf5fc838d65c84ac276c2666d8f697c9b9385224db704598f2cd00ce6471b01aa86bade44fd333c705e2933d0aa401b39
- SSDEEP 49152:8WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKgWPuIw:20zuNITPuIw
- TLSH T115A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 8c1a2ce59d3ca429218fe558d5c7fce25ee1f3ea26618cbda9f4d05010a2362e
- MD5 117064d3d4cf9aa209645823baf1ac76
- SHA1 5b39750fdf1f7d4c1d149b2b815470e12bc54b9e
- SHA512 b2032f2e170a5fd4cdf3e044ff570e6d5b205e312f20094ddda7d6715f974dc72e8fa61df5c3da5b3b5957b881ccd019947cc875179df70c9d6b44842b0db5b0
- SSDEEP 24576:V1QT7EcpfxR+N5AWAz3ooiYtjMqbptd7mPuI7cpctubZl:QTDxR+N5YzTfjMqWPuIw
- TLSH T15B55B02EA7F905E9D1BEC5799A23C512FA727821033193CB42A0C17E1E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 62797efd8eec63be78d22c0ad02cb7cef47d49a878fd34956af4e82da11625bc
- MD5 46ddbc22fde877f148e0187cd5064a60
- SHA1 57bdfbf77f49c76fece921dc99daffea3f7fe238
- SHA512 b4ec331570e6cf94a76e5d581fe4a478d504a562449480bbf3c4ff29f8a12ea1d75212160dcb035ca60972f4eff6075e1c7752193fc32df98ea8f5f9633f23e1
- SSDEEP 24576:BTMdOz0FFS+mmSLFtd7mPuI7cpctubZ0:r0K+mmSLFWPuIw
- TLSH T1CC75E13EA36D04E5E57BC27CD653C906FA733465032166DB0690C17A2F6BEE47A3AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 ce6c42fe7e80d9a1b9ad002775f7b9137c932f237cd58496e8f1514793124cb4
- MD5 78a97a6c5bf90fe9617ff42babe55ed4
- SHA1 58d968639160c14b56aaac3f851466eba80241f8
- SHA512 ac0637dad19635ccf51f081dc9dd48f9d231df8d8c1fbef1bfc44c6f50cdb8a3ba1253b72622f7c3c042e9d6bff53f7ed5769fd35db065304d6bdd08e98cc14a
- SSDEEP 12288:D4PCkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD9:Cutd7mPuI7cpctubZJ
- TLSH T1F655120C57EC64D4F573D274E5B28582A632B829272813FF25C2E27E1F362E9D931B51
- MD5 SHA1 SHA512 SSDEEP TLSH