a430f5c4781265f636c7d0425676def2ee632e8e0631ffff948133d93b061f01

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Size 20.6MB
Sample260422-sbm7msdt21
SHA256 a430f5c4781265f636c7d0425676def2ee632e8e0631ffff948133d93b061f01
MD5 ee6a7b36bcf672bd2fd745ebf1ee984e
SHA1 e0a387ddf0ed3b9e97c1407cd1a3ab26d9c6e7ea
SHA512 664a9d9e5eadcc6975b3a4dd1e5653b54d6c5772f75833d9e5dbc0fabaf16885219840c92b5d23fdb6c191054c1908ace69c9916f02126b0397678e3e49c5a37
SSDEEP 196608:gTvG9Siniuzt+rZFUNX48nrlHR950vDT3gGNrnsACVQBWG:4O9Siniuzt+rZFUNX48nrHuosnsA1B
TLSH
T1A527390567F98194F1F797349AB28787DA76BC416B34C78F1250620E1E73AA0CE7A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
544	alg.exe
4920	DiagnosticsHub.StandardCollector.Service.exe
4760	fxssvc.exe
5108	elevation_service.exe
4580	elevation_service.exe
436	maintenanceservice.exe
4392	msdtc.exe
856	OSE.EXE
4564	PerceptionSimulationService.exe
104	perfhost.exe
5068	locator.exe
3348	SensorDataService.exe
1588	snmptrap.exe
1616	spectrum.exe
2156	ssh-agent.exe
4584	TieringEngineService.exe
3712	AgentService.exe
1864	vds.exe
4256	vssvc.exe
3692	wbengine.exe
1128	WmiApSrv.exe
1556	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de39a68d14bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000920a5cb169d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b1b26b069d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047f0e3b169d2dc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeIncBasePriorityPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	4760	fxssvc.exe
Token: SeRestorePrivilege	4584	TieringEngineService.exe
Token: SeManageVolumePrivilege	4584	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3712	AgentService.exe
Token: SeBackupPrivilege	4256	vssvc.exe
Token: SeRestorePrivilege	4256	vssvc.exe
Token: SeAuditPrivilege	4256	vssvc.exe
Token: SeBackupPrivilege	3692	wbengine.exe
Token: SeRestorePrivilege	3692	wbengine.exe
Token: SeSecurityPrivilege	3692	wbengine.exe
Token: 33	1556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1556	SearchIndexer.exe
Token: SeDebugPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	544	alg.exe
Token: SeDebugPrivilege	544	alg.exe
Token: SeDebugPrivilege	544	alg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
388	2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3248	1556	SearchIndexer.exe	106
PID 1556 wrote to memory of 836	1556	SearchIndexer.exe	107
PID 1556 wrote to memory of 4876	1556	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_ee6a7b36bcf672bd2fd745ebf1ee984e_glassworm_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:388

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3896

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4392

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3348

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5028

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2996 3056 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:836
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3020 3024 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 24a24d826ff86033edce9d02fe645b112a14e6bd30c425e75c1cc05f0a7e41b8
MD5 03d994ffff6fdef1a2e466f8f54adbf9
SHA1 bf1e008ba7af84ef59f9b3c91d8043b0ee499a0a
SHA512 73afcbc9e13723ca07a6f8938a22578d1abb2930dbd2f68b0fee5c0f5acb9f2f56646b54694dbc645b47b615e8f027fef3bb0f767642c30cbd4af0d499aa50ab
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/Dmg27RnWGj:93q6sjBsD527BWG
TLSH
T18DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f06d5adcc62145cb808d42eae84425cd91d2c72025dddc3b12d8da6701a1c2c7
MD5 32bd1345b353f48aee741be3929a9911
SHA1 c8bc5b318f6f083b2e5bd093c60358bcb0232d62
SHA512 07a5801082d7ac6d907a2342f251183b111d7ec0b54dd56f1e6c49dc016d127d2de0c0d3e813e12ba50f0cdcc27eabd4106d72e976d3dc808188b2c7c499091a
SSDEEP 24576:2XYfDtczA0sqjnhMgeiCl7G0nehbGZpbD:1tc1Dmg27RnWGj
TLSH
T1E365F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e0252cce7628bd14a742923cb698f2cab43b983a40f84f41d5b4451597a21898
MD5 26e90101323a1ebd73889ed0c62eb93f
SHA1 7583f6547bdf240028855778565f87523e4a325c
SHA512 c619177f1840281d52cf9cf85788ae3c88817b95be61fc1193a9918d0e44e457f249fedb2c8ab1a77029127fbb6462450063c3a50f23d4eba76f8a3583125a4b
SSDEEP 24576:D0Le5ji0hmx/rMDsqjnhMgeiCl7G0nehbGZpbD:DPji0A9yDmg27RnWGj
TLSH
T136859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9984b0833fda6ceb985b098fbd4f8bab66b5166ed60a9dcf9af3378d4866bed7
MD5 90b4d4afbb134a04c38907842250703f
SHA1 f69747d8d2fc583e17a8a5fbdb7a0c628ceb2495
SHA512 5eb21b159453b13b0918d6c596caefaaaba6fd24466e4b7fc0c81bf89d9ac8027b8d0f243652a66bf0ba12e09c947e7ff22e2805b7fe2c94a90f585f1de811ef
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuxsqjnhMgeiCl7G0nehbGZpbD:M/ezSC6vUzPveHjyWDmg27RnWGj
TLSH
T190755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b3e39977af0cfdd114e49ead6c17dca2e5b1a034981855325323665c972e8bee
MD5 995bc418265b3d977f5402fe12da589e
SHA1 37c8c9e16a58fdefb301bfeefbd007fe764e834d
SHA512 662e341dd75a3b08af6f30b8825747430a9d1ae7660d7bb5e0f2806546371b3d1be88b3902baa1456abab5ef08350fb6944a35ffe7681f9e3a3b4154d0916fb9
SSDEEP 24576:FVbqPb88hv/l+YAsqjnhMgeiCl7G0nehbGZpbD:FVO88hXl+9Dmg27RnWGj
TLSH
T11D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b36006327763c9131da26d763cd97a5cd3314f47f31aa3d222a2bcb103374d09
MD5 e603cbd731cbe4a993c2f7077f3b44e0
SHA1 2d99c97eb47b8343f60abbda36cc6c224bf845e4
SHA512 5cbbc1bc96c8276660e5669f026c05cc24079dd2a19850dc39964edc2a77ad37a4beac74bb8ebe78d3c521963cbe7b7af23f05139df1d9d6d634c9a36e2b9a87
SSDEEP 12288:42vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:42vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4523BF974C50CAEA7608B5C3E9F11EAC177E56982008436AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 799c43d5b744be00961e87cfcd6d9691a9bf49937a15323ca1eac12e0a12549b
MD5 b9c66788a9b81ab0daf013062df20056
SHA1 a9f5f4c9eb82accc04f93b86c97a3d1a38f3459d
SHA512 07e235bb020dbff1e797dc95fe90c2fb1e9b83a58aaf6251aeeb3c7f2f12540ec8f4fb766325b681f05d623475a6235070d17f4fc67bb74091ec78f12e6adf37
SSDEEP 12288:/eBNUbTVO86UYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:/JIUYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15965CF7BEE28FCD2C27A8DB95791C600E76278314F2193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c24ef87662e8d25977529fb7c138b0a484c2f21c1878a99a9b240682885e7a9
MD5 86b89a89f4c985544b4dfe03fef15fa6
SHA1 d83c61338825b92729c0b10469b4c25d854d0f2d
SHA512 fcae96398462d196d18a4148f1d01904496112245e96f4feef526cf8e782a4f616913d04b1b505c7b5900344309f5b7773e872759796b267d0742e971953a852
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:qQvGAdlCEL8c/DRNw5CVD527BWG
TLSH
T1E1266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a69b1087d6f30e65e1435da4973d595ce282bf013a88b4523328a8ca019d4382
MD5 c0ec9a493404c21f97891c0738b090ad
SHA1 ea70b16cc89d88a09dd1e910c74fb18b030f2091
SHA512 458a11fbd4748d235f6ae7b63576bf7f7db2cf714d5323ef1b7aeb0b6e7b8ba937b9b908624f999215f533049e5af6da728ffa392e7e84a7fa995f54e88d7b7d
SSDEEP 12288:GAwSfxL/2Dc3HDLLmt0LDQewsAjuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:b+ewsAjusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 efb02f2c8b8ffbc6d83e065b66a1b5f866f7c8b73e28fe95de2a05ce7f8774fb
MD5 10be00eb17b3a60551209cfe076a2c61
SHA1 81a1a17c63520034f74d2015c4121dff8418fed6
SHA512 3736a6273a5432d58d562aaf0161653a0357034ea5598191353a2ad5df9829f33e7563a12fc1010599d97d8f4d06078469271d252d3205ab4087721691f2e721
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6VQBWG:cUEtQevvqc2W1cpV2tI32NB
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4e593b1bce8b66bc62e5caa651bbd025effea9560a22931f236ede69ca20b6ca
MD5 f5336e320791f722f5617f6e46bad617
SHA1 01eff312ff6120a43b5b47c13569b0451f16df44
SHA512 5294c4e23d3a185ee1ddea702e59cde1b015ad8d7e67be80034444810aed9afda3b75f2d576bcee86679f3373e5e6948186c6ebcf39f15188372e3486999b6e1
SSDEEP 49152:YCbRquA/m2yL5zTfFiV+XenmE3/ziDmg27RnWGj:RoquVjnm5D527BWG
TLSH
T125D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3a7ce1d9cf2c4e744ee9630f1dc587a3475a501bc719228278df4bdd74b73f5c
MD5 36e0d08477efc7773ea5195544cc7b4a
SHA1 b593806eea26c211b721c42fd497d4d6e4cfcf99
SHA512 4f64e86667f21325aeb9f51c591226a52a00cbbb91f9575b6fd62f04a28ccd7c82cd986e71a7a916853dd3ebc7001ba16e581934de19e8b22d71d61dae21adb5
SSDEEP 24576:7AhGL3IFoiwtA5l7S53lsqjnhMgeiCl7G0nehbGZpbD:7AMUFoiq5JDmg27RnWGj
TLSH
T180359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 315ca259085f39ccc9312e95e90c576d6c3b67ba3f653adbc87d11a838522407
MD5 c71a48ba6ac9b7815cd43e608ed147ba
SHA1 23b132414b8f0eb44f53d72917b2b10e2cfd112a
SHA512 0eb8c87c0009e46dbccb741a6c57b72d52b0c9703e383c38827f62ad8f069893fc42e9c98726aa2c4e61a72c4f25b6ba802b2c1cc12c77d9a826f2baa4630ba6
SSDEEP 12288:imw5HEjsChNTBFgl0WDm+CRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:7wuaOWysqjnhMgeiCl7G0nehbGZpbD
TLSH
T15265F15A76A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 0b307806399155d34ef08039bdc81df425838c5ed22ab99c7c005a37a770f5a2
MD5 9fbdaa2cadbf318c25cfc1d20628ae17
SHA1 bcd00de42a68b85c41d6815b08423675d912e904
SHA512 2ead7991a6a374be6373cfca21ee348e6a3542c1723dc30e780052bdda0870763384aeafb208851b180e9ae1d84f610dab359671219688a5a2c4d40f2fabd4c1
SSDEEP 12288:YjZ1Iy+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UZubsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F55512AA239820F9E1A3417CC5E5D609E7337C52673003CF16665AAA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c5b40e853a7f6e0cda9abe4087ecbdcc094ceffc82b6ddf0708e63d6ffc0b619
MD5 f98ca1a09c858dd6c86e47623cde82c0
SHA1 e2d08478b939bcc61acdbbfc9005dbe24bfd68d3
SHA512 bb7487f2d773204d06d28b4d193a2104d06d52dfc15757c8c7a8ced0802f2eb39f47234659e7de3e5b44ceb1cf6d5b1e43b5642ca14e40419ac0a1d12db60d04
SSDEEP 98304:VQRQyi36YOcPbLvw2gAf+PN3YD527BWG:sQyiKa/X+PNIVQBWG
TLSH
T15E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 312ab3512166e78681fa7ebea9ebeaf591757abb80d2a2016a6a6d2f3bed0cbc
MD5 a3fa5970b757acaf72f11d0923030902
SHA1 32ee503d3ab65a1c8545ba2b203fe03b01b531c3
SHA512 929702f8891d68754355405820aed639f25090203122c8a69949c46778a4060f042a8f219afb320b146eb6a0aa45038dd90df5cf8787f6145fa637e47b53badd
SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3YD527BWG:mQyiKa/X+PNIVQBWG
TLSH
T161667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d382757bb7e1f9b6e96e0c2273bee588ae317310d00ffaf6f414fff8de7eb09
MD5 cc7db899f839260405da375ea61fcfdc
SHA1 8e64ca6c0e870c28691e0cc1004c149d7d2191a7
SHA512 1111e574d5c0b506b4c78fed892f3f6483d777eee9736e01a7a178e2f3b9a52dd474a778c11e9d3caff1242a855215a0b30095dcae47ba107c226e055e9ab84e
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0LsqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/yDmg27RnWGj
TLSH
T102B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 87fc9f3e5aab4a0304fbf850a76047b7408b0abde580746a697d313d45741473
MD5 44a129cfc609ac95011b1013c94bdedc
SHA1 26c19fd73098629152c2d98ede3131f86775b9f0
SHA512 10580eff3302655c1068509f082d40ab4f2b2f826969618ddf400d54b557de81b74397acb1f338167ddfc221f84e2a0ff08725be6fc9716812a5011c87d9617d
SSDEEP 98304:Ky5112gYy5azzVvt69nLKnhZTD527BWG:zLIHEWhRVQBWG
TLSH
T111167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6833fd122e71346fec1f07f6c362b6da56785f7941bca5c8fc4827aacde93e5d
MD5 d46079dd97bacba105849a5ccb2d9832
SHA1 6db5a55d026299c0de833840171891b10dfd8638
SHA512 bce7cb89001f12aa80d810e255e2b316b00b3d46b805b323ab1ee5979421fe8bf87a2490ed2aff4afa2d3b06f9425bc0ec867ad0ba76c74215174ebc5417688d
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glADmg27RnWGj:Tu6Jmdxd2dAD527BWG
TLSH
T17DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e7072765eef5d4397be08e1524c84d4eeaa912ac40094f0f72a3ffc89c6331fd
MD5 bf068bff002dfb059a4a1d8d3127e5db
SHA1 602b6e0f102d8a33fa39125556899ae7758a051c
SHA512 640ecb5d3f0bf47026d9d714a6b452ce73998dc087cc24d3dfa4c445a0f46c5e687b225cf7b9ab84c7d9a56f8a4f30f54a0bb16dfe24df60ef272533108ffb45
SSDEEP 49152:w1hpsNoJpF1A63U44CwH7R4xkDmg27RnWGj:wmifPWR5D527BWG
TLSH
T1F1B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3d289b01b22f13ea81d66aed67827cb8ec0217632d819a7b7f8a346e2e58e069
MD5 74d4db6f49c75e157c34626e5d1b99e1
SHA1 a3fcafd507d2b3f38dc8a9fd7808028b2f8163c4
SHA512 31b3e5a10f1c4c45567bcb1778a3f2f8596b90c8172ef5a70222efed3d40c1b05321943cad26fdb9fbe9ae5e4d339f87f29ee608c8028b3a4fad832ff6a3e56b
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqPDmg27RnWGj:Z5dKii61PD527BWG
TLSH
T12AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 39e5815717314e0798dcac7424fa2fd26817c6475e289b3efc27c93dbbda1ab5
MD5 75aa747fb7c84db68285a0463af9e9e9
SHA1 8fb4ca952f5b570a717fd91dd2f2277daca21938
SHA512 859025db6519d22947d8474b63542bd11336a520372adcbf0f091c42987680d4dddb350d570064ac48a2bc62f874a62937fc1e875800ffecabc0966e74d5b6d5
SSDEEP 49152:zhtSn8EApI0fig3giDn0AP5wQDmg27RnWGj:yX2imphND527BWG
TLSH
T1B395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7999dfca782e1171e57a272d70d19b4ce40121592cbfb0710bdaf2b33b5abf64
MD5 9c20d5b77215c3c8af38e47ac469dba0
SHA1 887811389d8fef7fb0e67a1c3095ea3367a37de9
SHA512 544c80b7c687942944a5ee2dc57174ea0fc0c357662039fd9a0e09b57d551164f181a73918fbb1c7aff961f6baf3e5be259196a3e7d62d9fc242fd0d84f3832d
SSDEEP 12288:xHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BF965C41CAE62248B5C3E5F10DAC073E57E92004937A9B7CB9EBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4a2643f922e4cdd9d0b69bfd96e76f066d0edda86502db4c673c04989942c437
MD5 3eba710c3b969fe2dfa77a5466583a1d
SHA1 d729e86bc51856897783e75a195831598b5cf5c3
SHA512 c5324b423828acc8f0fefe16d9ee7ab172190e4b77c73da4fdfed4f13892c51ae19e282a4cc027b415e171fcab10e03c51bad8ff7593b38e68c55fe6769c9e03
SSDEEP 12288:s6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BF965C41CAE62648B5C3E5F14DAC073E57E92004837A9B7CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b10f8f96c37f4e4a465949953c4c271d23a42b40b9056fc1dd74139434624065
MD5 f229b5190b52a581009a02853d4da3f3
SHA1 9b1645ac76f6c5fef82bedf2e6a10da850eb3b3c
SHA512 a39eb77b6173c69b2e019cb655af859bf42b847435c57e7d0af8f930428fe7f5c7c5fb80297752090be1c84f90e47f5cb58d0463f9cc5d071001cbef393ef0ae
SSDEEP 12288:KwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BF965C41CAE52648B5C3E5E14DEC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2645c76b11d929f5b194ddea5661a4ae78d4017bfc09103c8feb93d5d629e43d
MD5 aefccaffb7f3663824608f9893e984ef
SHA1 1f9afd5a00586016d22b2f1f83b5b5a17f5e9a98
SHA512 920df873da0415aa0d0767aa7cd5ce81684f146a3cbe67c3c13c5706f7f23ba3a964da4a3ecd08e4eb8e8d622669db2b5c0ed658b1a433a89eb9c3c37fba3235
SSDEEP 12288:MVFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16545237B675C00CAD83285B4C2F5E11DE8237D96EA3005DB6B532CEE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f2e325d9a48ca51b913590e6d3c68e4bafc89318df5ca7279f2ef70f7a59b565
MD5 0346f05c24b9ee63a1359c3723322991
SHA1 50231dbff0dcfe6e0e50725d8d3e1a523ba6e6b9
SHA512 3be74e0f3c7a7e528f8fc908da912b41d776e7ead72c0da53ed8f405ab58446695b54ba919583487a22d8d9a5aeb17f61f82c31626e842b6f7f2a5f05bca32d6
SSDEEP 12288:1NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BF965C41CAE52608B5C3E5E15DEC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 93ef4370db544977b40fe76ece81b1c65806116662e1f5a65d7f1e28a01e350c
MD5 87da362f9efd7ba26d951ed045b43348
SHA1 fba170880da8c488221569c43f510363287c30ac
SHA512 006358934bf4b467b491feb293077e88290dcaf96952b06db6c7722396c6c6c222f04afc34faafc91824d446529c0f3da0b5ac6c96a769d2b6ea93408d574cef
SSDEEP 12288:wGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BF965C41CAE62648B5C3E5F14DEC073E5BE92004837A9B7CBAF6B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ecd543c039f6c925fb656bf7a93234e522ba49ad6058b2899e924201ba15a13c
MD5 e9cbf8ead6159f7f496d6e8c623b0b51
SHA1 4da63cebd002ca2cff230c833be23566e70b3694
SHA512 d72ba5b62bb0f767513a734d95906ebfe5501054a4c26f1960fe9c02f97a66ae873068a41df3586317c75c545e09c62d2ca067d7331cc76570d67467a2f9de7b
SSDEEP 12288:tiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tisqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BF965C41CAE62644B5C3E5F11DAC073E5BE9200483BA9B7CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e4988ee8ce61ea1d80af87c63e1a2fedc7a39ec34d3c96572c97d03d40b5c775
MD5 b40d57b4f28b79f08d2451c151173426
SHA1 f60362d7ca12082de75d9c124a72ff27c5d5919b
SHA512 af4f243dfd95a86409111276fc08b0af3dd2145fdb23a32e1bbe4fcedf85dfb15312bd777139262810982d878a8fae0d87fb54ae331ac264e538b14d63c3c6ec
SSDEEP 24576:kZM3zFVSOasqjnhMgeiCl7G0nehbGZpbD:kZM3zfaDmg27RnWGj
TLSH
T1406501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9bf58473646897c483bd952b63276a48dffa19b40a2e59f16f2b298bda7752e4
MD5 953e534c305eabf9508bdc88f0ff0d65
SHA1 a49016a8ad85d2d5493b2528f59c5eeed62c8e59
SHA512 6ada30b9b35c2c160ad8f71d0a4487c09d9a8e4bf44af0a5a8fcd150ebd0404abd21f9220b94dbc0254c7184854b3d15bcfdf858819368447e3f35a13b72b621
SSDEEP 12288:HrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 34756b81d09fa85b931c859bf03149bcc045ce092d657889e275d3545e0d5239
MD5 d0115406b3799c542ece60a4c7d9b69b
SHA1 2e7b855c17421af832656f762814b707b61d6551
SHA512 28d306528802f525ca2103f987001ca7c92366307ccad000bd1536a02fd56b0576fc63fa49f0c4d39d1b381efdf4fab2114bb65520e2ba10f211b36e06fd879f
SSDEEP 12288:Y/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BF965C41CAEA2604B5C3E5F15DAC073E5BE9200483BA9B7CB9F7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e284ee8419a988d969f0e5de21cee8931a58c7ee81f8a86b8e9c90120f2c7ac3
MD5 79e240d7769c7dc830f47900739dea6e
SHA1 43ab98203c300fecebf6d5d3e1d95f7c20ee69ad
SHA512 b2076e4473c5a114416691f3a50c890ef92666427d503c21fd0553f6a10c58064a0bd680b9ca0aa1d47844ac1246dac75cbe05506af10a5c11052d5b5f3f6398
SSDEEP 12288:+yPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16355025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6730086e616aa66f29d2ba766104bedd147c6f3fc1d36bf1c2a4e489b7b0999c
MD5 2fea6d1d7e7f6c6bdb9bf8830a021a4f
SHA1 c8aae8a72c5c7d0cf9c7bdbb069f725a256f02c7
SHA512 6daf9138d81a8f0b30be12490b0765b033a63149b62628f3acb88461a7f43dd174641f8963f3bb854612604b70de3a140c6aad66bd7ad7f8702ada99fde40bf4
SSDEEP 12288:2rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2rsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BF965C41CAE62604B5C3E5E15DEC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 66c53e71ed79595b5f27799d274f0cae5bd4757009b3b77f9142cbb3fd16c050
MD5 413a5c8bb6a197259e2c3fd5c2b306ec
SHA1 a78b2ce734b78e73d7250f6a4c58749745e48630
SHA512 9952ebb987323344288f0049b5367333feaafae325177c91a55036a1b9003b744a5a1c0c9b940a25032c7e86d9d16ff4b294580bbb717cc33532b861657c606c
SSDEEP 12288:vrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e8b92521706ee8c3c5773428070fcc7c315b52eca5f67669b3f553e7239a03b6
MD5 3950066c870042da3041329df88a99fe
SHA1 9fc85b1105d62106343cb397c58d032b8ebc9fbd
SHA512 81fb924484b9d56e98545e5d3bbe72d1eb8f63cd2ef31fd612c36e261ab8c05b7743d31aadf96867aadfcc574cdf7bf897022f5001616be25d3b10e1a901e431
SSDEEP 24576:ZCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAcsqjnhMgeiCl7G0nehbGZpbD:ZCUZPTY+8Wg2lIL8lrIUJLWwxDmg27RN
TLSH
T15D65AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 340dd88faabb9ca36493edd03336c589381888bb2c3934863815a42d7a0ea893
MD5 85c45664c8a0d548acd515bd84caf6d1
SHA1 c965b556ea78e2b78f9ad149d30c45262e5e7e90
SHA512 c77bc3beab41ffd2e1dfdde806d85aeaee416cadca1df64e8c34f537b9c7ba160ee04988c15612aceee563c033f8c6a98a60179285330e704b4ec0bb48ff4496
SSDEEP 12288:KZsfbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEM:jbsqjnhMgeiCl7G0nehbGZpbDe
TLSH
T1BA55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3506f66a2f86893a621f29f8859b0713de9053c9cc59620be6b7427ce634a49f
MD5 46bed13411d78ef5d4d01b198a450279
SHA1 cee79b6f271ebfa2f9d27649d61c46828cbf0b83
SHA512 0152b9b897d79da83295c61b722ff68a7bbfa144bb4bba58f545c7ef5a9ad982932d1a2ec7a012f2d3e17d12af2a9840abd9e61346541c4b020e982405b4b253
SSDEEP 12288:JQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D14523BAD34C518AE57659B482EAF12D680B7E669F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5f4bb7f8f473b1f133792ff485a845e6d7be4682f42ad2900944e5b91b97ac0d
MD5 550d68891763684071bfde10b3980854
SHA1 a8108ddce0affb04ce4ccdfd3ed48fc254592ef2
SHA512 83e6bf2c33371f181b00f692ad79bef6e1561bdd04f6f8a091606f2e2c4c1637c7929415786ae2e0902f1b23fdd254754104082518ee22a59eb2853ea5c30ac1
SSDEEP 24576:58RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCOsqjnhMgeiCl7G0nehbGZpbD:mRZwQCyiHiQEaiPnMnDmg27RnWGj
TLSH
T1D385B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 4fd26a1b1c295c8dbb58867d6ce46b8e97dc042f29bf603796f2eebee559cc7c
MD5 255257f55af437f1715adfe8580b38ab
SHA1 71611be92f5ca1b76abf9126a0be05b049848211
SHA512 a491edabbc0c55fe091957268ef550771b44be4201c2c0a111f51fa9205352bd50a0dd0d11a17fadd4998e95c820b690225a0aacaf34be807011e5ec764f70ab
SSDEEP 12288:ebxA1U7KgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ebxA1UGgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C55123E62AC10E5E176957D86D2C10AD6337C26672093DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9d9ea8fb5e09eb920072b82bd2e441cf0d9a8a3605f32a70e23ee1a3de6c2891
MD5 b2a84f363c75bf0fa8cf249a4a6b38ff
SHA1 5c432787704c877bc7eed0fd274a08ef3e640d12
SHA512 088acd7a998ee0839eaf410853fa96e86ee2a1bccd1acfa2e5145833f66d07570558204addc0d9b6e44c13d435693a8ac73e69ebe2f847072231745643e1207f
SSDEEP 24576:XjsmP0yHaqrVqHra44KDzMsrnVsqjnhMgeiCl7G0nehbGZpbD:XjRP0yHfVqzlAsrnJDmg27RnWGj
TLSH
T1A545AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 647895e6af2422bef6fbe333244bd4f74fd17cccb96a7355a6bf8c0e86a6b102
MD5 6016e86bc243349c11368d7b67ee07fa
SHA1 4a3eed921bf57e22c9ab0f3040116c0d1996456c
SHA512 fbfc0ffe6bb23c617aef7b46bc8a16b188a7e3470566a691b78418431bd8f66418e8ee8900dc292f1a11d0a39815a5dd192a1bd13ceac6cf624fb4c226a5589f
SSDEEP 12288:umXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:umsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BE924C51CAE93649B5C3E9E11DA8073E269B2004C379977CFEE7B54D88B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 28dc823e078f023c7f7353aee8b41fe676c8b885f76e6fe00ab0035e3ba33ffa
MD5 a5adf4cf51a6de3faf16b1fcbf87c40c
SHA1 7d8381f507590f25c9a924576603f85570133b03
SHA512 ff1b9ca539a6c986f1ce3ab311eea87ce4e27d8844a8a4f6c211aa1c9b532ab1ce76498f029376290b1a38c9594b64c0989f01994e714fc6b8f6a093e396481f
SSDEEP 12288:pOblA4LWO+vAYFT0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:eRLBUT0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 dc9acf79f795e7f3c28ca6800748abb1eeffc972302c2035dad831076429cd8e
MD5 f2f1d104d7b888c321919e712bcac575
SHA1 09280d167aa65ed7695e9bd0e9a6dac82d38db7f
SHA512 96690c942010ede0b70ab5c2b9b40c3162164f805b4811af5c12ffdad14414f455227b74c8a655b5b5627711a7980dea26a81c1587ad0bea92df03f8008ce7f9
SSDEEP 12288:v70VmbIYNvUyBp3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:4zYNHZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F65E12FA2AC08E5E57B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 23904e7071f965a59c82eb33ac24da62789e100d896964704768bc36680544d5
MD5 715d4db417b41f3d72f349e5662072d9
SHA1 84535ba4a6852689b4c53d0bb48b05a58af6422c
SHA512 7d40cbc6ab421214f37e7a6e2e55ab91938e3bb2ff94624404d1b4f3e07989ab0a8cfdccff992dc373ee1376520e7af4135475180029dd9cc03f2e0155139065
SSDEEP 24576:QnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKh:QnXoJJYH84VVS6AmEOJas+cHBjSSKHP1
TLSH
T1A165BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bc1926930e52b34148180fd9bb01fa14829b0f7d3eba2258efc00783c7000fe4
MD5 c97d1e798c7160982dc0292eaf717183
SHA1 745b97eebcf5aa5c3287c3a58192a9a0778df1b3
SHA512 23b9ca5dd7c3ab3575e0156a558a43bbdce544286d9944bee20d700019307d839ad1ec28c9e8c95354380a6f991f2253c60c01859ff08b66ea1fc22bb1027f44
SSDEEP 24576:6v7Xbxd9Tuycf8M/TYlSuxrr2PCPsqjnhMgeiCl7G0nehbGZpbD:6DLL9TuJ0M/TYj2PKDmg27RnWGj
TLSH
T1D1858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 cb378b758501eaab9733bd069b98c5f3da36b702d740c780d9e386f06470938f
MD5 4180daac8641732c5e83eca8330ec4ce
SHA1 68046d74f9dfa7e0096e55a8beec1618a0f9d36c
SHA512 99a78e426d9d0bfccf784a6c88205583c92fa71b2e6bf266b65b4e10036e0887f4757cd0a08445a12b38f3c3d97990fa98a116602ffffd3b6055fa085d453176
SSDEEP 24576:0egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w0sqjnhMgeiCl7G0nehbGZpbD:0ngOJOmPOHzQDmg27RnWGj
TLSH
T1C655CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 6d1037c1f7fd11e93ec0717278d88f15f81367439ba3c2be8a0ebecef40de820
MD5 9c2e5a1b5bba7f6318611a661e32ab96
SHA1 af34896ffece46afb0f2e0b63e8066b6c558abda
SHA512 97c0e07d6cbee08583c0a17e732cd6528197c34d8c487bc7340722ed9080916791e53119f560ff09609ea464e06c327075f9f2cb266ac3da5810a42bda3e4f4b
SSDEEP 24576:xLJnJiTk3R3waE4JrOGsqjnhMgeiCl7G0nehbGZpbD:xLJnJK8R304l5Dmg27RnWGj
TLSH
T1D575E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5786d7b9794e8979b6940d849ed1c2eccb193aea3ef3fd8ed3fc0f5a9331adc8
MD5 750acbdc94ad03d766108d456e635862
SHA1 aa1eb9829d17923311117db0afe239058bae2e42
SHA512 92ab603f065852ff22f8a0a34e64aeb415b4576b6b10daa97fe5810ab81fece9cdfbb695df62cdf8dc16130973d1957a349d5ee47293c244a0866ddd7b7b0efc
SSDEEP 49152:F9mqCzDScAZmlvTcFg8Ph6mDmg27RnWGj:p9D527BWG
TLSH
T16F955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ad992a3806b351e62523ff15d071bb9990214b6907d7d91cb648fea296d2506a
MD5 acce51f62eac2280ab25528e1a1aec40
SHA1 e7257a4a3d4c13697bd81f83e089940b2e6e28d7
SHA512 03df924570a2e57b46966ecc5b6af6a6576138a203dde9da3a2e08e94d3eace579152d0a9db650ecfdcbb8d88a8f28d4127f0f9c68f7a68eb26fec4b142332d8
SSDEEP 24576:llYJeXm5jUuEEsqjnhMgeiCl7G0nehbGZpbD:llYJeXmRUuEgDmg27RnWGj
TLSH
T1025512AE669C30E5E12A8079C2E2C508E633B876571017EF65E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 daee7b8cc478d1feb3e49607357cb08cbe7f66ba5c5d23f533bb918c620c3c04
MD5 d4ece7c0158322e3dabb88a31e126a40
SHA1 c7f1996c6bad96d3858fe9964d83775c245c00b5
SHA512 06aa9a563bcc1edfed8ab63a23f28f52bcae4d31655ec9c1d41609b5d875aec1d6ba6e5b94f89d6bf10050737b015e09631ded26a34179f56f468ba59062b724
SSDEEP 12288:qzu6ky1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qqty1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F1552219639860D9EA760978C6B3C158DC367C219F2042DF65D1FA3FAF72AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ffceabd2b56801cee2cf9ca123c2658f8d906ce38b4beb2550976cbacf60bdae
MD5 0e7163ac6a39ad15cd85bd16a6fa7c44
SHA1 b8ad5eaead266542b033c497248cfa7dbb8830ed
SHA512 8c164d034e940d37defe2d0b79d63f525939217ef91ff4b17125b368f209c0fb746d9da4c3c1365240aaffb54f66681753600fb3695a1c82d42e10c6d7b644dd
SSDEEP 12288:QP0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E64523BE525C60CAD92244B4C2A5E11DA8173E36AB2014E779E7FCFDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d14bdda8cbf4ecaeefb9b27fe212d014f88b2d4f38f79fe7225c31e388ddf6c1
MD5 857fde57d36a4596b0fcb6c83191523a
SHA1 0064e02c5b80457d91fbdd220a177a6aeba62a58
SHA512 bc00a07cc69137d486a417066aeb5326dae6acda13d60d53a51f02714891e2848a4aec0e92a72091fab1d16f985824464bd14884b8b8a48dde17f76a88a70e2b
SSDEEP 24576:+C+TyQIu93VAumZr7jm7sqjnhMgeiCl7G0nehbGZpbD:+/TfIq+YvDmg27RnWGj
TLSH
T151558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 18ca0f1fe76cd5c78431646f01d9fc763747215c7d0f0c3af22ac4eb903f559b
MD5 4d31b50ed12d315de997b306dda91c94
SHA1 afc47f51ff942319a8e1575dac76370c062ea0b0
SHA512 a743278a4ece9c60fa4b59767d1d66047da1bead617730fd164194ec9e12173ee5b92a71c7b6b1bc3c984000e6e60b44af08ea0cd7a7252d6011f971a69e91e3
SSDEEP 12288:ocyrWOstaa3kcsIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:NLQikZIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B265F11FB3AE0095E0A7813CC8858116FA737835571163DF12A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b24870a07b860c6711b347046460e502d2262bd6153a67b1708d06660098e8e6
MD5 94a62a597a0a13ef3cf91a15c260215f
SHA1 5884962851d0f0eff08d30b1d13606134e5c5bda
SHA512 30cb8ad265e761e48763e65b9dbbe5ff3b6b9ef2d37dbf1f878edbd7e42af8d6411202b84ba534388e882b67e91fb411c2ccdde84c62944aff43dceebe7f7ab1
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPpDmg27RnWm:xpC7b4+80GTkeD527BWG
TLSH
T1EEA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b2c1cab9bde641a3a193868417c0acb0addf41fe7c746d173558d44f6ae2623
MD5 10dfa5d548808edf970d4b37972261dc
SHA1 59e21470372441161ed9b98f00d7e66d3e900251
SHA512 4563090dff18345e20d9f80fbf9bb8ca335ef9b57b0122f97383898245c83667ce0e8e7fceca3f85dbdc0216c9726fd077811d54d6060b8e9572c8a6cf44400a
SSDEEP 24576:rSAwJPE1IDAo+4Kt+l4413JUQtsqjnhMgeiCl7G0nehbGZpbD:rqPCIo4Kol4vQRDmg27RnWGj
TLSH
T12B55BF2AA7F946E5E17ACBB4C663C601FB737822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 9b1890afa80580b7996aea7577e9777d42547eb2390e23046da812714a0147ab
MD5 59841f5b0475ca8274404a32d08668cf
SHA1 67ae85093d9c84a3e14a097e64ed4c42b89fa2a6
SHA512 ed2fbf070577afac39a8c9d6107d23abf9c3e055486b93eb1fc31ac78945d99b4d36906260c111fe1ed8f5c93da1c402163a2c5f9641d42deb28a8a1032ce22f
SSDEEP 24576:gyLXPLca94t9sqjnhMgeiCl7G0nehbGZpbD:gy7PoNthDmg27RnWGj
TLSH
T17075D03ED76C04E5E47AC27CC2A3C506F6723CAD033166CB19A495792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 77053054c9adbcf4da2205b586ee39e79e4b0c4833a90fbb3fcdf844be45d935
MD5 adbd8fe8ac530e0c5cc893a87aa98012
SHA1 ec945a30825216ce547d8ced27535874e3bd098f
SHA512 df303987d6b947a341a867907be8b04298726134bf3e3203d6031a9d8408238bd6b3d1a399f05899e3536658852f98a5db5ab34369b3063c245d47e3028ec6c3
SSDEEP 12288:p9lyvj3IkxjbBz4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:pWv8qjp4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14155126E529820D9E43A4674C2A6C12994337D77173459EF75C5E8BE8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/104-455-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/104-127-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/388-23-0x00007FF878CF0000-0x00007FF878CF1000-memory.dmp

Download

memory/388-22-0x0000000140000000-0x00000001414FD000-memory.dmp

Download

memory/388-0-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/388-456-0x0000000000850000-0x0000000000881000-memory.dmp

Download

memory/388-6-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/388-123-0x0000000140000000-0x00000001414FD000-memory.dmp

Download

memory/436-87-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/436-79-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/436-84-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/436-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/436-81-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/544-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/544-11-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/544-25-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/836-478-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-472-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-467-0x000001A80ECE0000-0x000001A80ED11000-memory.dmp

Download

memory/836-468-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-469-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-470-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-471-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-474-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-475-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-477-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-473-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-479-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-480-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-481-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-482-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/836-476-0x000001A80EF60000-0x000001A80EF70000-memory.dmp

Download

memory/856-454-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/856-100-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/856-107-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/856-106-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1128-270-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/1128-239-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1128-245-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1128-462-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/1556-289-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/1556-256-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1556-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1556-463-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1556-250-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1556-273-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/1556-312-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/1588-152-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1588-160-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/1588-158-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1588-461-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/1616-169-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1616-265-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1616-163-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1864-215-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1864-267-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2156-306-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/2156-181-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/2156-175-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/3348-460-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3348-458-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3348-457-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3348-140-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3348-149-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3348-146-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3692-269-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3692-229-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3692-235-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3712-207-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3712-205-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3712-202-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4256-268-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4256-225-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4392-425-0x0000000140000000-0x0000000140153000-memory.dmp

Download

memory/4392-95-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4392-89-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4392-88-0x0000000140000000-0x0000000140153000-memory.dmp

Download

memory/4564-120-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4564-124-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/4564-114-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4580-68-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4580-307-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4580-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4580-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4584-185-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4584-191-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4584-266-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4760-49-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4760-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4760-38-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4760-44-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4760-46-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4920-34-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/4920-26-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4920-32-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5068-138-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/5068-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5108-57-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5108-263-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5108-60-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5108-51-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download