Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
22 signatures
150 seconds
General
- Target 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 2.8MB
- Sample260511-cgf3hsds5m
- SHA256 117719b1aae2bb4f5a93c390bed6b9568df0aa7401b035740365d1b1ae299ffa
- MD5 7a506a4a4ec8cc00acc6354341f89743
- SHA1 44b299214a53b13c53c2c3f9cb2f42c92e204933
- SHA512 279cf43bb4d0c83fa707a67ec6b217b063e31120bb2e574a666f7f5c096b5399c4e060ec27512927e108e1cbb6ba6dd69eaab1358628cd8f20ebdfe83719409b
- SSDEEP 49152:yDdxw6dXF3W1QrL1UDq338mlp4DOfdc3L6CuQQSz:GRW6O7mrZf2+CCSz
- TLSH T11BD5AE5393EC41E4F07B4674D8698626EEF27C190734A6DF0241FA1E2F33AD25A76722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Executes dropped EXE 22 IoCs
pid Process 5012 alg.exe 2904 DiagnosticsHub.StandardCollector.Service.exe 1060 fxssvc.exe 2704 elevation_service.exe 4720 elevation_service.exe 4556 maintenanceservice.exe 5392 msdtc.exe 6120 OSE.EXE 1872 PerceptionSimulationService.exe 3340 perfhost.exe 1584 locator.exe 5856 SensorDataService.exe 4656 snmptrap.exe 5964 spectrum.exe 5540 ssh-agent.exe 1304 TieringEngineService.exe 3528 AgentService.exe 1684 vds.exe 5872 vssvc.exe 6096 wbengine.exe 3644 WmiApSrv.exe 4048 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\O: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\Q: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\S: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\B: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\E: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\J: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\L: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\M: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\R: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\W: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\Z: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\P: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\T: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\K: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\G: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\H: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\X: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\V: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\I: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\Y: 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\msiexec.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\186dc5ed8b62accd.bin alg.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027aecc4aeae0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049a61e52eae0dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003922a52eae0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fcce749eae0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd0be351eae0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cee6a4aeae0dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009995354beae0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 676 Process not Found 676 Process not Found 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeAuditPrivilege 1060 fxssvc.exe Token: SeRestorePrivilege 1304 TieringEngineService.exe Token: SeManageVolumePrivilege 1304 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3528 AgentService.exe Token: SeBackupPrivilege 5872 vssvc.exe Token: SeRestorePrivilege 5872 vssvc.exe Token: SeAuditPrivilege 5872 vssvc.exe Token: SeBackupPrivilege 6096 wbengine.exe Token: SeRestorePrivilege 6096 wbengine.exe Token: SeSecurityPrivilege 6096 wbengine.exe Token: 33 4048 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4048 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4048 SearchIndexer.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeBackupPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeSecurityPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeLoadDriverPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeShutdownPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeCreatePagefilePrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeShutdownPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeCreatePagefilePrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeImpersonatePrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeSecurityPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeBackupPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeRestorePrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5012 alg.exe Token: SeDebugPrivilege 5012 alg.exe Token: SeDebugPrivilege 5012 alg.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4928 2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4048 wrote to memory of 4268 4048 SearchIndexer.exe 103 PID 4048 wrote to memory of 1204 4048 SearchIndexer.exe 104 PID 4048 wrote to memory of 3484 4048 SearchIndexer.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_7a506a4a4ec8cc00acc6354341f89743_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4928
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:2904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5988
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2704
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4720
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4556
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5392
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:6120
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1872
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3340
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1584
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5856
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4656
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5964
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4444
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1684
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5872
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3644
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4268
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2836 2832 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:1204
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2888 2884 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:3484
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 09c8297e60426e7cc54acfb654dbe512c1c8d97adcbbbb9431ca51633dffb4ab
- MD5 a4e1c97564492638fc9e0af9ebc99ec2
- SHA1 986e0fc70ae75c184d881eecced2c519086132f8
- SHA512 6b8a610bc30070eab8eec14b48e2f692cc88dbc5283bcfa50301bfcde0f5d544816094cb0342d10e88c2905358a4b09d40aec511f5484ea97ef5a36eff607555
- SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4dc3L6CuQQSz:d3q6sjB32+CCSz
- TLSH T1D4D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 7041572e63f7eaf92d6e3affc50407e4d3eb727d72fb29ca188c89ebce439a36
- MD5 60b932b5607fabcd26d736291cde4fe1
- SHA1 0c6fb3ea2cf88f4a4968a043d087d65e4f80e011
- SHA512 8a495e0a91503c8a6dfecb1c3e64d5eb8e45f4a845e8006ef6999c5fd7205ca9682d64ab5443009ff212d3921d0fe8f5ecdacabfa4d8bf246d69a94d4b479494
- SSDEEP 12288:C1XLsswWkxy2lRq2czAiop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt:IXYfDtczAjNDGDn7q6dZhsCuarQSj/
- TLSH T15065F12867D408F9EC67C23CC9A1C411E632B8954764F79B03E4DA661F336D85E3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 936b1784ec76c0163fa66b80a070ab39405414209d4b1319a434d96c2a042891
- MD5 115d605e56b694d130883952fd1d4da7
- SHA1 53281a5dd84933ee98ea8490a25e5fb81a5ec07c
- SHA512 a4e2cb66d5c6b73f886c0a564f189411eeefe3063363dcb7d39fadf35bb913e52b192ba92e902910286c9f838b8c9b7ec210a875f647317f9a51dc7e9367e1bb
- SSDEEP 24576:I0Le5ji0hmxxrMQNDGDn7q6dZhsCuarQSj/:IPji0Ajhdc3L6CuQQSz
- TLSH T14085AE16F6748375D073C0B9C5D2A68EE971308657308ACB4286D77C3F67AE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 d2706e8b868535d3144324429a2fde0fcde064f62210810dc3bec4660b2bab9a
- MD5 26720ed8919ffa7118cbe8b2d4694852
- SHA1 7e960794447c70fed31e3adec5b1d4faf8c88409
- SHA512 95b8856b762ef5b641b49e2dce095a71ebd3974b8f1809641f2827607317a7f201ab95746c1da089977302e5184a977e249496662b09f8905c92e2be5006d50a
- SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyu6NDGDn7q6dZhsCuarQSj/:U/ezSC6vUzPveHjy9dc3L6CuQQSz
- TLSH T115756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 10fc32d72d512c241b29a87ea34601a5e567760c285ae5fd913c84a7c6dc790c
- MD5 865f7fd2edc0f7e6ec7050df4d40b296
- SHA1 9b870b3235c8d7da3805027c1c94abd57e772fad
- SHA512 73a6813b7dc1315d9fff5e8ff3a57a3f7173e85854a693573621fc6c6db1c54a624800437696cacbd433d0264ce8981a960d1dc8520a9b510255a189607eab5f
- SSDEEP 24576:oVbqPb88hv/l+YnNDGDn7q6dZhsCuarQSj/:oVO88hXl+Cdc3L6CuQQSz
- TLSH T1B9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 124fbe1f1d9d65ca8333e49a8b2bc00e1550bc730261c5d2cfd6f211d453e22d
- MD5 cd1e420850d38635baeb32ce677b9c4a
- SHA1 98d519ece9f855904861f6d064e4e0539ed11863
- SHA512 3d31fe06238a98a2411ce9c8a88f1cf8635ee9d64adb6f141e32811f7f4d8613baa35b9fe75569ce2c9e216aebafb26b031ae85e19e6125ea54e2b4b2956fef6
- SSDEEP 12288:QLDop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/5b:QL0NDGDn7q6dZhsCuarQSj/
- TLSH T16B452349894460C6FE77CE382614CC119630ADE9B4697B2581D2FFD61E384F0EED1AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 915d59b06ec47649eef8a64b08c82c745b9999f5f14f448ac677c44141e08084
- MD5 1f4e6ae6f81ae09f12f01a763050e2a7
- SHA1 fdbe53a77081f4c542b9e533de25080fc469223c
- SHA512 527d32e759b9bec11687549706bd027d232ba5abc024880379c581b7da13477446785875724882ad415503f8f4889e33690cc6a8aaa73f0925cac621f6ef2c17
- SSDEEP 12288:3eBNUbTVO86U+op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/L:3JIUfNDGDn7q6dZhsCuarQSj/
- TLSH T18165CF2BEE28FCD2C67A8DB85B51C600D77278704B62A3CBD165C34E9E235E05E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 b63726f8140302f12e434ad50b956cecce090646334c6eadb32cd7e0ff6c3db5
- MD5 4ba8cc474c21a12d7c189ad6d3954a73
- SHA1 3018280d24ffafa15d86a83b6f8345504104d641
- SHA512 a156ecd0406903ee1262b50a50f6d9cf29c2445bba52b886b99455f32482a68aaf4cc9703793be9787fde866a5f7a600669563285a5d07a3e3667667cdec4092
- SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:eQvGAdlCEL8c/DRNw5Cq2+CCSz
- TLSH T147266C656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 e4c534e29099d97cdf8ac5464036c77973c1739cf2f0813af59e47e41da05146
- MD5 4ca21e087fe31bc6cc7c40a029d167d8
- SHA1 a1fea20029a58d4d7ea53b138b6da99051b0c579
- SHA512 bbc9b882e919264faf55691aad3bdd0014d2372b0e5941687ee0a7a9eefb0c5e3b35171692d56631207a191230249a1496d712d618ec8f35a093a306bafd8aa2
- SSDEEP 12288:5AwSfxL/2Dc3RDLLmt0LDQewsAj4op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwroC:q0ewsAjRNDGDn7q6dZhsCuarQSj/
- TLSH T18875E031FE74E036C6BB0DB61B25C716543CB9604B612AC3E3E89E9E59301D12776E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 303cf4048fdb4a2e7551994aee39e52fb8fa0a63f10a55831c539ee9c61e4490
- MD5 7691898cba978e6ecace3b0d8e865ad5
- SHA1 0c87229c37fb2dc2f7ba4c51163a98d4596191fb
- SHA512 cdb35af96b7d1e9342f1c2075d6f954f43b8a12efd3fa262940be21d33bfd00f67fa195c0cdd0df96a80ad4c405a8b281d46a64f54f93c20d1d13a289665829d
- SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/PS:4UEtQevvqc2W1cpV2tI32nS
- TLSH T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 163e1b28c46a03eabcaa47a39dd6c1c26000c2d1bc4c3d82c2c89148b97e2d1c
- MD5 a862cfdf37c1ffdeaecb3b31f6799d8f
- SHA1 a670c4cf2c15cc69028e2fb8a62074a90825b39b
- SHA512 5bf88dbb2d3387f9f89bc851fe500ef39c4cc3244deabb6e3ff85be371b357e4397ede9ac72b803195af7137fe981c6b99d83fae2e965f9841f9ede8b5936d33
- SSDEEP 49152:LCbRquA/m2yL5zTfFiV+XenmE3/zxdc3L6CuQQSz:UoquVjnm22+CCSz
- TLSH T189D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 c55ddbe64d6bcce489156e95dd84e923c614b2b0e005f31b66e8c2cc4abd2da2
- MD5 fc079e595f560e03b80ccc5551784382
- SHA1 f9b5f87e61ab0292f7ab62414d52b29b333cdfcf
- SHA512 5e115f2cc6475e820bae4177a80d28c4b401e971f965aa4499cc933f37d85adc6390f2d111d1bcb27f66b8718d17e4ca6dcad0a42938f6310cc5beb5fce17fbc
- SSDEEP 24576:1AhGL3IFoiwtA5l7S53WNDGDn7q6dZhsCuarQSj/:1AMUFoiq5mdc3L6CuQQSz
- TLSH T10835AE80E7F955D4F5B3AA7899768470EA76BCAA5E31D20F2150D21F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 0ec2f9808b469886d10008c2dc2ab454dd1e5a936a4d62055d09957ef78347a2
- MD5 412925c77e18b46646c90da7c6d535c9
- SHA1 a414571c0c046dd5100577c1d4e8bba97cd0d931
- SHA512 6e7790196181211042f19b78c43c68be455572efd23337857b970676f486af8fb2dc97b853c04d02c8c20c70db01dd9cfd60a597253f531f5590f588b8fdb76e
- SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+Chop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWL:qwu4OWdNDGDn7q6dZhsCuarQSj/
- TLSH T10E65F14976A41CF9E97786388657C432F7B2BC123A25D71F03A0C75B5F37260AE29B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 ccb6995ad3be4968b09b2bb4e2bb238196f377c5ac9039258c6ef5c7e934189d
- MD5 6568b3b9ace280bf4c8f946479ac2205
- SHA1 c325a466736d3defa1493f01a9c97fc8ee689d36
- SHA512 4ea81f3fea61ee94264f25fb2232b16b3bf1850de859c705e80d876d2cb3994cb0c7f6dc9859aa0a1e426017f5c1e8fb4a04abc3fd8dd0b682190ef5b3f3c89e
- SSDEEP 12288:ieZ1Iyoop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/7:vZuoNDGDn7q6dZhsCuarQSj/
- TLSH T17955124A269430FAF5B7CA3C99A08905D37078A7733553CF02A197A62F319E09E75B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 26def646e42f904569455f2e3ac389096000be184a294355243da652524654f8
- MD5 05673ff4abf9940f7aed0ea5b9a8820c
- SHA1 cf01d29902ae202b24857147e746724dac752616
- SHA512 8f8bb2ca44bb6b00667ed87c1d5e9aa6a09f673a8f03b0a8f17c6298726679d592e3c41c676c3fb78fa1ced2c48d7b29b266f56376dc8e44551800d42bf4952d
- SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:OQRQyi36YOcPbLvw2gAf+PN372+CCSz
- TLSH T1CB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 6b1a37f851721ff210ee3822c021eb4830b9dc989cb1688645276106d289c416
- MD5 dc2b7561dbc51ff8e0ceff4cbc9c6081
- SHA1 cb46aaefe07c67bb42663c3175856469a15773b6
- SHA512 cdfffc9deaad6398a0b10ed9ba195189745b557fb6093212b7af43ac0454c03a16db305efdb10360fe21779e1c374282826397b9f211309a673306757d72c9a9
- SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:iQRQyi36YOcPbLvw2gAf+PN372+CCSz
- TLSH T13B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f3ac380052e5ef1916e6b1ea606890788ebeb8bbe0beb5d8b822c1ba47223b2b
- MD5 c8a11972a9365749ffa914cc576a4ce1
- SHA1 d0c6f0b2aa59f20e88d2e85618fed1c9599984f7
- SHA512 55bedcd9b08f2b930d1d010fd3d62ce37ce48ec0a0048e3ffaa4f73dacf65fcb47adccd839985a439ee8f0c3a532c699f97258ce032e6a544da60f57f40484d0
- SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL04NDGDn7q6dZhsC3:X68Qg55nhceWu7PNU3/hdc3L6CuQQSz
- TLSH T13CB54933B2F600A9D44DE1769F4A872196E17C758FE0E3DB815172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 eee38e4835d2a4270b6429b3ae8a80eea5a548ee1920d846f255ae578ccd2800
- MD5 c0fd98bff594073aae04e3ac1d691f3b
- SHA1 0d220592cade82d0376860b5439f6904b9ee90cc
- SHA512 16308224d6bab5ed923c243b64f3a73e6e2c8ab0b07dd3f84eb23d6b83200dae3704a0754e73a3409c4c9b993fbd28baa3bae0a896e00bccb7d7cc462fdc6171
- SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk992:py5112gYy5azzVvt69nLKnhZ02+CCSz
- TLSH T131167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 176ffd676fb187fa01bf618b6fa89d6f050d284ebfe8006f36512687cc16b50a
- MD5 6d944cc3d25df8bdcdd96835474dd172
- SHA1 9ed3f94890febcf104f02f22e08b326419928658
- SHA512 2b9a5a048a672c54417ffafe582b3970622c0edab3afb462f932e61a9424b33ae67e54230e8df71cf244553ad9d623ddfcccc7228753f09dfcaea7d0b32c38af
- SSDEEP 49152:PB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glzdc3L6CuQQSz:xu6Jmdxd2dz2+CCSz
- TLSH T175D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 b6ce95d7f6988174af63768b7a3045e474b52b38a96027829683fb5ddfb872ef
- MD5 a84bae838b148cdb49d71e27bd8c60d8
- SHA1 309f5dbe2deaaf1421641027d4ec25c2665c8ce4
- SHA512 49b8a2890f3f841e10893804fe6444855364276489c7ed785ea764d345bafef6d3fe47d0c597b7e17b8ce942a2fefd80194155bf52896032f420d0b54050c9a8
- SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4x/dc3L6CuQQSz:PmifPWR22+CCSz
- TLSH T118B5BE13F2D800E8D06ED17887569632EA61BC460B34B6DF0A90B7961F7BAE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 e2a5974fda9957b064cc8f342e1c92bda725efe9fac537bd1e4bb6ee0a5ff770
- MD5 e6fb3b23ee37aa1371d6922a66b20d6f
- SHA1 95b3c4bbf61c3a13f0857f61055a1ac2d62a79f5
- SHA512 dfc0fb71b25dc3197ac71729af9f537958023dfe7c4d7d175d84a2c8e81f5f918a7fe16d549990efd306b24a99cfc96e23a3e64e3cfd5b00e29f262a56941af9
- SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqodc3L6CuQQSz:k5dKii61o2+CCSz
- TLSH T1DCC5BE03F2E940E8E0BED67887659632EA72BC464B34A6DF064072551E77FE09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 daab6511412fc1c1b8757d530b65be05f01340e64cfdf6b010128defc539083a
- MD5 898dfa87405e7c7439b6a7baa4353f09
- SHA1 2003fd3531f2e7801d0532e9931995c80464ee26
- SHA512 aea1f9a34238733d6914d3a99f4c206667b90f8e4a65ee2f6cf9711dc9dfc23f91ff9da08738f48d71518e714f1b6886f81ff551bee0c54c242589d82890e2f3
- SSDEEP 49152:RhtSn8EApI0fig3giDn0AP5wjdc3L6CuQQSz:AX2imphy2+CCSz
- TLSH T1D395BE13F2D900E8D06ED178C7468632E962BC160B35B6EF0A90B7561E7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 59b82ebf1a39494035047b37a18ef200a3c1a2ab6598350648e14da5a4893d47
- MD5 374f7c25a71610e0022c52caa9017e98
- SHA1 69b0a0a277e895616f9443e219743ecca919d85b
- SHA512 1ec8e253c3061b761922a2e4b975075c28b451caeb39f286799c7c8ef498a7be6eb1fd2cbcb979881c7be68369336dee891c231f72c88099355ee8da92248008
- SSDEEP 12288:B7op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/l:BMNDGDn7q6dZhsCuarQSj/
- TLSH T179452309984850CAFD76CE795614C81195206DEFF069772592C2FBA22F348F0AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 74a44db141f998c98e5e37a298cdfc7f54f76ad7b797eb274060264ba0058a6a
- MD5 488769a321c56a83bac6bf6193b52f33
- SHA1 ff30cc12f6c8783ca51f8ef9c7a30146019cc15e
- SHA512 952839df78f3530e026cd8594c89c52e0769c1f6917edc619acc43ad5609f24256f6a88f5d2427da550b6a60b6abe8f60ebef40d03d5d601b9f69ff5bf35d569
- SSDEEP 12288:ssop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/l:sFNDGDn7q6dZhsCuarQSj/
- TLSH T1D8452309984450CAFD36CE795604C81195206DEFB069772592D2FBA22F348F0AFD1EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 a20a05dc6e98206da990b14394cdcfa69e91f7be355d8c018d66dbacf09f0140
- MD5 3c08086f5882b073e4890a7bb22b5f8b
- SHA1 9955fc66e3cb35f83a49a37f6364fa3fdf3b8a4a
- SHA512 dd6643657efb4de592fb48bea737b40cff27d453e1d537c4135540d49bda942020ef2e0471c92cb15f2610a558b4e4f41a8f18631079f767db751d6afed8cfde
- SSDEEP 12288:5Wop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/l:53NDGDn7q6dZhsCuarQSj/
- TLSH T146452309984850CAFD76CE795604C81195206DEFF069772592C2FBA22E348F4AFD1EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 df23ea866cb3bb3c96ebbb9b5127a6952881d1bc53755596c8221a8a2193c9d4
- MD5 c104a48574a11d6aba9845626bfe16c6
- SHA1 9502761a2ee829649bf293a4da8f6391f9afda03
- SHA512 076b29aebcf2cc46e82825531f9d4165b627d6d329190961f105203e33dec88a4cf99f3a73b94a14ef2174344aa28e895187186a660f45ad312b668434f5f080
- SSDEEP 12288:0V9op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/2:7NDGDn7q6dZhsCuarQSj/
- TLSH T17F4523095A5850C6FC77CA789A10C411D270BCEAF135776F9281AB961F305E0AEB1FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 bb56a60b070f1793b524a97a2640be7897907a41ce624eec6af0b112ebd0cf3a
- MD5 105e13aedd2e3bc3002443ab3eaf1c91
- SHA1 c440f1b546c35130a65b5bc041a3a69f8b80c36f
- SHA512 57e3523c15cb68400c4f5b1eb7324b416d26e695e7be34054478e36df9602ae25393f0dd9beec32dd25e755db06d49705daae50dabed98111ae0e4a8016bb59d
- SSDEEP 12288:flop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/f:feNDGDn7q6dZhsCuarQSj/
- TLSH T168452309984450CAFD76CE795604C81195206DEFF069772592C2FBA22E348F4AFD1EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 4014b94c35b27956262b32a141ec42c9c861675103ab0d4c02327af609e89bd9
- MD5 8c9ef3ceed7dcb0dce4a6b16cc633bdf
- SHA1 4f7a5f14a83c3354f92ca93027eb4dd354a995c4
- SHA512 ffe8b170909dca6d89e1400773349bd5374a3dc9186d456bccd0b42cae608092822798476794247d76d58ca7f9cf5ac3c7fb3b632e34e673c75a08729d9d1e0f
- SSDEEP 12288:fwop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/f:fJNDGDn7q6dZhsCuarQSj/
- TLSH T15A452309984450CAFD36CE795A14C81195206DEFB469772592C2FBA22F348F0AFD1EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 cf8855ec4d8412e187218e858a7345b541c534a1526aed3c7a284d91387b1714
- MD5 961dd670fc5ed887e47faf7eb0ba97b9
- SHA1 45a2e04af10300d0718493d4002898385c815f03
- SHA512 44ff2a879eb42e4362fa902301b31c2564b3548fc24232654350f791ae4cc628729abb010f26a8f594ab74b68f91c9edc3abb90fd4f1c85892a4b6fae959613f
- SSDEEP 12288:60op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/H:6tNDGDn7q6dZhsCuarQSj/
- TLSH T1B5452309984450CAFD36CE795604C81196206DEFF469772692D2EBA22F344F0AFD1EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 df0a596e9ae757e5e55347d25f3e70785b50da52ab7531dc7b4da67b67870fdd
- MD5 92de45f9e04783ce677342aa5ae1b686
- SHA1 4802f95d855f778607a390c180c336e1249cde9b
- SHA512 7c7efdec23e91c3e6f8d86001cff91c47b4dc8774b262efa6b14174eb7ff73559f0fc5ece9378645db66750b74cef3a4359608cda8e93f6c8b1a2082bbe43afe
- SSDEEP 12288:ciZwbVzzFEoS2cPvyMop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/I:/ZMRzFVSOlNDGDn7q6dZhsCuarQSj/
- TLSH T1DA65F199B39018F8EC67863E89158806D6B17C6A5670C71F03E437675F332A05D3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 2ca29d3c5927b1a3d7b5184b3b3a0e60ddf92971ecf00c1ebc075718568a0564
- MD5 617b58f00db0bc26f3da75a18509229b
- SHA1 4e063c49135defef5f2496ebc12bce4f171e1177
- SHA512 2114a1a3beb58ee8f7c493e0643b30daf9c62df146eeeb38daca72295149479028a7cc41b412265d2e36692cea53f4abf8abb7d145d53fc8ba702580fceee973
- SSDEEP 12288:KXop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/C:KYNDGDn7q6dZhsCuarQSj/
- TLSH T143452309984450CAFD36CE785604C81195206DEFF069772692C6FBA22F348F4AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 47fa31ef0b2ae394f495b9dc0eb2481d9ff0d0ced32660587d56d81dca9a4168
- MD5 abc7ce1665ece05a6d15a4a8548528db
- SHA1 e866e90b854b2092c8b49c0755cbd437157a0c35
- SHA512 ffe4c076247addf7299a03164494a62c6abc527eb7d5fbab4691aac6efbb8254cda3664f7b13f5e1af6b2b685415c7387bc73cc0f0f1aa757f9cbe438a9aabf1
- SSDEEP 12288:Pzop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/C:PkNDGDn7q6dZhsCuarQSj/
- TLSH T192452309984450CAFD36CE785604C81196206DEFF069772692D6FBA22F344F4AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 381b1d9d159ca23154d7d178c9e96a19e93e02cdc7b24496c7c9203b1f325950
- MD5 9392b6d3c17655858dffa6b02e3ccbde
- SHA1 ed10ae5de14f6b37bb6e2b6ec6826791ba8ff3cf
- SHA512 3ddefcdf05eac840ffb71b817ec5fd3feacfcdec1ed63b84f6fe9fcf79a77d9b9d9ab017624cb905d3656d2c2c16f89fabc7d1598f69b674999a764be150dfe7
- SSDEEP 12288:iyPz5L8oop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/W:/zyBNDGDn7q6dZhsCuarQSj/
- TLSH T18F55120776A030F9E537C63889514902F370B87657249BAF13A057B72F366E09E7ABB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 f9da7f6baaf83096e3db6c831bc726291f49c4fb79203a830bf8f2ed36113b9b
- MD5 5d702e135d20125d5d085babb48b7cf6
- SHA1 4a8a0c74850e711249c9dfcaa8e978689cd28ad8
- SHA512 592b728db9e5d1fe2b259257223b63f04867777da02ebaecfc1a89e19ff5ec58203a60e7b2060452e73a1710719a1111b32d879d9f6f66af26486fa27f523a38
- SSDEEP 12288:dXop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/5:dYNDGDn7q6dZhsCuarQSj/
- TLSH T17B452309984450CAFD76CE785604C81195206DEFF069772692C2FBA26F348F4AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 ffdbb1a80d2ab70a8b5684a0fe155ad7f9a40ad3ef7dd16054629cbc6c2325de
- MD5 c3aace370df6c10f7be9a1cf696c5883
- SHA1 e6f33b8b493a6759028d3dde8a21be2ca1164d4a
- SHA512 11d020b74261e3122a8528833eb340f4825e56d66895160a74da1210a3125b8e578ec1a4b78aaf7e85c8c634ace9ac9dc9e9124f9ae744964935f47a1622c2ec
- SSDEEP 12288:5Xop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/5:5YNDGDn7q6dZhsCuarQSj/
- TLSH T1D7452309984450CAFD76CE795604C81195206DEFF069772692C2FBA22F348F4AFD1AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 2060d1632a08e6d08ee7142c9c646b2f4dc0da047d8bd3dc964a5a663571108b
- MD5 424d06b2de1b896bc50358c980755171
- SHA1 54c51a0db3f36a7298be1e54b59872921d49face
- SHA512 03f4772d99d5967d66b5e6411811f763a459fe441e28b191ee6f9a775979fb66af7c84f92a4255b3887317bb6023a7d9b21970528eba758b79eaf6dade403390
- SSDEEP 24576:1CU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvALNDGDn7q6dZhsCuarQSj/:1CUZPTY+8Wg2lIL8lrIUJLWwedc3L6C3
- TLSH T1A665AE1EA3DC0896D4BBC1358A518A06EB32782E1B22D6CF1160C77D2F27EE55E75F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 84a1f06403f2dfe914fe6cee28638ba0118a9252cb91c649d2ac805013ad5914
- MD5 0f74a11cd979dafd2e52cb859fd4c178
- SHA1 0aa0d48852e6306b92f6dc3128d9da2a15d095ea
- SHA512 c4647e2c9a7abf8cda43aba64c8b272825eb0b96c1517adfde4a4beabb9e252cb65d7a32b616c332ee2124e471ac87b6877f4b4f041d3fb21e04fb745b9035c7
- SSDEEP 12288:Zbsfnop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/A:0oNDGDn7q6dZhsCuarQSj/
- TLSH T16F55F009D29801D8D46E9679CB058901B3337C6A93E1E3CB52C0FA7E1F355E09EEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 7277135e61af263fd5e599370c588e032cd78780ef53ca97a4db75efec35794a
- MD5 50d8812fafff2a3791fb0d8acac35399
- SHA1 02fba6846d4fc79bae445df3ff4071d6970483bd
- SHA512 865892cce4db4248c83f07fce90b051ee1a1b79c61e084da7cf4d93960f0cb98de94dc207d8136980e06e171e9a95e1f2062868122e55b93e25b9ee895f6d8e4
- SSDEEP 12288:k2op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/g:kXNDGDn7q6dZhsCuarQSj/
- TLSH T1D2452305964864C6FC7ACE341614C42152247DEDB724B7A7A181FBD22E348E0AEF1FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 64df4f83e07609fbe513b3e74be7d1fc86205b0caba743c7a5ba38a1e73c1955
- MD5 87e2501f05582f2a29660a1416613f92
- SHA1 d59d28ef54cb93985be70721a59dc1804ed8adf5
- SHA512 b697357e3228bb07ff99015dd55d2e9d06072ef343dcdb9c56e03fbe2ff41d835bfce21a28f939a79bdd7042cb88df1969e7e0a333f25e408abaeb9aa6dcc898
- SSDEEP 24576:j8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCxNDGDn7q6dZhsCuarQSj/:QRZwQCyiHiQEaiPnMwdc3L6CuQQSz
- TLSH T1E785BF1E62DC42A5E0BAD278CDA74407E6B278165731A7CF0291C27D1F27DF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 877f7f8821282c7caedffc0251c529c6b2c4a8734a3f3755947db2f6c49bc091
- MD5 d34fe312c4e732bb1b8981e39c4df1fd
- SHA1 6e378ca6d73b69361c6b10a6d75197bba33bcfc5
- SHA512 24a8955e170362c38a94490a5fa7e60098bb4c33f22b076106d544af2556afa2a7581b7353053eefb63f0de01a3a75f4b55faa265937904820153798ec3dc507
- SSDEEP 12288:lbxA1U7Kmop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/w:lbxA1UGHNDGDn7q6dZhsCuarQSj/
- TLSH T1E755011E669C24E5F576DA3D89918002D330BC6A6325A3EF11C1C3BA0F3ADE49D75F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 dcba94c20a183fb15f0bf92e3f05eae396cc2e57b6d7f319407f0c9b29ff56b6
- MD5 68203361db29b0d0b2efa95883484394
- SHA1 f53dee8a5d90a1f7eec60ee49bdbcd4b52e339d8
- SHA512 33207873f6ccc6d4fc90d57d7d1549863398d9e98f744030ab1e60fe6a1642f72297e41cf56f0eafc633704724a2366b95643a212a05a5daa99fbb29db9c90ec
- SSDEEP 24576:rjsmP0yHaqrVqHra44KDzMsrnmNDGDn7q6dZhsCuarQSj/:rjRP0yHfVqzlAsrnmdc3L6CuQQSz
- TLSH T1C145AF2EF2B910E9D8AAD136454107B5AB71742D1F209BC701B0C635AF0AEE89F35F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 bf9b83d848c98707bd45667babf2d564856003239d6ea86dda5583d558d987d5
- MD5 50ddb5b6391a8f57a68cf3ac03cca4de
- SHA1 3f478a650ac5f81a039c344253890f5994b222d3
- SHA512 929b1db6af121583e4f03f4243c8acf8c2bdab37bd0e85cde7da681a16046edbcfb3eb4fa043eeb08e0eea6685c95716645236867c60a4e6a709852dcc32ffc4
- SSDEEP 12288:3Qop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/g:3pNDGDn7q6dZhsCuarQSj/
- TLSH T153452309994460C6FD76CE781604C81192207DAAB12977A751D2FBA21F384F49FF1AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 b04785b73f1f808bb2d6a868a41647b25a6dd2460daa7dbc1dab6bfa3ef137d5
- MD5 7357a1234d928a9a8396ca65d5d6c241
- SHA1 8615282f57aa5c16c4ee6ae52f15cc544adc93b9
- SHA512 403911822903a578c9172303d099e016bae3518c02ae1df868826db17a745ca7f3dc4f544a4e07e1b0ea718890debc4a0482b359b4b18b924e80924c38c2da08
- SSDEEP 12288:ZObfA4LWO+vAYFTiop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/a:ObLBUTjNDGDn7q6dZhsCuarQSj/
- TLSH T17475F145E79400F9ED7BC13CC9628916E271B89D1364E7DF03A88B661F236E14E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 69ad4ec19749864257520c995567c65e887aad25dd56faa31779dbd4de66c361
- MD5 fa934719a42c8526b053e5f0aab31611
- SHA1 7d69f6ae8442d8f795de31aa80bc6be76325cb34
- SHA512 10651ac864345bb5194c8e7f397214560f6928dfafbc9834f378da558b5f3b3445dd820c17b5ac42b6e0445438cf155769264f1a25ab97905fe235d7db1b39f9
- SSDEEP 12288:X70Vm9IYNvUyBpLop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/0:gpYNHiNDGDn7q6dZhsCuarQSj/
- TLSH T12E65F11E56AC18E5E57BD17D8A828505F27278A61311A3DF01F0C3BA1F27DE8BD3AB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a2284373ffad1d8df860aaf85da9e19facd766821b2e05e465b9825b6eaf714d
- MD5 5f44b2d31eeb963c8d2926f1dddb704b
- SHA1 b179dad75bc8c5822024718ce308b900ad64b7a9
- SHA512 d28fb953f94d6f8ebfa15dcd61c3526f4a39b4128d34ce7feb28694a0c1ff685c28568ac4b520177aa6d824e888ed5190348be655305b52d9a36ad177805a7dc
- SSDEEP 24576:qnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKa:qnXoJJYH84VVS6AmEOJas+cHBjSSKHPq
- TLSH T12465BF5EA2BC04E8D5BBD17DC5828506F5B178661331C6CF0261C2BA3F27AF5AE35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 175982fa7ac073774e3cda7f12492ba20075022a78e675de5a28f9208ddd5c22
- MD5 1ab9702a0765a7178b61ab57951962c6
- SHA1 6856f1c4263787a105de5768f0ee5826c1d13dfb
- SHA512 6dc8c79ef3255f53d93c399896cae7063517e7a9f5f4329187a2250a5de30fe64d6627b694b9fb6a9401ff364930e69734cacd7bdeabfcbddf6fcccffd8ed69c
- SSDEEP 24576:4v7Xbxd9Tuycf8M/TYlSuxrr2PCUNDGDn7q6dZhsCuarQSj/:4DLL9TuJ0M/TYj2PJdc3L6CuQQSz
- TLSH T10B858D1EA2EC42D4E47BDABD85B79046FAB2B855173091CF0291856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 28276474a6ca6c72eafbef2c0a5d68c1bbb1c2a79d27504e7b881dd29911a368
- MD5 207d04fc2cdbcb0c39c2383e0e3925bf
- SHA1 717cab25e1325ab36a3789352340d935c2e28d53
- SHA512 3445a24db846083214936ebe94faa1fcc8191eaebd90e73a6a26ece412951c62768182536bebc22c5a74ee1dd0b1152c4d9f50b074f42c3cac7e39275618df6d
- SSDEEP 24576:negJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wjNDGDn7q6dZhsCuarQSj/:nngOJOmPOHzjdc3L6CuQQSz
- TLSH T19D55C02FA7BC15D5E03EC17D8A928816F6B0782613355ACF0190827E5F2BEF46E39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 1dff9c65a7d98792bf74318039e930be051b7b270dafc862a2d873afd71cfd79
- MD5 809b91900ddda826f53f37a9d7f87e53
- SHA1 8f6fc46f991b107a89d3d8f68d568e47e63fcf93
- SHA512 83ccbb4e46f1228113968a5401b9f157c131dd425397fe30a6bac33976966a4681c5e372d134d4bb1e56000d62c23d8202ff06ecca6946aea36fae46b3a8104f
- SSDEEP 24576:xLJnJiTk3R3waE4JrOJNDGDn7q6dZhsCuarQSj/:xLJnJK8R304l2dc3L6CuQQSz
- TLSH T19C75E12CD2A810E8E4B7C2B4825A1A56FF31347D3B216ACB15B4D5313F11FE0AA79F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 3dbc4a104c030262b065bbfc2630002373f5a1b490445bb3581a2e04e86c7fd8
- MD5 607958f5e25a746e4dcd8a2ba9ae6674
- SHA1 be97743ce43c2b6e017739a60bc601daa6a50150
- SHA512 d29f05c2de2a5845b5e24d6d251f302ca3b3976e092578c328df4f37c1ec15c2e8b727d6c2cc99449e3f7e075828d6c8acce854effba1bf94ec4356fbff9afb9
- SSDEEP 49152:b9mqCzDScAZmlvTcFg8Ph6tdc3L6CuQQSz:/C2+CCSz
- TLSH T194955D05F7EA5298F8B3CAF1C96294159B327C509734F7EF4A80CA6A1E32BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 6f85ea1cec311842ce8da035932a711824aa822859a89d3fed90ff0548669c20
- MD5 01ff071705cff954f28a9a8ebb8aa0a4
- SHA1 dfa913f86b55c15a46f8227977a37d8a769fc3d6
- SHA512 19b41c3484466f0895dfa4266e06fda91fcfe951a8574dcc44cf27f085eef8a66f3f64c724bc52a80545202d7ab105e802b3a3c153e0dff4912f61e67c396385
- SSDEEP 24576:8lYJeXm5jUuETNDGDn7q6dZhsCuarQSj/:8lYJeXmRUuETdc3L6CuQQSz
- TLSH T1D255124D6A9C30E5F53AC9799A518800E330B4BA631167FF41E0D3BA4F359E46E39F92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 d38ab4ad5b16eeda214ee493be3127577fe9e1c936a6456e9743dcc2356b770f
- MD5 8c8299bef7cbde55db51e83fab2923e7
- SHA1 bb80c295ea544bcdb173a8f762264e5e8e6eb467
- SHA512 850174e3b71ea8f61289d4c909d877243643d80abc8616ee62ebaf751545db0c87ebb1ee12f075ebfef3d17a3af6264836149a69006377de373b691bac09f669
- SSDEEP 12288:Vmu6kyNop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/I:V7tyGNDGDn7q6dZhsCuarQSj/
- TLSH T1F9551208669460D8F9768A389A628050DB30BC75AB2463EF51D1F77F2F346E0AD70F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 c4a6b89b6aa6c30b8d625601c7b861f27d46b537b35598774f4af697e30e3ca0
- MD5 7bd6b9b8177eaf29f2a6624a18f6da9f
- SHA1 af9c2efbf3a5b107f86669a38cf825dc8749e668
- SHA512 b95bd1511ba3841bba4ec33cad95ec8a1e2bc3e2d87a21d08d989a267e8d51963b7f3009402e13fd6c044d273c8eea22a51d218681a799264d73651f547c3fe4
- SSDEEP 12288:IPiop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/u:YjNDGDn7q6dZhsCuarQSj/
- TLSH T10345220D595860CAFC36CE7816148811923079BAB12977BB51D1FBB25F384E0AEF1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e004009c1a8c107f678beb7975524509baff966aead427e29fae25325d3392ca
- MD5 abfe859285ae73b71c12c51ee7e40a9a
- SHA1 76a884cc2ca3315108474a7cfc856c726857e456
- SHA512 cdf3ccb339a286e9f012abde580e8efa1c9a4c4ed67de9af5d6d2213614822cf87a08f85dc7a3791c2c324ff9ba2d099b6e8f4e2d9d8ba3c9369014e5ccbb001
- SSDEEP 24576:DC+TyQIu93VAumZr7jmINDGDn7q6dZhsCuarQSj/:D/TfIq+YIdc3L6CuQQSz
- TLSH T1BE559D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 9c8a97c25d84924828275cd9642db1ae8a77b6ff5978f791f4680ae70b6a2e58
- MD5 4de930b6991301054574747c8ee9943b
- SHA1 1308cc682074d98807ee185149e791dece0676fb
- SHA512 25d4b0c2575eabbb874c2722fc0e80bafeccbdb10e7f452085146080af40f2b7b71141a6eb69025647d0730c2d198d9e4eb5c33b8f23912f48613d639b053421
- SSDEEP 12288:mcyrWOstaa3kcsOop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/K:/LQikZvNDGDn7q6dZhsCuarQSj/
- TLSH T1AA65F00EB6AA10D5E4A7C23C88458112F6737475571263EF42E0C7BA0F775E9BE38B92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 477828b53934b6dda1b7bbfcb872b4659768d6c6f72cf22cf5165cc8f9b730f8
- MD5 053660513ce78d5cbd7164ad50ef7a0a
- SHA1 b1d6f17e4013fe4e0e1e337f32eaa910b30a31b8
- SHA512 20c9d94f604582c23fb976428654944df88bfcea2030f57eb6b3755815f1a7a0e8a2fb373e995e4b2f6b2168aa5f65663cec5d23ccb0a49f1a81639fe13ca475
- SSDEEP 49152:tpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPGdc3L6CuQR:upC7b4+80GTk12+CCSz
- TLSH T162A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 25bc07da5e2b4f0cd80b7dd0418dfcd4994e11e3376ab75990cfb62a9d0f8b6e
- MD5 5eb5ba0ab69636f5fc59af0041c64e6b
- SHA1 d353ac602311a8622cf89f3a6199796ba1095b6a
- SHA512 767214a374ed3ac02bb8c54ea33b29f4a980aa3461af2e121c4a670f417c80c1c71376402c4da05e79c7e56ffff9172963719fe9b64a2e534ee9572d4286c1bd
- SSDEEP 24576:hSAwJPE1IDAo+4Kt+l4413JUQ+NDGDn7q6dZhsCuarQSj/:hqPCIo4Kol4vQ+dc3L6CuQQSz
- TLSH T16355BF1AA7F956E4E17ACBB49663C501FB727823133163CF4290827E0F169E89E79F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 29c9ab56ceedce60bc49c82787d437bdf5a8bbdb1e0ec547c4ede4fba51c6fe1
- MD5 eaea96afa591cb4da0abd0864126ae2d
- SHA1 85f66d238db218fe23ea17e349bb2aed7f892f86
- SHA512 b9679831ab3601aa434d24e0e682707438a3efc5088e2988fb985ab55ff060f673acce947e57e224bbdb4f0fd9c189b3b6cee78aaef0bc10c7a6d718bc2b18c2
- SSDEEP 24576:6yLXPLcw94tuNDGDn7q6dZhsCuarQSj/:6y7PoXtudc3L6CuQQSz
- TLSH T17275E02ED66C04E5E47AC27CD6A38906F67138AD033166CB15E0D17A1F2BEF4A939F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 499ec9016c6577ac44b70d69289ba687d98297b56d93daeab1075bca9c28adb1
- MD5 294441a82583cfad9b98835374f55a6b
- SHA1 964ca72bacd1ec70212bf90a45e9bf05eb748e65
- SHA512 e296b2729aa22a76267e9b2bbf37b6b4020bfa231f5f855bf9fcc35b60d464072d0a0d2184963226cae9c03181c6c0042c34606859d4fa810d6a8641dcd55d84
- SSDEEP 12288:E9lyvj3IkxjbBzeop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/ts:EWv8qjp/NDGDn7q6dZhsCuarQSj/t
- TLSH T1C865120E569420D9F47ACA349621C0258170BCB623796BFF71C4EAB70F349D0DA7AF66
- MD5 SHA1 SHA512 SSDEEP TLSH