e40adf069cabf03bc68b545adf685dc3d27ba993a4982392b3a6574174c1d1db

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Size 5.2MB
Sample260511-b15pjscy2r
SHA256 e40adf069cabf03bc68b545adf685dc3d27ba993a4982392b3a6574174c1d1db
MD5 2183f834138a3cbacc91c8a73d5ac591
SHA1 256d34a2b53bc6871c1f1af658abf40f4a8c1bec
SHA512 3f6ffeb847c32d7cfecaed600f28d81992a9e76734513d520a818d79461f29dc1d0742114dbc49cc95b7a7ac4c2873d814d6ad5614fdf8a5be1cd36b55c618cd
SSDEEP 49152:0OBiVNVE2YVq3C+WXBc25ckmfbDwZT5wt4VdFXP74fiXzMPh6FlcF5bmr+EelTYu:Nc5mqa5w6dufkFcr66B2Bobj1ELm
TLSH
T10D467D53F3B611F8C41EC9B44B1E552299647C8A4734A3EF0AE877221A75ED86F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3432	alg.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
4904	fxssvc.exe
5064	elevation_service.exe
2452	elevation_service.exe
4924	maintenanceservice.exe
960	msdtc.exe
4628	OSE.EXE
4196	PerceptionSimulationService.exe
5904	perfhost.exe
392	locator.exe
2116	SensorDataService.exe
3576	snmptrap.exe
3348	spectrum.exe
1516	ssh-agent.exe
5308	TieringEngineService.exe
3972	AgentService.exe
5840	vds.exe
908	vssvc.exe
3416	wbengine.exe
5932	WmiApSrv.exe
5288	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dd97ce73dfa73473.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\disabledupdater.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_168343\javaw.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SystemTemp	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SystemTemp\yandex_browser_service_update.log	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cca0d6c8e6e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082752cc9e6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001864fac8e6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017744bc9e6e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c760efcfe6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d56219c9e6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c03c12c9e6e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036c259c9e6e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
1796	DiagnosticsHub.StandardCollector.Service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	4904	fxssvc.exe
Token: SeRestorePrivilege	5308	TieringEngineService.exe
Token: SeManageVolumePrivilege	5308	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3972	AgentService.exe
Token: SeBackupPrivilege	908	vssvc.exe
Token: SeRestorePrivilege	908	vssvc.exe
Token: SeAuditPrivilege	908	vssvc.exe
Token: SeBackupPrivilege	3416	wbengine.exe
Token: SeRestorePrivilege	3416	wbengine.exe
Token: SeSecurityPrivilege	3416	wbengine.exe
Token: 33	5288	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5288	SearchIndexer.exe
Token: SeDebugPrivilege	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1796	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5064	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3828	1960	2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe	78
PID 5288 wrote to memory of 3248	5288	SearchIndexer.exe	104
PID 5288 wrote to memory of 1640	5288	SearchIndexer.exe	105
PID 5288 wrote to memory of 4024	5288	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_2183f834138a3cbacc91c8a73d5ac591_glassworm_icedid_njrat_ryuk.exe" --statistics=https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=service_unused,-brand_id=unknown,-error=UNKNOWN_COMMAND,-installer_type=service,-launched=false,-old_style=1,-old_ver=,-result=0,-stage=error,-ui=55AB5481_4CBB_45B6_A74E_CCC0DE85B80A/*
  2⤵
  - Drops file in Windows directory
  PID:3828

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5812

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4924

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5904

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3576

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2920 1692 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1640
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2976 2972 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 08745f5bdd48c0e481c2f42e4ae284f08b65c4be36e7a418ad49c57ae8ff6700
MD5 d09fbb6278e69deeafdb223490b4ca7d
SHA1 9cc0119df0bb5ec4e2ec00374a1c66dca2c07007
SHA512 7d03b44d5f4369c897496ea46fdf8db75a14ee063228390312d7fc39d842ec96143e0fa83a479142dcb5beb7bf5b3099976981b62b33bfb4e5064b0d4a3c154b
SSDEEP 49152:K0X4/T3QDRmcQsqAU7BYYkGlQ/lFTjN4:R4EDRQDiLm
TLSH
T138B59D03F2D941E8D06AD178C746953AEA727C890B34A6EF0790B2592E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d3682ff54687315dcc1523816efffb6878bf0a80ae223eb2945759e85785b7b9
MD5 1695a497c2b6070e7a3eac2e6f7f0b96
SHA1 799779f934ca09640ee09c8f0414bd9e4fb69db2
SHA512 f029635ff10f771e5035c41d811917e4a2da26916bd13b6ece2cd577e8f2443028588af9ff8ecd44c1974fdd4c9d131dc74a40ab09d8b40488b1e53be9e3720a
SSDEEP 12288:W1XLsswWkxy2lRq2czAjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:UXYfDtczATnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T15E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1bb26eac808988e6ef8ca27837b1d75fd015fdbac0f340414174db76b0d23ade
MD5 fbc0e2aed116f8f16cc34822ba4a8a42
SHA1 3556b9eb15e4781dabce25dc6ad1bf69e45a4f4d
SHA512 315a70025aabaacd91daf0a1f9be45e0e08e720d9cddfe7f592ec21963af55479090d34177b528c7ee8d7f9aaa7b39fc3651b6e47075fca923300c9c90b50c4d
SSDEEP 24576:M0Le5ji0hmxLrM8nQ/tbw/2Mkjy6Fr7g0oI:MPji0Al9Q/lFTjN4
TLSH
T1E8859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 253c14bf46f33966943ac4e10e91c9fc7b719f88d888ba9ad22901243d87d83e
MD5 4d9fdad4472ab79080574dfe0a404ffe
SHA1 bd720aa59b3bf431c0dc36510f4ebf3174fc0e54
SHA512 f43dd76b573fa2059e8b8d9a220c1f2533870afcdd6ad860af7dc72331da8e4b3debd17d63d3ffc0215018b8b10c0b52549dfff3940788bc6e0ca5cfaca5eedb
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyu6nQ/tbw/2Mkjy6Fr7g0om:d/ezSC6vUzPvxHjyRQ/lFTjN4
TLSH
T1BF755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7d5436c59af02d4acb4d2cc5dca1308a93aef392a7e0d828a049c156d977c8e0
MD5 8fe7e730d49d03d08ca0029c0fa8c16a
SHA1 56fb97baa43fee8a498e1e633f90983f8aed41aa
SHA512 f28c05acf99bc2489152b231b096145cb1eedb6ccca94c761ce31b5fb4ba449be0343af29d7705ea084f0e0d6abb7e3bcd1c84a2580e47df18a13c49b32b395c
SSDEEP 24576:mVbqPb88hv/l+6/nQ/tbw/2Mkjy6Fr7g0oH:mVO88hXl+QQ/lFTjN4
TLSH
T195559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 221aab3e3a95d8fdec6ab5e939d40ce92aaac760845ffa4164ac4cd05d8189b2
MD5 57726a72de8e2a062a7f09e9c0226617
SHA1 d256a187b3ecf8b2c4b3ea7fa76ecabca8999520
SHA512 f77ee0c048a7cc6f9b5d49d878584e44a0c166e1ba1d71047918cea7b5ba64707f6c5048cbf48b39dc0e6c18be4724bb45475a86d6e610f49c8eadd8b9471c50
SSDEEP 12288:nzoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:nzonQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1FA5523796A14F887FF2B06B15CC285826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8b7da48f56750260b6529d208b3ad9dc547a71e9c9e5e3b4e0614dd2398003e8
MD5 c7461b1d1ab80aa2241e7f698758791c
SHA1 19790f75c4195aeef9379e7908e226177a68380e
SHA512 357c72a36053f2d66612aad0ca65281453e9b5957f1a56d9b5b7dec7a1aaa7e269d3b5a9ac1d1056b0764757e2c689b0e860ddbf175847f03b30ccee07e90b92
SSDEEP 12288:yeBNUbTVO86UHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:yJIUnnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cf83a25fe4126a3dcaa9cab44250c0682589066731892e89373c7cba57751327
MD5 7bdb256bfb22de3fbc902df254efa079
SHA1 37fd19b5a9d7a82b00bd113896c379597c0e1a83
SHA512 a58eef677f7375c95afd1ed2fd0eaeef9d7184bd94ec3a262b68a74f5c7cd7885a6f8cfd9eeab280a0bf8c0c279a9a59696b7412525cc736edf2f9bf250112aa
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:HQvGAdlCEL8c/yRNw5ClLm
TLSH
T1DE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9be16b33a7a68915995b74e25149474839a57961b2456b589cf3f81ec03bb70e
MD5 2ee1fc596283b64f609cf418e468fc94
SHA1 6ab2e62d81646db95f72defd09e32c80aa19972f
SHA512 0cc7fb4d6c95d5db6ee224ca3c28cbb3cb5d9a69260d29164fd7522174c1daae0b7d2e8465890a5e50cf4e04da54f4bc410eeb0fc68f85c064631af7fab1402f
SSDEEP 12288:jAwSfxL/2Dc39DLLmt0LDQewsAjNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgH:cQewsAjtnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T14E75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 17bba59f58112d388f2faf4e4c7b3e8c291060d9d9e8fef9e1e9ff57b7eb985e
MD5 82f16201fb12783a279acdec955f40ab
SHA1 97c42682b8aa296c11dd5516c84d61dbd48895c2
SHA512 55d8420a2060456c0c2b6fb0443228927b1f8626d2da803221f176294be65f16d3b72ce67a76f910993d59f44c5c5d3e0c17ad7c888751cb55dc43094ae83db6
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHKL:aUEtQevvqc2W1cpV2EI32
TLSH
T1D3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bc9fd6dbb7433187da05945beb160270f0a6e150a1d1576f3040023536249587
MD5 4dc922eeec07559d5482699052c5d76f
SHA1 f634e16caafd2ca80a1362e8c75519ebb27d0d31
SHA512 54bcc01bbaddf192e72b83adbc7fe802473841c9b8f94493e5420c785c9fb8d081e5a6f166639d15b0bfcf1f04e49009fc43251713e991b9cb6c1afb8b8d1f2a
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/zNQ/lFTjN4:joqtVjnmZLm
TLSH
T109D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 177c19e54f5087bf92a3cb2621bba7a59c88970feffd216c5448252eaa2057cd
MD5 c358a35f56ed15f7937375e709de3e5f
SHA1 0927dc15ce039cef3e4d0c337d4b8974b3eae06d
SHA512 709fb900f7ea47bb583a32b6f5b4ee1f96fdc111ddf350e5788da744f2a3d63d447938bfb9980a5fcbdbc6d4c9e5003575a298930b9592b5fc711ed2072427f4
SSDEEP 24576:uAhGLJIFoiwtA5l7S53enQ/tbw/2Mkjy6Fr7g0os:uAMyFoiq5uQ/lFTjN4
TLSH
T1CF35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a788df76cea690b332721c56da3c199151ceceaeb033d14be9b519ca016b6bee
MD5 a503355625f2bce3a5ece22551fde633
SHA1 ac4df59584cc7e9f207ceaaece9d7ad8bd7ffbf4
SHA512 1bf424c0470676607596edac32358cc966519e698c29e29ea9cc49eaa659c86217e47e7a1ae7802f089a486e3b656b8e0e99042c60d998007b806432ef5fd58a
SSDEEP 12288:5mw5HEjsChN2BFgl0WDm+CaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMN:UwuHOWxnQ/tbw/2Mkjy6Fr7g0os
TLSH
T15B65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c2abf363d71d525313762b376bf32266f53f3bf3718b7c3b837d6e25c7d0692d
MD5 00d7fc436722ef26507cec3b632f6d54
SHA1 fbc72b1c0a80b858653699d90f78d5f704a64d50
SHA512 91a1cde04eba37b126ddf3d65216c45bccefadb956cafdb8fbf3cff70a7ba92a079db1650e6e88e827560096a84a54efb33a6ddc92736d4c5a1a279d1ef4af26
SSDEEP 12288:iXZ1Iy9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:6ZuknQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1FB55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7C11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
Size 6.6MB
SHA256 3355f5d3c61b50f93567e863950a56a1e61847693848a7b497f66959e449c5f3
MD5 03460ab5ea603b61e7536e69f884593b
SHA1 e99cb8a72d809acf58ed8c94a0e333e8d83fc783
SHA512 083257e4a7018cc452ae7f50d8b01272741fefff298ba2827335b4a5646fe542445e8ddfb0fde620be2b8ced2764a23c5ec4c99d3606d5e6f98792d7541d2c34
SSDEEP 49152:/TEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZu7H4mYwrjDDSNdihLuZykH8mYxw:5ut4LcLBbPU7H8SUY/P5h9RLm
TLSH
T141667D53F3B500A8E05ED9B4CF3956229B757C4B47B092EF269436E11A72EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
Size 6.6MB
SHA256 5ed87f94dc2ef4e66c4ebc5843c16840863855a886dd826fc992ba66526fa6bf
MD5 f926cc95c14f8f18dfc10be39a5adb4e
SHA1 f004702800f79d084dfcc583b4ed1d506646e5a7
SHA512 1ae674c50af29fae92d5d38b6a77d27f89a05666956c7ce1119cf8dce95d75a20be24e9291457ba8bec59d8495884812c18e66f6b158f013486c515f63bbb1c5
SSDEEP 49152:LTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZu7H4mYwrjDDSNdihLuZykH8mYxw:dut4LcLBbPU7H8SUY/P5h9RLm
TLSH
T1AF667D53F3B500A8E05ED9B4CF3956229B757C4B47B092EF269436E11A72EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 3f85fa7e00b1dad0b6d47d0406e24ae44d2c4877ce30740e3f0f5aeeb7957e6d
MD5 74a059a89651624c30534ebffa06130a
SHA1 f35e3f9163f33b43b8295522f9e84c248d98e781
SHA512 6af015fd9b9c8c3e8e339063cee0f8e08867814b2ab96a06b105f70780e221d9bea47e6f9f312b595a45b9225b33f6388892ba162e1de7904aa18e684f5e110d
SSDEEP 24576:zXHhwegnv8593atGFEtDUeRQt5iMaJgv4W2E4PsnnQ/tbw/2Mkjy6Fr7g0o0:zXenvGq2EtDUtLuXW2+Q/lFTjN4
TLSH
T1DF95483672F300A9C45EA0769F56473196D27CB1CFE0D3DB8241721A1FB29D47A3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe
Size 3.3MB
SHA256 1f0fb38a568b4f4f81917c97a55540f9d9e29c70d051b3a46dc47037fa80441b
MD5 70c3d8fcc66e466c2e5db82f33128f1a
SHA1 e2dc79ad186be31461462d5acd3e0d939ffb6ae9
SHA512 60f05475d5ca1f08875709b6e88286750c89e927641f6d7d042956684497921ce08cfe459ac8568bbe5490edb7cb78ca5bf3d6279f25aba2a20819ec2a60d361
SSDEEP 49152:sFKbxUEEhQ9gsfxp6MZEtEYVnNKkNIHNNlCX0cXz6GfpksGLP3/NxQ/lFTjN4:gKKsnZEBSkNIHNNIhj6MpkJWLm
TLSH
T1FAF57B13F29900E8E05DD1B8CB4A9622EAB2BC850B3576DF0650B7562F7BED45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 a9db97ed708565ba1eb0d071f8dba200108818ad45b4c6f73dc2725383be42c2
MD5 2a895c183047aeef01a1c9c408c8de2c
SHA1 5442b73609cdb06788b4eec2f95dac0693f751a0
SHA512 fea1e8558be932ac82138bf508582686cc5f95b319add35d20810afb27790fdd92721ddcca46387799077b8b98f6670a5acef38c10970c1350f510ed4fe3c5eb
SSDEEP 49152:e1xWevYkaNRxiCtSGAeA4msvxQtghSpOzQ/lFTjN4:kHMSGChLm
TLSH
T1D0B5AD07F2C941E8D06AD574C7469236EA62BC8A0B34B6DF0790B2562F77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
Size 1.9MB
SHA256 a03f7e5273f53cda72c4f7d7e3297d4e064b2296c85c220ffed5f42aaec23949
MD5 f1e246c804bcfa5d7e62c8caf849cb9a
SHA1 ff428ebd321205529bafeae7c1a4f74e5836a729
SHA512 8e0aae01ad3ae3eb77728360e1260798725c3d43c608a8fc770d19a4a6196dcc21853fd161bc3e52615993924695739b7dc4096d2d5af07a9b92f0070fb7370a
SSDEEP 24576:rvA5Wwt59ZKNT4cQywprNzP8AqYUI8byGrXP3xvHrrnQ/tbw/2Mkjy6Fr7g0o7:rvAl59A9GJzXq9I65XPhvvQ/lFTjN4
TLSH
T15D95BE13B29940E8D05EC1B8C7568636EA727C820B34A6DF0798B6592E7BFD45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
Size 2.1MB
SHA256 b598c0fba508601e6b9c8cf48d457f72b54f0ec4e699f49a2740148e83a29c29
MD5 16ec7590e8b29823e3fc7906c82e4513
SHA1 ff314ae456922cb5b5dd5d8366920a0f7310756e
SHA512 2923d35a6cdcedb9be3439623f97a06272c1d0717e81d2187ce15a8e1fadbd8ca77585154b1e8a7684866390f19ea4feaa8ff5fd024346168c4ad005013a4074
SSDEEP 49152:tXZNoU5kqRZvTE9lDKGWfMhkQ/lFTjN4:jFZI9lhWoLm
TLSH
T1E7A5AF17B2D940E8E0AED274C7668522EAB27C410B38A6DF0790B2591E7BFE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 f9dcb4101b80ceba783f86b6ac1a97b7c9a06657536ba0ba103daa592e309e3d
MD5 89fe67062bb21885c38249fda8e8aa8c
SHA1 04344fe2b19dc744bf38041ac9b7e03e25e614e8
SHA512 9f41d31e12020e72b5d459c3f63f496fd7c75563d0d6289780bb05c1996557ccade9c7adf06a71ba563955ec2709920c003c746e3eff71841e3a8696eedc95fa
SSDEEP 24576:409xwCr/8dMJlrNs4ffuTdskLV+gvnZlunQ/tbw/2Mkjy6Fr7g0oL:40FrFp3nuT26V+guQ/lFTjN4
TLSH
T18875CF17B69941E8D02AD5B4CB668132EA727C810B34AADF0790B3592F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 70417a1ba8c3a7c9bfe7022945cefec591fda4e4a6c7ac22bb7e6ea090f3c614
MD5 25551de0453ea00cc94ef07718ae8d90
SHA1 7b5ce7acc1c81480ecabbdfd0366b9eca0a1caa0
SHA512 61e154cca4b215583997eca8c380ba17bffaedf0db8aaa370ac5d4dd774856d07fdf9b3d4912a2b475036867338e02366a02f4af34d39306fd36889e1d5e9f4b
SSDEEP 12288:ZwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:ZQnQ/tbw/2Mkjy6Fr7g0og
TLSH
T12C5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8cdc0e5dc4c5e3bf6495e3b9b39ba187d92e8dfd409fc742acc6a4e23541e7f4
MD5 de4b61709b1a87665c19bad55f672bcb
SHA1 4b92d22a3e040a951c8db53a10af1dbd59632fc6
SHA512 0b94c7a5c97f01f1855f5bec6f83cc9b076d12fdebb37ea922ad00c4040b67776386b1a51ab3d46c68834aa60fedddb8fed69c2daad1d97e5dbb879ace511e9c
SSDEEP 12288:r5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:rJnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1AB5523697965F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ab7159462420d27d67da366b6999154ecfa4fd293ed0f32f5d0cdbd593bd72a7
MD5 d551784bbef521346ae2fea4bc3b9c7c
SHA1 40cd3a5fd5ec8c3028dddb7ef6ce0f8886359b52
SHA512 d8db8fb19a9129a01fb7930f67a17ced4760a40c3423de770b6b210b4aff9ed081274517ed37ac3859ca450c9393b9d0c8df2f08a8e5dd65c2e83f153aa37406
SSDEEP 12288:ovGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:oPnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1935523697965F98BFB1706F14C838182AB7B0DC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f892b14a8933c5ccdbb8e841e2f7190dff952b768d87e5609781eff04c67339a
MD5 53bfa3c0cf514c47d8bfea517f68f509
SHA1 d020c48d117b208806111b410bd8d16ff0abac85
SHA512 7ef6cfdc7fffc10b46be210e6e730522309c6e04e2f3f9aeacd5809836f41e2a5caf83b77b7d76f61bde7b32e79bca2f954f2a32c09676e4f35ba435853ce8fc
SSDEEP 12288:1V+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:OnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1DA5523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0efaa0b046c7df36f132fe3bd73b4b7738e2c7f96c003835a1ee6880e41bfbd1
MD5 929c4e430c9a72697a652ec5e9b12752
SHA1 6b5f06beef02488837edcaf496e4d83f1d490e0d
SHA512 09189755aa8030d6a0734d661c458c3028377d916286b8db9dde8432d71b0810fff87131614d2c00b20998dc38d53622fdb51e5f262877eea3d67a7d580856e2
SSDEEP 12288:S2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:SWnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T10E5523697965F98BFB1706F14C828182AB3F0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0853761bcaf8ba8cda41e8258ee05ab22d5355feb84e899ef0b31e5ac38c63be
MD5 c291326beacb95528a525289869c2710
SHA1 d350887c7896e72754f58595a8b895a51c9c71dd
SHA512 4303870e07f976e13bc5e4cc78332d793e55d8ed7453c2c1f52a623243cff0e48185cc3dd174723400444c61cba67bb2459061e4739a1b07ac84361ab191e4ab
SSDEEP 12288:y1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:yVnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1715523697965F98BFB2706F14C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0ec9e7b098d9abc9bbebc25f6db732de9eb9c711d7d98f582a9114d16f8eb873
MD5 bae1ea5f9dde99af29a61c5524a71d18
SHA1 5e781764c5f8c8794f8eb572624c35dcf4c00845
SHA512 6197288f653e996362783f339ab4dcc7ebeb75336f43c5443e94a18057ddef471388f7eb2640d68803960e49667809b0580d9611b2caa9609aaa234081dc8607
SSDEEP 12288:bxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:bBnQ/tbw/2Mkjy6Fr7g0og
TLSH
T11F5523697965F98BFB2702F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 601b93edb69fd87c44de39d322e1eb86333203af8ff8d9ba0cbd846f5e92a800
MD5 e27927b4ffa9a3c3bfe8ccebdfa35338
SHA1 64b505e49af7e209234d58f9f5b13b7addac28fa
SHA512 23e7b1e9891c8b90678de464b4b3134718e87b3223ab1be55094cb057cdb0f19fde432a16da8ab9c698ab6f43b082a8a84bbcfb367aefae0059d70453ca2f250
SSDEEP 12288:KiZwbDzzFEoS2cPvyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:tZM3zFVSOpnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1177501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c56eec8f598fc672b72943baef8b11dc07d9811a6b8792945c925d71ea954603
MD5 e132dedc727c14b86b6d569ec515e6dc
SHA1 6304ed94af56d19ede9fd7683a856349f86caab6
SHA512 96f6c771687bbe26500f6b6fd52d89367cdf27e8817b45bb3197928a015ee9cb5cb3b194e1f530f7160f3f471d3bec8c41b8e6dd5d4815b7087114a5bbefa235
SSDEEP 12288:X0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:XUnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T16F5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8a2115944dd9fea5d910f7135558faf55b409b181b199265b76443b48025b49a
MD5 58fa24273331ea4f1ec2d524d9bd0dc3
SHA1 bad2309721007c87832a613283b68103cf286fb2
SHA512 49673e97911e1a55048f27cd5d4734e574954d0fe3e335fb91acf41109d751fe3b249c10ce4bf88f38417873d1019bde7092ac8769c0f82569f3fa8b5bf9424c
SSDEEP 12288:xYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:xYnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1C45523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3f30e20d815560c3a7cb804003797fc87bd4356d3e0d0f210ef7072666d8b34c
MD5 b66de18cb40f427aa7e7882f7f474eda
SHA1 63f5e2cab105a4ed8af27ef2c6624959176b22f4
SHA512 d409585bafa01b59c1714d6fba57d07597dab0295e40bb78acaa080114033f45519cd26e83104eb29e21c5dac1d7ea55960d5c69dd45da53e3a0109a808b2d09
SSDEEP 12288:MyPz5L89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:VzydnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T19365021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 75217181549c68b533a9669dd0463bdeae276c0bfadb7efd55ba0fc74d358fdf
MD5 74eedc3e479b8bf48c1b3872bf7920e3
SHA1 a529f242a632f4932f113829a2930e9e275804cb
SHA512 0df9256f5a3cb6de264d1a430a2930654f65bf046db28c872528d101b18185954a3b2b9415c3b3d465ea1d324f00c1406b70d1eadb988033cb1fbab1365f0445
SSDEEP 24576:9CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvArnQ/tbw/2Mkjy6Fr7g0oa:9CUxPTY+8Wg2lIL8lrIUJLWwWQ/lFTjG
TLSH
T15B65AE1EA3EC0896D4BB813589518A06FB72782E1B32D6CF2160C33D6F27AD55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a2bde47c91dcfebcd4c68b7890e81ea3782149c1636d7c3a5fa57ccb983ec306
MD5 555558c01c48ba6d936d8c9556b32316
SHA1 4b3395745dba212873e989a9fe0526d09c9db1c1
SHA512 3eef912546bc5ca8a3b51fc83db88a6f7d49ea86e122a1d10563b0d2a0c9741d307f0132b27f89ced2153107542db9f8e5acbbea8787a9021911403511a2fbec
SSDEEP 12288:OssfEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:4knQ/tbw/2Mkjy6Fr7g0oH
TLSH
T11365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 298445efbcaaba0194fc524c02d3ae7acbb1ff7c9019d53c02d06a7cbb3c0be5
MD5 8ebd9cbfbe1541e963197e24e21b1e69
SHA1 f66e1b36be8111e11577474f7dc50cd274add7f9
SHA512 c6f3b62bbb8088d05d89ac1a9f9dc56f7bd0e3ab7f1b8394350d0fe4ef7a43e3d69d6c4565df94367b290c9c656051efc7e5aa8bd5f90de5dd3a4dff5edcf27a
SSDEEP 12288:MPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:MvnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1335523696668F94BFA3B06B04892C111673F0EC5BF90D7CFBB042269953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6c0ff8b540635f1506e002844cb9082278ab28946b0f36a4b93b4dbe369593d1
MD5 4f9bc738963c8bbadb14dcb4c91743d7
SHA1 9c829dd6c3a59c77e9c0d0458dc2a8f9942b0312
SHA512 8f04fa514c625112b3b0edbfdb75a3946b48cca44cfd0009c72a9c516d1f3041d23f8f1f399c0c7d2f4091c6952106b1a29cd81c9db9ecdc49cdfc584b55d1a7
SSDEEP 24576:t8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCNnQ/tbw/2Mkjy6Fr7g0o/:SRZwQCyiHiQEaaPnMcQ/lFTjN4
TLSH
T1B885B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 65910db252949e10b8e0f1622e1d8f08872ab7bb936f3434d14098c9eb416b62
MD5 22a5b18c458590636f6689fe1525ccd5
SHA1 6aa8a83581f87b4dd1625c6f9f26a624ef1d12f2
SHA512 9d6a6e6768689498df8d5129430d3451de18ebb3baf0478199ba28c84ce4649ad8f4838a4265f1725bdd8a81bb4fb12cc75006b3ef1dbe5a6c7518029db39613
SSDEEP 12288:vbxA1U7K/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:vbxA1UGfnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T16055123E26AC24E6F636927D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ef6cae45a1276530226523e9a41ecd988c2d117ccf2e84f4a05cf687b89e7234
MD5 aaa7e5146feaf8728703ed4347b769bc
SHA1 7bd4f52f4c24d6a4dde1c1faf9f2d5ed4fad14fa
SHA512 e4c2ce804012545f53a481c9110b45577cf82b6397748746d186e7671fe43eeca6d195c54405b72dd2bbf4547d8af3630bbd3dc042582a28e21aeddd46d4601b
SSDEEP 24576:ljsmP0yHaqrVqHra44KDzMsrnunQ/tbw/2Mkjy6Fr7g0ok:ljRP0yHfVqzlAsrnuQ/lFTjN4
TLSH
T13545AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e9e241a3d886cba1f05edbcfeac3dee8fb09663fa9021143a96497ba68241362
MD5 b7a4efd09eb4bbd7a91163e0ec297632
SHA1 59842ecb2a75a941707777fc15308950327cc2e8
SHA512 f8692c819b503d9eb5bbc6a4c910dbd1f0fc6e4247b6268cbcc8250200291d353a15463c693daf8d17b2ca6d5a2a9c96bd48ebb0dec337efdb30f771861c02bc
SSDEEP 12288:KVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:K1nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1C15523697655F98BFA2706F55C828142673B0EC17FD1A3CF7B482229867D3D40AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 4b3437795c533a2e519bbf772b7b7d7c1c8fe2e4c11eb77b05d8635eb7848bd2
MD5 92c4e424ba167e98f60e338bb0e97f5b
SHA1 b148e6709d9a93920c81440f251bb03079546417
SHA512 ff1efad2aca13a10e1a10a9b3ff0f49194e94094086c5bd62099374e73ffd11054b7d47b5f35391e3d5afcff10b980b51583476aa2278a405847a951b49f4339
SSDEEP 12288:OOb4A4LWO+vAYFTjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:3wLBUTTnQ/tbw/2Mkjy6Fr7g0op
TLSH
T12475F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8e30491d775d1e6ecbf5b263491b5af48bdea40d27f13b6a2fbad7a46c7f036f
MD5 cfba63e60bb9d7585a1a4e3f6adb51b9
SHA1 a9d92002c065a3a3159a446ad2a5b228d69c08eb
SHA512 48089d9e61bb1308e26ee1edc131c2d2bd22626349909f35e8d7d4f664962a4ad1025d77db25cd3eea50f6019fb1706e401305d17ab4e8e95b84c489af30a204
SSDEEP 12288:L70VmuIYNvUyBpAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:0KYNHSnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T15E65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2ce5b0f99749d5900116575c97b118f94e30bdc09dcf2ac59efa6df1270c95ed
MD5 e7be6a370a43bba2a4540f426fef78d6
SHA1 3deeb5cdca8c69485b361e78ddfa451bc46f2733
SHA512 366cb8fecf92f93b5d2875185468644600fae1cea6f8a020932fa22cf8b55c6de0990b66f4a3cf267f205608383276f7ebe30fb523ed279815f823ab20dbce15
SSDEEP 24576:SnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKc:SnXoJJYH84VVS6AmEcJas+cHBjSSKHPJ
TLSH
T18365BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fdd2cc35a05faf0fce907ccfbd0fbb4f11648345849ca92ff20b142ecbd6ecaf
MD5 ce523ab338acce325b91a6f009bc09ab
SHA1 1acf997af2e4bbd046701803c79b6cbb671b6199
SHA512 c15e3b37a8558cf8ad721415f0ddb96858e8753913a32d1b3a844fb8b7d4e6a27b5cf2db04d6f41059161d25efb3ff6954ab3d230fc144fe0386c51ad3be8d4a
SSDEEP 24576:+v7Xbxd9Tuycf8M/TYlSuxwr2PCInQ/tbw/2Mkjy6Fr7g0oA:+DLL9TuJ0M/TYW2PVQ/lFTjN4
TLSH
T13F858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 058df2b2dc2ffd0e7540fc106f77c6a63dbf291197dec6e3a1676692f423f1d1
MD5 69ac911b99dd3eeb9af4d894220f4271
SHA1 107619c66a347594e9018a678ff8b9f21a51afcc
SHA512 fe6c79622bad1c408daf3b0fd3cbc30a52b0a388c09774aa18d7559e23f1a59a562ae84858b90f92bf2edfa1fd38858a62e34433b184c23c75e8e2798872fc5c
SSDEEP 24576:RegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wTnQ/tbw/2Mkjy6Fr7g0o4:RngOJOmPOHhTQ/lFTjN4
TLSH
T1A555BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 651be3f7bb4138fcd7af4dd8cc021213010da22b0a3854d78fd209e18720a313
MD5 cbe962146ab585fe95b7c050f832eb59
SHA1 5fe547b341dbcd522f990b8ff4bdb04c6bd049e0
SHA512 a6a864bbb1bfcb1c0731acaf139073be5938e339056de1221100e22852286578949d0d6a8e688025a24c77b4ee5a6d2c99bc3e74f73293056a6e2d8f99893b35
SSDEEP 24576:xLJnJiTk3R3waE4JrOVnQ/tbw/2Mkjy6Fr7g0ob:xLJnJK8R304l+Q/lFTjN4
TLSH
T1A275D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 779256c3c17acc60771ee3d0527409706896e800769884fe80401d04b6318668
MD5 749871b97fe711ffc1fb598cfe6e624b
SHA1 f0350307afeff02032f24b9682b325411a46dde3
SHA512 647dd87cd814a58819ee2a50cbad9e0398cc18418996c25c7b3c54c7d5c68b55f5986ca7d09e3ae79a7ca89d213f31c74bf19c54004e0f48be022cc358b420fe
SSDEEP 24576:JA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pbnQ/tbw/2Mkjy6Fr7g0oA:e9GqCzDScAZmlvTcFg8Ph6BQ/lFTjN4
TLSH
T1E4955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 fa5cd8d791183fcb857cb13f74eb3aad536f195103293121aa908539c2f61e2f
MD5 1acec65e99339396df33b98fe2babfed
SHA1 1e7b49ca7cde4b74cc689dd872f55da990422e69
SHA512 f7fb6a070871abb6db7a782548a22f76c19b6c3007af8468c4441eba98d47f06ef22f27e6bc6e239200b0ea8ca53453c53566e7296550fa1dd727c782865b62f
SSDEEP 24576:wlYJeXm5jUuEDnQ/tbw/2Mkjy6Fr7g0oy:wlYJeXmRUuEDQ/lFTjN4
TLSH
T1AF55126D366CB0E6E22F41B988928545E372B4A1274163EF62D0C17D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 834f126d82b4617106f0bdc049d834eda67871ea9c7c143f91b2c19e8912c9ca
MD5 232cd9c6d4336db0726a2d38535027ea
SHA1 09f330648df1c52c02045a34f8be32fd6e14d912
SHA512 56e0d20eeac4b466a6f400780b7127f875c6c7a6f78819f3f8c025fc0324827e543dd820b419f3b5593063669e3fb12612e0c27272847c50a04253f4f0920b6d
SSDEEP 12288:SFu6kyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:SUtyOnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T19365121833A4B499FA7A06788DA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 4fc4a14dd98b1c2fd0f9cc926d5c41dcbca045e9f75dadba5c9e0d26252ee092
MD5 6e131584004695e335333b58b1c65e2b
SHA1 4f03a40342fd5ee0c20ff1711f8b87e1de1e4720
SHA512 9453d6d7e516415200569cdb6c4c0ae17d1205e2ff889dc3f7dbe64cb6c69d8bac806bf06e4c678d83b9465530ea57e7bd8d3863d3b5fa21c80101c68a10764e
SSDEEP 12288:fPjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:XTnQ/tbw/2Mkjy6Fr7g0or
TLSH
T19555236C2624F49BFE2706F448528142A73B1ED17F91A7EF3684A139CB7D3D016B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e2e2bbe3a7c974a1bbfb040261466052d8fa3514e3ab85ee33f09ba6422d850e
MD5 275fdcc461de0f1e4c781b44b0330e06
SHA1 6c53b2715e5fc36e103a093b7c3e9f17ae49dd60
SHA512 8f6aa0c76e8df682eb1ebb7899308f8812b4580d1bee45a4c15a4ad841194741a4711ddbe98a0577f4a9e558e84e62c037286c8f1d9ad3c954d337b5dada5955
SSDEEP 24576:5C+TyQIu93VAumZr7jmEnQ/tbw/2Mkjy6Fr7g0oh:5/TfIq+YEQ/lFTjN4
TLSH
T144558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7bcc5c5228df7944d050c54aea799139e8a739542e597ba629c153eccd7e5142
MD5 e533005501615b7ab694f773b0de98c7
SHA1 35063d142c912babf985a8a4b5e7eb351d8decd0
SHA512 c26eeb6c8641b6d2377d9db45d7101b5833087e262b7056aa4796c547952856b4dfdc00b1a2fb5311d9d297bc4f765cd88f28b1d293e7e15f6bf6fa475a87bfd
SSDEEP 12288:1cyrWOstaa3kcsXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:ALQikZ3nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T15A65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 68a54d45f35b9ca344b74c1fba621e1f4cc7b5fbf56e462d4f9e4b2bf8c5d397
MD5 48444891dda67f9d6fcd2bdf8757707e
SHA1 2d3fc02e4db42da8485f6e7ee4ec592e59761cca
SHA512 37d4ab9a7154aa4b028ce447c68b42b84fba55f83f8722571e8dd17f153ce8dab5fed2150e96977bb25832c5ae70d689d385d5837468d746a468c16a2a4b7ace
SSDEEP 49152:CpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPOQ/lFTjN4:/pC7b4+80GTkuLm
TLSH
T1F5A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yandex_browser_service_update.log

Path C:\Windows\SystemTemp\yandex_browser_service_update.log
Size 3KB
SHA256 8798f457fc40ba234e9f9d2c07799972cd4a66bc3223f8b59b85a866dce489e5
MD5 31f966ad2c896589bbb890853fba2060
SHA1 99f84c2b9f5c82c3cf47f1803db8bf7083cca65b
SHA512 1905c10e7ee84282500c764e888a039bab74563f9dd9a24a9d7145f6180ae6ae6dc20f49a2641f52f9b4196a7dc1ee51803137d82f40b34fa03e659112a6b34a
TLSH
T10471129C5AD91A323F2C02D7E2F21B630F2072462D08C67455BD409D35A3E6C3FAE0B9
MD5 SHA1 SHA512 TLSH

Submit Download

yandex_browser_service_update.log

Path C:\Windows\SystemTemp\yandex_browser_service_update.log
Size 4KB
SHA256 fba072a313dd6a67aed4c43b22f554160e25f9d43c52f22ffee4433e33930c2c
MD5 e0606e6f9740ff228859a8b0e8333bf1
SHA1 f4e284743980e13a6d3ed83fbd2b1a2825a296e2
SHA512 c75f426007bf6e0a47d3388f6a7713363efeb57e94a68c6a23e018c3739441b655293fa3868d8e5a35c84ce4b0ff4a072a928c5ffb524ce3d82631437ccfda6e
SSDEEP 96:K6LHYgOHTc2/Qh/5h/whjOdk2XovUs+jQoIuDOBHKF2/Ve9+0/po2UIU+0/pofHM:jkhLohBhYhtcocD0tuDOBHKF29K3Udbl
TLSH
T137A1669D56D91A363F2C12DBE6F32B630E2431462E08C67455FD409D28A2E6C3F6E0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6fbb9c5e21a4989cc2951b6a8397de6b203a407c69ac786588f694fe1cd957ca
MD5 94cb75ab851ccc05fc656cd37fbe52e9
SHA1 71b5a72301b5137f239a899b68a191661ef00ae9
SHA512 a96ab59585a9ffc3c334d27e413aa04305bc31e71ddb18e8c67a29cfbcb6d41455384a391d0f6e1bae2481ad6be714625a9cad8062b8e840383dead49584a97c
SSDEEP 24576:cSAwJPE1IDAo+4Kt+l44135UQ2nQ/tbw/2Mkjy6Fr7g0oH:cqPCIo4Kol4/Q2Q/lFTjN4
TLSH
T1AA55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 72e55543a8fdcab94dfd0262c53c9a35edf65f1c8eb88a05e5816d7f827a8b60
MD5 d798d00746dbaff280306f7506cc3f97
SHA1 a3964558df798c330d60940e2b7ad23456a0b99f
SHA512 59d9231e5f28bd5767d3503d781f4a2bb7bf772c2e371a6393c312cc944fc04690138c4b076f04da213029e460d50b24e521103b0b6d948d3d0645278d7327bd
SSDEEP 24576:AyLXPLcf94tmnQ/tbw/2Mkjy6Fr7g0oK:Ay7PoetmQ/lFTjN4
TLSH
T18275E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFE46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 41d3f2d2b653ab2c82907d388e03f9228650a3cd0d7c5fa07878cdfaa8f71f9b
MD5 37aaeaf44f603da75c27ab39ebe6c773
SHA1 4aca49d10b234edc2b1c060b90f926eabf73f0fd
SHA512 8b9b4a5f8c693271343b202871ee201590539b6ae547c209815723bee8fcd2fc9c724411dd1c53467fce57a97c156b3a42895f2d569bed3f43c4ac525ef4dadd
SSDEEP 12288:G9lyvj3IkxjbBznGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:GWv8qjpHnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1E265125E26A4B4D9F53A0274D863811692767CB227A4ABEF36C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-143-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/908-195-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/908-405-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/960-194-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/960-105-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/1516-175-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1516-402-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1516-179-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1516-169-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1640-424-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-410-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-436-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-437-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-438-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-439-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-440-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-441-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-428-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-427-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-426-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-425-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-419-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-446-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-447-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-421-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-422-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-445-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-444-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-443-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-423-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-430-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-431-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-435-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-432-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-433-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-434-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-420-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-409-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-411-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-412-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-413-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-414-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-415-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-416-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-417-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1640-418-0x0000025472480000-0x0000025472490000-memory.dmp

Download

memory/1796-57-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1796-51-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1796-164-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1796-59-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1960-9-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1960-98-0x0000000140000000-0x0000000140582000-memory.dmp

Download

memory/1960-0-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1960-8-0x0000000140000000-0x0000000140582000-memory.dmp

Download

memory/1960-589-0x0000000140000000-0x0000000140582000-memory.dmp

Download

memory/1960-583-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2116-148-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2116-429-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2116-214-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2452-87-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/2452-84-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2452-78-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2452-186-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/3348-165-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3348-162-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3348-373-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3416-407-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3416-198-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3432-48-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3432-152-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3576-153-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/3576-287-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/3828-43-0x0000000140000000-0x0000000140582000-memory.dmp

Download

memory/3828-32-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/3828-44-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/3828-144-0x0000000140000000-0x0000000140582000-memory.dmp

Download

memory/3828-406-0x0000000002DD0000-0x0000000002DDC000-memory.dmp

Download

memory/3828-574-0x0000000140000000-0x0000000140582000-memory.dmp

Download

memory/3828-575-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/3972-187-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3972-189-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4196-119-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4196-145-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4196-125-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4628-141-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4628-115-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4628-109-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4904-76-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4904-63-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4924-103-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4924-101-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4924-100-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4924-89-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4924-95-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/5064-72-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5064-178-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/5064-74-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/5064-66-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5288-475-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5288-237-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5288-256-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5288-221-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5288-216-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5288-210-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5288-204-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5308-182-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5308-403-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5840-191-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5840-404-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5904-137-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/5904-142-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5904-132-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/5904-442-0x0000000000F00000-0x0000000000F7C000-memory.dmp

Download

memory/5932-213-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/5932-408-0x0000000140000000-0x000000014016D000-memory.dmp

Download