65d9dcd6247b06a65002c81577a8f737c31f49b2c60168bf5e57f9f189ee58ca

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.7MB
Sample260419-2dgmbaf191
SHA256 65d9dcd6247b06a65002c81577a8f737c31f49b2c60168bf5e57f9f189ee58ca
MD5 1b758f2d47bf70fc1f4955b52e22348c
SHA1 2f77824efd02215bf00061f80cbf5c1275878c0d
SHA512 e6aa2cbe6d08abeb21e258c35205e45fed81d073448a8215b1e87d6ef8d806f1b9baef305368e8ecb2bb7ffd833d33e724c7e1ee621f6148626fa79b8fe4439c
SSDEEP 24576:s/01dARUHWpfIdS8PCrkiitAfYLH8AcevDN0FImbwQuq3Wia7gD:iNGCrkiitAQgAT76sQuE
TLSH
T1EA85D057A29502F9D06AC2398A939112FB71F8450B71BBDF03A486371E33BD45E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1668	alg.exe
944	DiagnosticsHub.StandardCollector.Service.exe
2280	fxssvc.exe
4680	elevation_service.exe
2284	elevation_service.exe
3968	maintenanceservice.exe
3500	msdtc.exe
1952	OSE.EXE
976	PerceptionSimulationService.exe
3552	perfhost.exe
3556	locator.exe
224	SensorDataService.exe
4456	snmptrap.exe
796	spectrum.exe
2052	ssh-agent.exe
1708	TieringEngineService.exe
3152	AgentService.exe
3972	vds.exe
4984	vssvc.exe
1240	wbengine.exe
748	WmiApSrv.exe
3216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2b11c7af14bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e49d8d34bd0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a34e4d34bd0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d6ffed34bd0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9ddaed44bd0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007098c7d34bd0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045ec59d34bd0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d4f02d54bd0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	2280	fxssvc.exe
Token: SeRestorePrivilege	1708	TieringEngineService.exe
Token: SeManageVolumePrivilege	1708	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3152	AgentService.exe
Token: SeBackupPrivilege	4984	vssvc.exe
Token: SeRestorePrivilege	4984	vssvc.exe
Token: SeAuditPrivilege	4984	vssvc.exe
Token: SeBackupPrivilege	1240	wbengine.exe
Token: SeRestorePrivilege	1240	wbengine.exe
Token: SeSecurityPrivilege	1240	wbengine.exe
Token: 33	3216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3216	SearchIndexer.exe
Token: SeDebugPrivilege	3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1668	alg.exe
Token: SeDebugPrivilege	1668	alg.exe
Token: SeDebugPrivilege	1668	alg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3524	2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3840	3216	SearchIndexer.exe	105
PID 3216 wrote to memory of 4640	3216	SearchIndexer.exe	106
PID 3216 wrote to memory of 2016	3216	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_1b758f2d47bf70fc1f4955b52e22348c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3524

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1584

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2284

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3968

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3556

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:224

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4404

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3840
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2860 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4640
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2844 2856 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5d6b91f64b3aba775846c3b148706b51f2db6fa33318799a8915bd3a59083b22
MD5 43b12dead63c619a8f9b1acc1a9a96f6
SHA1 dbfd737a4bbc71a9ade85a224028ea6154c9e6de
SHA512 77fe6e8ac3e7d7f82094c19a72e3957096fcb28d1c5778c226ad14d4cfdd375ebb1b90a5c75d4102c412dea3389b8455eaccd6473998f811093122ec462d1703
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnDAQgAT76sQuE:K3q6sjBPqGsQr
TLSH
T18FD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 fa8a260e59d965e2f950952261e5d05c114df51cec73636bc02eafcbf0f5932c
MD5 0fb246dc36d9d213f894d1373ab079d3
SHA1 1d09dbf94c3256f8fb8e8702d4f737b91f3c93c0
SHA512 5e0b6450280d2b87b904797d5dc59ec06c89e4e47af5891f4a91f25ea1a003abd31a783ef888ce986bb92f59019c93843a8ee952020c50fe266f524de561fad2
SSDEEP 24576:qXYfDtczAKAfYLH8AcevDN0FImbwQuq3Wia7gD:xtcRAQgAT76sQuE
TLSH
T13275F12963D408F9EC67813DCCB28511E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 72433c645ce456dd7d64bef219d93c033224d42724208b4a0a4c542bdbccb161
MD5 b51efeef328c1f00ac7f765cbed8a1f5
SHA1 cd7c163f6cd1dd5cacbd61957a2b8a72e0fc807a
SHA512 89ddb53db4a1bd4bf58a7455d534d0b80bcc5e76f3b264bd48e06f7b5992e3916af4fa2cd4f6505137fb2ba8c96f76be8fb451392048f783eef2db018c85a72b
SSDEEP 24576:y0Le5ji0hmxxrM7AfYLH8AcevDN0FImbwQuq3Wia7gD:yPji0AjkAQgAT76sQuE
TLSH
T16185AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5566cfa495d06eb18c108d2c9ef5d9ffccdc2f912b63ec161710fb50b5c9cad
MD5 71e723f7e6c37f5ae85d6f332f18edc9
SHA1 93a914f437e008060351c939c4df6ac1e75b6d6a
SHA512 d99588a891f5f6cf09d221bbeadcdb338c37e3fc84b164145c031299be441ad3bd903eb4c0e748cb6045d0dad0ed3fbf45d6f38e8e222f82d6944fdd3c4769d1
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyuBAfYLH8AcevDN0FImbwQuq3Wia7gD:o/ezSC6vUzPveHjyYAQgAT76sQuE
TLSH
T14B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d339a501d2b2e149cfe27241038bf78404a6c9792fc8a5177f2ced7462731fc6
MD5 832c3d8d83db1dfe609f61ca5c97041d
SHA1 8cd3e0f40e394e5ae53a854f0918648fcd9c45ed
SHA512 9258f2020d7006ee9cd5682cb50c24b92f5dc23f1620d442bc1d64621027544fae641a13a158d65c1b8f160c94808a707df290d24a967d8b48fad02795233909
SSDEEP 24576:1VbqPb88hv/l+YGAfYLH8AcevDN0FImbwQuq3Wia7gD:1VO88hXl+pAQgAT76sQuE
TLSH
T1B9559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8b16af71558f3682a7ecc98f6609b80eb3424b739eeac24d19d0d8f79a8e4565
MD5 31a079690bcfe595f98b064a9b0082db
SHA1 3a59a17c13054ba4422c0735bc3606af8079b8ae
SHA512 408eb9034dc9984c40ae8e06dc8f982371dc5330d51e598c10373cd638593b1d961909fc08d16edd1a486643d1deae3b1d8dfdd355e585970caecf99e1796ca2
SSDEEP 12288:7LXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7LXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1125523574A4C30EAFEFBD1369CBBA5B963D1BCB8824597AA00463BCA793D408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fca8a64f3d3494e266a45d1fa78686e8d98b54f8082b3dec7514c6c2d855526a
MD5 5ef9c5fe8f76c029c808e2e590b55201
SHA1 2a67706f24bf72c8914d1a8e6fdeb4d8ec492cb4
SHA512 eb3ce482d13a5758b9365eba89b3817ccddf09d6ad04b1f031503bfb6aac506de1bfe3da141c7ee3f1f6b2aa25d37379652b8c9d0c4d7d93d463162c28c3fc41
SSDEEP 24576:0JIUeAfYLH8AcevDN0FImbwQuq3Wia7gD:0JIUeAQgAT76sQuE
TLSH
T18875DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5a24bc86ef7e9109fd24f787f76ae8d82ae05e8f96e28a3b2b462c748b01ef81
MD5 7aa77da6393aec0ffc38d47b9d1cf16f
SHA1 adfdf29c65a15cbe4755bc6c0964b88f7c42a7ac
SHA512 4cbae7eca421d273fab357fde3f9b1c6e5518e1fc080801ff97d0dc5791e8e788cf0e71c8d93c349cd16a935130e87562a7e09159c421a1d610899f689c38da3
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:uQvGAdlCEL8c/DRNw5C6qGsQr
TLSH
T153266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 62fe2c7deedb699a792a3438d7258896fda5dead4d5b20acc40bd7c709a1eb4b
MD5 d0687179ff84b5efcce41ef631f103bd
SHA1 96dfdb8c0b463b1b0b762d08c16eae97f0118014
SHA512 1646fe34f0fc14ef964efed7af2a6157dcb8352bbf29eca88057fe7f621f1d7316754fc919eb8bdd886879983daf1350d2d0f0096bffacb6e9fe407f74ef69f7
SSDEEP 24576:G0ewsAjUAfYLH8AcevDN0FImbwQuq3Wia7gD:XljUAQgAT76sQuE
TLSH
T1E075E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 312d00f7accc39d1c7c80f5c316d25204c7f526fd752b7c029299720395c9249
MD5 6e9a869f93c661a152c9f02ee692f94c
SHA1 2c2b4beadbd39a51aae83a38ab220750af713a75
SHA512 6ee67094336401e690fa84ce75a4a5c299a7c18cd00904d32b767e2c3a5ac5e5dceda116e3d4a517afe6bb0690b518645b228ca9e78e7ad16794110fd17b56a3
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH3j:PUEtQevvqc2W1cpV2tI32
TLSH
T164474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3e6a2a5ef05e8aedfc5b2ee142f50e7ea3a2e0939547dd4ad0662d2e8385c43c
MD5 981269c646af51de05c6a39fced28283
SHA1 d52605e175038babc3fcad39a79de2f0a378de2d
SHA512 d781a9e815ed22ca32960bcc3c46cec992731a517383c9c8223bfd07cd855d250c18eb04c218a023dac3de5cc8df6863712ecbead7c49f9406e2f76a967a86f0
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/z0AQgAT76sQuE:foquVjnm+qGsQr
TLSH
T167D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9373c49f1a5b5c3a4211d666e3542f32d5b03f1cc75e6c72d0b5677812af6a9f
MD5 100b1c9c372db037c13037fb88a8fe73
SHA1 40e51cf7f35e3ef654ffc6fc02edea49c2232565
SHA512 a0558fb1ff8374144d5933e2e38ef3ff77419b1ce8e87e129bcd80f1385a7853ea5cd3812c757dfed19d29f93c477f0f64fde342b32a73beb85431aff25f43f0
SSDEEP 24576:qAhGL3IFoiwtA5l7S531AfYLH8AcevDN0FImbwQuq3Wia7gD:qAMUFoiq5FAQgAT76sQuE
TLSH
T112359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7a2a5b057ea45dc76091a6d89d5e37465ba6bb9b01dcba98ee71bfb4e7f36baf
MD5 5258adc11dd2fadc4e2d114589863c79
SHA1 b2592f3383b73e95a1c4209801930c69d9779af4
SHA512 d388203d1e23eadeed71c82f46ec484103daa932ca94e877bff740f2743109724dfd5b894f38d02a44f81dccaf343714aabdfaaa3bb63371e8083fa827717c3d
SSDEEP 24576:xwu4OW4AfYLH8AcevDN0FImbwQuq3Wia7gD:xwvO5AQgAT76sQuE
TLSH
T16465F14676A81CF9E9A7813989A7C136F7F2BC152621D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5eb36e3fa943f4659934772a8db4ef2f0ab1cf597fe9c8eef6a8ca4d81ed6d80
MD5 8089690bb230cc175120d1edb7ce9c2b
SHA1 5914427785ad7824f271124b00baad980253333b
SHA512 ea1b67eb7fb385b8e3559c1d2fdd93aaafbbd0c2691e968c4f5456f349214abbb63b9f4b2507e73d9f38ba1817d2dd37ba84a7c8ad88ec2d55b4ed75e329f93d
SSDEEP 24576:eZuzAfYLH8AcevDN0FImbwQuq3Wia7gD:vAQgAT76sQuE
TLSH
T1BF55125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9c41e1b831052f0455554685c3b3099b38cc5b0f7aab9035388d0ee806cb507e
MD5 5337b7b4b9077a51d3d6b13ee48e5e6e
SHA1 bc9f266bbee6b8ad62cd7f03ecbc182c0b3ab7d2
SHA512 30810debe4b7142bedd829306666b06e764df43651128ce4e59939be8c985c3ddbac31a131c4c1f5427e12fb5c430963dae6118d88aac86b41198c2d391b31c5
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:LQRQyi36YOcPbLvw2gAf+PN3bqGsQr
TLSH
T1CE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d284954d6573785ffc25458f27372ab233d5da3ab61cbd47d3a7f2f91dfa666
MD5 b6bda29deac5fa757e6f57e83e034b45
SHA1 fad8c0aabd3ee3d3bec2d8e7a42e32dc8d4bdf36
SHA512 2fc700d416dc2647f5a905e16ce769d7626ff4b3fd93ad6197b80a3e048b35d8befeca1181ff73d3c0e5b58433c789bdeb0c5e28d3df0a32c7099d6c34dcbac1
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:vQRQyi36YOcPbLvw2gAf+PN3bqGsQr
TLSH
T1C3667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 44a91c9b85a767141eea6e328719f549443527f30eee37030da8366d7ab884cf
MD5 5fe1b6cd0dacf4ed308afa2fed75db4d
SHA1 5bd27a9d842f885be41f21b89f2cc597b7b96dcd
SHA512 079093a93edf551aa941eb9795ba20e36ba88057c79ae0e9e39bc3cc14267caaca0e508fbe94b4d6910aa88605071d2dba05bf3fb8a9e37f9d0b4fff9d159da6
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0DAfYLH8AcevDN0Z:668Qg55nhceWu7PNU3/kAQgAT76sQuE
TLSH
T1EDB54933B2F600A9C44DE1769F4A873196D27C758FE1E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 15a86126aa6b4f5dde6029334d1e00b1b4b3eed7d119c033708a6d6d51bbcc54
MD5 f2891aad34e67b909f75c9b17bb814ef
SHA1 b1fe47e58996e449b5a1786b7d40bf85d5f96fe7
SHA512 549f14e3ae0d9393654011bfaf1aa035b448977c2dd2252df0eb5a6656c69bd91aa30aec408d4f955fd9de48a6c62d319ccbc9c2417d481236c06a37798e716c
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk997:ay5112gYy5azzVvt69nLKnhZ8qGsQr
TLSH
T126167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9af5153abc67f7690f3a27820952cdd9394738215ed028e31d9294df53937dac
MD5 21a5e6964aa9669d78bff6931ec17593
SHA1 e0f3b5568220c308b20bb5f6ae6a717414443e37
SHA512 39e9d24ff078848986c79a0eec1fc48c7a207531befcadee05ccd4e9b54cc60b3b08d1f0533332af254bbabda306824c3079196bb03a17ca4cb1d28728fe1265
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glaAQgAT76sQuE:4u6Jmdxd2dTqGsQr
TLSH
T175D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e880c3539179e3f24c122f5c2cb573c0b2235714e4f1eb5e5bbc5294183a1607
MD5 fff8255544e6ba1c0634b38ccbb24a88
SHA1 73f7808c2aafe17a6445bf61aebd066e5274f7e5
SHA512 cb46f2e5e5d26c620d21f085d6e6b059af33c13bcf8b0254cf0fcb4e02ec7e814652247713d47c67aef6990c547fad8fa2e92c02d973a7dd571cfb18ae0e9a4f
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4x+AQgAT76sQuE:XmifPWR+qGsQr
TLSH
T19DB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3766220cd697a356df2c59380516a6b0712d4678fc3b0a8088fb594f14c446d6
MD5 14df4ff2c91d618a984e4816247603de
SHA1 6585d57d09cdd98e4ccd555b96e141203b93c27b
SHA512 a7023f3995d4d31a0ce4700ca0992fa6742c33bd7ede42eb3ea23b723621b44507a28a7a9ae5d782610b7acbb5049b6612d5ac50d6de34cc5e42c09ee8021837
SSDEEP 49152:ZSuZQIY0Be2KcRVtOnks6NMHqzAQgAT76sQuE:35dKii61YqGsQr
TLSH
T126C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 91076de30b7147445423a268e6af50c13ff14cf5baa34d4136302353b3640fd1
MD5 8a666e4cf6c9ef17b1662c87dd89d983
SHA1 3a18d30335cb0464e8ca0317fb3ccb5855d36a1b
SHA512 3415cb478542f9e6ebcd3dc1cfdc66a5fbf5a283e3d69287825d06833d18f6e0ae4ddcdd16fefb858fd9a2ff1b6bc009772584bff87906c80520e0fd5e50451c
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wKAQgAT76sQuE:BX2imphCqGsQr
TLSH
T15095BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fa782aa1f035a03961c2e1cebfa1d401a923aeae14888ea043f2c0b276946402
MD5 ec180d62fcb22f94ea6bf92b16023827
SHA1 c872ba69cef5a28f5a3b91fa6d03f07ee089f2d3
SHA512 6e69d03748905c8a4fa1a22da7439422e2fd8d47f016f78ff05775e3b8556d21129e8926d646372f25b295c42ffc387ab17fe20cafd3fe515b403c65f4702cf1
SSDEEP 12288:EPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DE55235B594C30EFFCBAD1368CB7A1B9A3D07CBD9346939A110A27867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b8a5b535e152c470094722b957b3b8c68e63f3e2cc1e671f69f5104e35ab9eab
MD5 55435e78026d138e6efda7ff20cec1a6
SHA1 092292079e2fc84af4e04d7804ce484d2796e073
SHA512 de9788adafd6e8c7d980a74b2c6be5699df439b1885a9c954a33d9a298653a786d4da8f3f3b97fe2e68b11edbadf6f3ef8651edb82398efb49691b527de02523
SSDEEP 12288:zAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:zAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12E552357594C30EFFCBAD1368CB791B8A3D07CBE9346939A150E2A867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a9f6244632bb9214371c302897b8b91658c70fba99f4146d352bc3af2fab272f
MD5 73b0567bc8c50c16fe1cc16cb7886513
SHA1 695dd9cb05da637736aaf14a3da2b60c7c8ec5fe
SHA512 226f90e55d63c73555ba0335afce13af3280aafeaaec31356342c642bdb6484a50dfbe5208b85dee7025997311acf11848b000895f94b18acbebc5b07071be6e
SSDEEP 12288:dWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:dWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T142552357594C30EFFCAAD1368C7791B8A3D07CBE9346939A150A2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7d44da7751d48ff46326149a5e5b1296e8b40f5ecfb57672955a851876f1f4d6
MD5 8090528f40910f75a4dad04db24c06ac
SHA1 48954a2fb96b479baf038565a42d66013eab04b9
SHA512 9a7703cbabffc133d165d0a914a21b54ed13412ca2500d3e03bc00bde1d2e04a7e8b2127dff896baaa1a416ed700aadb35a1033bb7e0c6e8ef39fa8620268932
SSDEEP 12288:BVVAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:xAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T131552357165C20DAFCBBD135CC7391B9E3E1BCB9930293DF06051A8A2E3A248D1B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 48f5fbfc4cf95d479bb32a1428c86f349aa9eb79f3042ebb835931f342f932c1
MD5 d98829e357b26e9b2e3a60e41673dec1
SHA1 ad609d95ee873efa3d5f3f8cf70e7ab6667d5e5e
SHA512 c401d0662ddbf07d1f54989eb8fea0322782f75b5f5e2bb4fc953ed260bb62daadaedbe55b2db7699a6941afc00712447adb8f3aef215a29cc5d51f6880dafcb
SSDEEP 12288:xdAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:xdAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FD55235B594C30EFFCAAD1368C7791F8A3D07CBE934693AA150E2A857A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 816303ca303b495a5c6cc80bd08731ea4dc6f9577b526b4ae29bc68843270413
MD5 bc8f39a1eb2d8d44b3687dcae4ef341f
SHA1 fa457346b903b9e21bef7d90ee8b9e1d7439c754
SHA512 a92503cddf736341dd19f2be4ff7f17eb7a65c8fcb464f8d2ce670610b0bd3b4cb69c3be4b73ed62170c12244a2a1d596bb986faa35bf39acb3dd67dbe9eda8d
SSDEEP 12288:EsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BC552357594C30EFFCBAC1368CB791F8A3D07CBE934693AA150A26867A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4d821587dff5dc63f236648bd990618966211d8c59af8be5e89e6f35bb8357fe
MD5 60ac900efcb1fa1cb398782ffbe80622
SHA1 0ef59858a3242747f64c95e469e65780565adc1e
SHA512 ad0c662d5f09d9d231bea698cf7eb1f03b5392e25774349ce8594e6b5180b0a622fe0a0a047e8e19a31d73ec2cde9fa05cc085ba9bc90e2005fa84ea806c5a87
SSDEEP 12288:KIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KIAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11455235B594C30EFFCBAC1368C7791B8A3D07CBED346939A150A2A867A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e92946a74d351f3b3ee9d56fcee6482e952e29c200832e89437224c073eff6f1
MD5 ae40b0c28cdcaab0970d2fcff6da5ac5
SHA1 1be6d0510db728fcf33dc31b3908696aa1264b86
SHA512 43120b49e277b1ad24555186b1a302d2d15b50d88c3665db8637fa5a05368fbd48d4cb128af4bc42700f66ee63c7a9b351e4a8f6d93285728af562961dd3295c
SSDEEP 24576:JZMRzFVSOgAfYLH8AcevDN0FImbwQuq3Wia7gD:JZMRzfcAQgAT76sQuE
TLSH
T155750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f8c3db2735a817bb11231e183c54e9f8f6af95e61093a63c60a9348997294428
MD5 ff56987b68273f0acf23b439b91bc19a
SHA1 d8de819360933f57399555882af4011b2e019a86
SHA512 5c7c74e1866cc693ec7d52ed14fff1d3c4fd24f73a4b717b85b91f1412629de512d0fcb71f6a025dadcf6a3e0023698e3ef53baba915df8f51709fb35430a69d
SSDEEP 12288:VjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15E55235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 506b56ff2ad783bc005af1a29afaae09c47d1f244af572af972cd46872751b8c
MD5 6167e30f1d675f1856eb04c90af9db14
SHA1 cf0bd161312cfba1bc0d50640fa88234c09df629
SHA512 bf44db3ee886cb6d3ec09970313ee2e7057443eaca082187b0caef479f18e9a8b100e18202b3b741447468d1d0d78479671c642bca333e9d3f1d919dcc7b9189
SSDEEP 12288:GHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GHAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14455235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150E2A867A3D408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8be644a5a2e51d5355b4fec5dbc27b245f435b635e03a6682297f6e3065b59d2
MD5 41b6c2990aef4acc7fa866ebee7b05f4
SHA1 ee534d06da016c7689138c0277ce978379efa53a
SHA512 efad5ec150abeeb5e3628d70499c8f2d563ffd15318db9994690336a72bc0544a693b101d9630b25ba1f02b0f1c7ebc1299daf44fe34e3080fdfecd8d2f6307d
SSDEEP 24576:JzyEAfYLH8AcevDN0FImbwQuq3Wia7gD:JZAQgAT76sQuE
TLSH
T1BE65024763A530F9E577C239C8A21A55F3B1B87647108BAF135407B62E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f02447af892f2e1fb57d62278b6c9fd20a79a2b6aaaecec244d48b3846500599
MD5 7d8655d5b4b96014322516cc9c469e35
SHA1 5a1800e1138e66a4e3bf2da72b33bfd0806bf0b6
SHA512 b5f1eb805d3d833de9acae7782a184ec82fb669ac425864a99b85968aa34e6593671bb96fc1a43c54bcc4aafcc8f2271c221bb6d68ce894138052a16b1d0124a
SSDEEP 12288:9jAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9jAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15555235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 93ca382091a731e73542f6b4ed1ff8df351714f4eb540e0e8f88018d905eb9d3
MD5 7a62f49d523519cab491cf316cad2a0e
SHA1 e4e180af5175a6f76b1b0c2a54657c280f0ca979
SHA512 066a3cc55d60779e729e31b1ebb5b9cafa87d9e7ff612daf292abc0285c4f842d9cfb7075f538051beb18543fbf330ec8348f5604eb69808cd28c378d9b573c2
SSDEEP 12288:djAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:djAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16955235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bcd43baf53d6bd57a0aa4a9ea880199425fc66a3e9ffa7b3b3db7193cfc6ebd8
MD5 807eec5f0179c5413d2f51357e053495
SHA1 213d983ad2fb10f1a5234eee22ad3d90e44bc517
SHA512 8bddbb77cc763ab6e87f045aaa0dbd3505ed75b0e8fe31bed59466dc08dcff6d3971f1d4782c7b4a5a80c9525a4642fe03df43a40c97d42be55864a5548282c3
SSDEEP 24576:eCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvASAfYLH8AcevDN0FImbwQuq3D:eCUZPTY+8Wg2lIL8lrIUJLWwdAQgAT7o
TLSH
T13065BE1EA3DC089AD4BBC1358A518A16EB72782E1B22D6CF1160C37D2F27ED95E35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 909e1cd20fdc2a7e6528cb83b6328c889d7ec8b080256dee4c1eb1bb39bbf588
MD5 bc574faed2afe5a2a99ad98477ab0de0
SHA1 b6f2389008b92036c66e85d44e69e95b074b15ff
SHA512 2657f7e1fd719a08f62f09ee12deaadf3010d31f481e6ab6ccbe2ca572fbf269bc801741f21f68c81a3fd7581c4feb1907e482a4474f59b2f0b9dbc327a25193
SSDEEP 12288:4bsfzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:fzAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18B65010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df733d73cc999a5bafcbb71766479edd6f7ed84c56c1fbd699a386440b6aa3f8
MD5 634b3c8172caf1d3cccb4e1f07ebd5fb
SHA1 1e20dee31504ba26571bfb9e917a0ccadc340527
SHA512 616d8cfc43ea6a24f51f4dcbea85ee363824fe742871350d1d8d4954f5a30b467ea8ee72e623b4a1e862093206d8f53f9de540cfe0eab2eb42fdfb8d990568c2
SSDEEP 12288:S2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:S2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E2552357864C74DAFCBBD231487BA1386399BCBC870582DB640A27C9793D8C8D9F4E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 79aa91467f1b81f6bff9c1805692f14ab9d50f29fa2d36d8023826edb735e83b
MD5 bc5fe58bcdc80bd155ac1ede68ae03c6
SHA1 1552f299e461e429eb04b6ddd1e09e9c861e71cc
SHA512 0ba63b13fa3b82df6b48d4b29fdbe49eb676faf384d473c9e622acaa5ffdad7514fadb663e86aed8db91ba31d481b369febcf5f9aff3286dff3ecd11df77f715
SSDEEP 24576:B8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC0AfYLH8AcevDN0FImbwQuq3Wia7gD:eRZwQCyiHiQEaiPnMbAQgAT76sQuE
TLSH
T1E185BF1E62DC46A5E0BAD278CDA74407E6B27816473197CF0191C27D2F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c5847e5ea3b93cb22bc4bdd48a93332b482a43cef5003d444459e679a4cb1c59
MD5 40978cf1b2edeb425afce7fe7c977f02
SHA1 a1e668e605fd465376b4d252020b2a615859e0ba
SHA512 883f2352db0c1846619628eabb8a45f54f730983fcfd2a7cf836883dfa2c29e48cb863a53e243aac764d0edf6c82c236cca943e265bde045a84fea552513328d
SSDEEP 24576:obxA1UGmAfYLH8AcevDN0FImbwQuq3Wia7gD:obxA1UPAQgAT76sQuE
TLSH
T1D255122F569C24E5F5BAE13988A28119D371BC2A531193EF108183BE1F3BEE89C75F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1412eba31676ccfcc970872159e456c1cdacc033beb72ec47e767b554bddec41
MD5 8a619b23e533ad6b5c4e3016e8090767
SHA1 cc2531014099ad0cd74fc799e12cc77969baeba4
SHA512 a629a1bb8335516fae72054a6fcadf77eca227a4783ef8ad0265fd4d1251e1c3246840e25d9b306552a4d9a6d1924e863d62a849edcaef67f8a1ed79d977abc5
SSDEEP 24576:bjsmP0yHaqrVqHra44KDzMsrnFAfYLH8AcevDN0FImbwQuq3Wia7gD:bjRP0yHfVqzlAsrnFAQgAT76sQuE
TLSH
T1EB45BF2EF2B910F9D8AAD136454107B5BB71B82D1F209AC70170C634AF1AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 d08f7f5127a59de4619926bc5c33be4e0d63064f1be21d7930d09674a888423c
MD5 469119bd0ba6206dc27bb020a772b63d
SHA1 b9b1a82acf452f69bca2cbb73cd41b91ed849620
SHA512 f7917b317470830ad11d25d63072ba31ca24f677b8ad8c169e42ee204f8082faa60a1942bb50d9eafe5e32dbf9161cca35c2ab17ca46fb3fc2344fb00fbbce26
SSDEEP 12288:rMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rMAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19B55235B564C74EAFCBAD1364C7791B863C07DBC834693EB140A3A8A7A3E499C1F4D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 cb942b1c9a09d31195336904d31388162aad392bb205b07d5848e630d876bb38
MD5 7e4f65bfe2ff9e3df6368ce6d8c9341d
SHA1 4ac7cc9e4063b88b306f31f4ab818974ae00ecfc
SHA512 a5e3522bad74ed04c2622548b9d7075c361cd54e83e83cdfb303029fa3770119dc48203b2923594adf0e02cde4391675be8528cdc0a406ab815034c271b3af16
SSDEEP 24576:4bLBUTKAfYLH8AcevDN0FImbwQuq3Wia7gD:4bLBUeAQgAT76sQuE
TLSH
T12275F155E79410F9E87BD13CC9B28526E2B2B8AD0354E7DF03684B551F236E58E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3c6690e6875c2c3f877bdaae12e3e7815d65de3e247dcf7f4534dc44189ff1ad
MD5 fb94fd2625ff7800d2b9738466f1ef08
SHA1 662d021c7116ba1411606b1c3c9279ee4c0bc0f2
SHA512 d0c7978aeaf7a46784c3c26cf2cb7292851b94b69ccad4fa4ff2c05f0580757c6b6feea3bfd77e6c0c20508fcf03a5e7a7d20742e4d31557872df93c938403be
SSDEEP 24576:YpYNHJAfYLH8AcevDN0FImbwQuq3Wia7gD:YpYtJAQgAT76sQuE
TLSH
T17465F12F52AC18E5E57BD13D8AD38219F2727866131193CF05A0837A1F27EE8BD39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 90d5530e82d1fdcb056906f2e6b2bf7062e9919143cc21c5c26fadf3b61d6143
MD5 bf529dfbbd1016d2c24d05af17656876
SHA1 a3679e26af7781ce0cbd060c20eb601cf6e0f649
SHA512 ee9d5c79251772af8ee6e0812988d6bfa2edab0a5da2de79b8be1441caf539ec48ce6d69092c886653dad1c2e8a5cfdfcd8c08630bb4b1f77ba46a1a0ef2d6a2
SSDEEP 24576:qnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKv:qnXoJJYH84VVS6AmEOJas+cHBjSSKHP/
TLSH
T13465BF6EA2BC04E8D5BBD13DC5C34506F5B178661321C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f4c9471a57c9f2b0cd47889f74a60291d4d114ae2a845ca8144a265142e3fed0
MD5 259ba9609a32f3966a6d9696a62c915b
SHA1 d0a93a22949249f8782095861f0ae611d97b2c2a
SHA512 0b4c49719a70efb8b4efefe4e2494672b61c83ead28fc4cd75bcaf8c4cc8f10e9b1e5a8d2cfee3fe3a01eebd2e9e434ae1f266aab92a76d5b5fb6a300f32bf93
SSDEEP 24576:kv7Xbxd9Tuycf8M/TYlSuxrr2PC3AfYLH8AcevDN0FImbwQuq3Wia7gD:kDLL9TuJ0M/TYj2PsAQgAT76sQuE
TLSH
T11D858D5EA3EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 8c1b0c2a6eb1c08f4cdebd09ea7e35af426d117668e9b0c0bc1d7ddf913c8752
MD5 2253640aa4a6c6d19b3053fb32ca2fc9
SHA1 f196488f7739aad2137b5cc9805e6550f72aa257
SHA512 20fc1deb033d3dc9d266a9f5eacd4b89a11f9c6c7dbf54746011196aa27c4477ae1c1399875b1312af7924333137991a9b7fd0fb63edb58e23db996d619f9415
SSDEEP 24576:BegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wKAfYLH8AcevDN0FImbwQuq3Wia7gD:BngOJOmPOHzKAQgAT76sQuE
TLSH
T11255BF3FA7BC15D5E07EC13D8A968916F6B1782603255ACF0160827E5F2BEE46E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 32d6178f42958ccd524648d64bce8b56e6cf03bfd7ea962eb99d7f03f3a0a78a
MD5 2c5b8b92c6b417fbbc00911d283419ca
SHA1 53d6a5986a6889228bbd681e5e7f75ee73eda10f
SHA512 4c4fc87d63886dc25351d20511b0aba5d60c9513dcb0662a35985faf0cac69c02eb4db8801e64885e5b613698eda9169cbecfc1943700a7adf2c484d432292dd
SSDEEP 24576:VLJnJiTk3R3waE4JrOsAfYLH8AcevDN0FImbwQuq3Wia7gD:VLJnJK8R304lVAQgAT76sQuE
TLSH
T18675D02DD2A810E8E4B7C2B4815A1766FF71347C2B2169CB19B4D5353F22FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 71aeae1b17493b4e7dc3bbb5e30dedd7c0f171cf47896972fbb55d9a70181384
MD5 4eb4b3fc00358f8f43d0214a26fe490c
SHA1 433734beeb9a246bb097572e806b722a702a413c
SHA512 727ad42bb41b00af1347c9936ced421360787d8957545efc2e40cec01908407464e7a4471b04a1f5022b82006b5e46a45e0262951ab1718c4bfc5746882996a4
SSDEEP 49152:99mqCzDScAZmlvTcFg8Ph6IAQgAT76sQuE:RyqGsQr
TLSH
T164955C05F7EB5298E8B3CAF1C96694159B327C509B34F7EF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 fe84cea7814af715324fb996ec64dccb250ec66565b2c48e4b57368b5b891a08
MD5 144da1cf1cbcd8e1a3e209c42f93fe3d
SHA1 5977c95a0e2ea1b688160e6755dd5ce970ff41d6
SHA512 40c14e49bb5f444898eb867eaed127c517328900a67878f9ed32cf81e7c13260d62039a88462cb7467cf3867d702c921358237b39152bf76c8392efeb11b7246
SSDEEP 24576:WlYJeXm5jUuE6AfYLH8AcevDN0FImbwQuq3Wia7gD:WlYJeXmRUuE6AQgAT76sQuE
TLSH
T17855125E269C30E9E57ED03A88B24564E3B1B4B5530263FF01D0C2BA5F3B9E56E78E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 2a7e6490a9582b56a270ac3b667ffe92d81a94fe7a4969fa28175d7f4b32b0a9
MD5 da23928f554252d9c5bbbc2578f713bf
SHA1 a0f3d8de275f963e49d422c690122ea78978d6d2
SHA512 4822802d3484e341bdb016bb103119543d498898d3dd689ba4f6b87bdee354c1e91bba44628102207860e6881c92515e6961aab13214c8de7dad00f25bd61e6d
SSDEEP 24576:27tylAfYLH8AcevDN0FImbwQuq3Wia7gD:27tQAQgAT76sQuE
TLSH
T12D651206639860E9F9BA8539CDB381B49B75BC748B0193DF1091B73F6E3A6D4A470F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 9572ddb8f58bcf3f4ec1d3495525ebacadfa76665eff18ee8d510d079e8fd829
MD5 195d771d485d34cb4729b64a87e2456f
SHA1 83791a7c2ccd3dbbf92c1095e642fc248798d2ce
SHA512 2aa8ff886a581ac7d6137c748f28595890b9ffcda42e426f46df0a63177887c1d89dca8a55d56fe367836d60061b9bf6537318581a7d1c6a1fda09b0a638d0ac
SSDEEP 12288:1PKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16A55235F064C30EEFC7AD135887755B8A3E17CB8830162EF1089A6BAAE3E485D1F4D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a594214f37e3c53764d7697e33d615f14361c956e239ed9eed2cb9ff39705521
MD5 4563aee850bcca62e63a19e8923d5969
SHA1 5d0736e5237965dcda6250541290e902c64aa415
SHA512 0161fbf8c4fbc195ff4926a22c0d729970aa270c385f67e292fb5fdb55010234a28c0dcc198f48eb8adae3caa427defab839b5ed6730470c78efdf5e92ee8ff0
SSDEEP 24576:MC+TyQIu93VAumZr7jmTAfYLH8AcevDN0FImbwQuq3Wia7gD:M/TfIq+YTAQgAT76sQuE
TLSH
T102558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 6b53263e6b9dd31903324c762d99886b09afba374e80eb350fdb445d13465957
MD5 3e2e554d08c716512b723481df678db8
SHA1 bbc7b7a0435ca12ecf6005d2898a03b0ad9ee3e0
SHA512 a710e1138940aff092c6ee95940601881ad25f87cacd8b89e5f8465e4f8bee5caac8768170c39113c7bf5985587c02f30ed96d82ed47f90352829f092af52c81
SSDEEP 24576:vLQikZuAfYLH8AcevDN0FImbwQuq3Wia7gD:DQikUAQgAT76sQuE
TLSH
T11F65F00FB2AE10A6E4ABC13888964166F6B37474430263DF0290C77A5B7B5E9BD78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 983c5b3892ce6867963e0eb54fd7cb7ba6a69a09feda83ef6d17d5ea25db97d6
MD5 f2b6eca3b566323b7182f6e8968b8798
SHA1 9d140ff2684a37014d8274d4edc38592698b64a0
SHA512 ec441e4586cb8f272335f11167a1b50e0204f6af5f8c1097be4fda251fa56637dd80497f3196d0c4e178769e9a7f7c967e93837be8cd4432f32734a510401efa
SSDEEP 49152:upJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPlAQgAT76s+:bpC7b4+80GTklqGsQr
TLSH
T1FDA57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 41f081893499e0c590b781b7a2d9cbf2d770566a6adfccd29d8e3dfd9463047c
MD5 bb4ef80be518f911bb9cad107c35e1c6
SHA1 b45d7790376121d15a264e9acb7c52f790a50d21
SHA512 d3cdc50e5405d4432800bfb99d1c9c8b3bf16e516746acda2944e5138afad836807f60b238a2b21271eaa189f0f166d252f5ea6b75a330c87581bc5af860bdf1
SSDEEP 24576:cSAwJPE1IDAo+4Kt+l4413JUQ9AfYLH8AcevDN0FImbwQuq3Wia7gD:cqPCIo4Kol4vQ9AQgAT76sQuE
TLSH
T1D855B02AA7F956F5E17AC774C663C611FB727822133163CF4290817E0E269E89E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 db5fce61bcbbce1eb4052c337cfd41e632623e36d59390fd0703c01199e861f7
MD5 932a5fb7d6986dfd47fe26f75bba6d42
SHA1 36336ac0b623c733187f16655d22f2cde17ad23c
SHA512 0b10a4e78ba836f6c52b28009a75532142883b0769d0744145ecef96dee4f13be64216ad61891600a1d42210b8c19b29ea57ca687f01a05af4d862fa72cb9b6c
SSDEEP 24576:hyLXPLcw94ttAfYLH8AcevDN0FImbwQuq3Wia7gD:hy7PoXttAQgAT76sQuE
TLSH
T1F075E03ED76C04E5E47AC27CC6A38506F6723CAD032166CB15A491792F7BEE4A939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 387a3089c9b72df98f8439f40e9fe8fa32c0b63527cd3b91dae331db2d72ee13
MD5 96b1c5f72edf37e417645ba894867107
SHA1 61a97b528889fc7c8c93e233535612f4e25f09d4
SHA512 33f955add707050e5c13941619720a13012c10bb27bf33a8867cc90ccce93f84903d23768b46726769fa5d08c2ca1a8bf52b56f39c2a753d43f1c8027b7b9781
SSDEEP 24576:eWv8qjp+AfYLH8AcevDN0FImbwQuq3Wia7gD:eWv81AQgAT76sQuE
TLSH
T14165125F569834D9F47A8234D933817991B1BCBA135496FF30C89ABA4B39AC4D07EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-470-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/224-163-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/224-147-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/224-141-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/224-473-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/748-478-0x00000000012C0000-0x0000000001638000-memory.dmp

Download

memory/748-264-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/748-480-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/748-261-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/748-492-0x00000000012C0000-0x0000000001638000-memory.dmp

Download

memory/796-177-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/796-168-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/796-174-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/796-417-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/944-32-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/944-176-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/944-36-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/944-27-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/976-125-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/976-119-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/976-166-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1240-252-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1240-250-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/1240-477-0x00000000006B0000-0x0000000000A28000-memory.dmp

Download

memory/1240-474-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1240-244-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/1668-113-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1668-467-0x0000000001340000-0x00000000016B8000-memory.dmp

Download

memory/1668-19-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1668-13-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/1668-23-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/1708-201-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1708-193-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1708-464-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1708-199-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1952-111-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1952-160-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1952-105-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2052-188-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2052-190-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2052-449-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2052-182-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2280-72-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2280-62-0x0000000000770000-0x0000000000AE8000-memory.dmp

Download

memory/2280-46-0x00000000011A0000-0x0000000001200000-memory.dmp

Download

memory/2280-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2280-60-0x00000000011A0000-0x0000000001200000-memory.dmp

Download

memory/2280-40-0x00000000011A0000-0x0000000001200000-memory.dmp

Download

memory/2284-240-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2284-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2284-70-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2284-74-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2284-472-0x00000000013F0000-0x000000000158A000-memory.dmp

Download

memory/3152-205-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/3152-219-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3152-218-0x0000000000670000-0x00000000009E8000-memory.dmp

Download

memory/3152-216-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/3152-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3152-211-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/3216-277-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3216-285-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3216-479-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/3216-274-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3216-323-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3216-268-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3216-494-0x000000000C010000-0x000000000C018000-memory.dmp

Download

memory/3216-481-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3216-301-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3500-100-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3500-263-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3500-93-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3500-94-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3524-9-0x0000000002480000-0x00000000024E0000-memory.dmp

Download

memory/3524-8-0x0000000140000000-0x0000000140272000-memory.dmp

Download

memory/3524-84-0x0000000140000000-0x0000000140272000-memory.dmp

Download

memory/3524-0-0x0000000002480000-0x00000000024E0000-memory.dmp

Download

memory/3524-466-0x0000000000830000-0x0000000000BA8000-memory.dmp

Download

memory/3552-161-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3556-137-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3556-162-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3556-131-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3840-482-0x0000026C70F80000-0x0000026C7111A000-memory.dmp

Download

memory/3968-82-0x0000000001E60000-0x0000000001EC0000-memory.dmp

Download

memory/3968-85-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3968-76-0x0000000001E60000-0x0000000001EC0000-memory.dmp

Download

memory/3968-91-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3968-88-0x0000000001E60000-0x0000000001EC0000-memory.dmp

Download

memory/3968-90-0x00000000015B0000-0x0000000001928000-memory.dmp

Download

memory/3972-227-0x0000000000F80000-0x0000000000FE0000-memory.dmp

Download

memory/3972-221-0x0000000000F80000-0x0000000000FE0000-memory.dmp

Download

memory/3972-465-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3972-475-0x0000000000660000-0x00000000009D8000-memory.dmp

Download

memory/3972-229-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4456-152-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4456-158-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4456-164-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/4640-498-0x000002B122DD0000-0x000002B122DE0000-memory.dmp

Download

memory/4640-497-0x000002B122DD0000-0x000002B122DE0000-memory.dmp

Download

memory/4680-468-0x0000000000760000-0x00000000008FA000-memory.dmp

Download

memory/4680-213-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-50-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/4680-56-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/4680-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-241-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4984-238-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4984-232-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4984-469-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4984-476-0x0000000001160000-0x00000000014D8000-memory.dmp

Download