a652bcc6f923cf07d1b5a7fc57c31d67ffe979ad0d909ec4037a14b98246d4e9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 8.9MB
Sample260517-genf2acy6s
SHA256 a652bcc6f923cf07d1b5a7fc57c31d67ffe979ad0d909ec4037a14b98246d4e9
MD5 eebddb5bb9b55daeed8020ed44d88fc3
SHA1 2b4020916da5f395a885feb2e72eddebecf3ec37
SHA512 ef19bccb75dc6d95ea9de3469ea35bca896243394971cc92fee0ad25325408a7b563a17feb49c4e01de24412684a1d91875eb0ce35dacc1fc73e848ec2523390
SSDEEP 98304:nAW3TxgcOcB5PezCSxHUo3kaW6GoOMDdxaJ97DwsCnLm:nAItcddzIHiY7D8nL
TLSH
T13E968D23F2E601E9F06ED1788B6A9232A972BC854B30B2DF075076551E76FE05B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4640	alg.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
1108	fxssvc.exe
5076	elevation_service.exe
4624	elevation_service.exe
4152	maintenanceservice.exe
972	msdtc.exe
3668	OSE.EXE
4080	PerceptionSimulationService.exe
3500	perfhost.exe
1128	locator.exe
636	SensorDataService.exe
4172	snmptrap.exe
2004	spectrum.exe
1780	ssh-agent.exe
3868	TieringEngineService.exe
3828	AgentService.exe
2284	vds.exe
4288	vssvc.exe
3416	wbengine.exe
5100	WmiApSrv.exe
4384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e7a905ade52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f51a8345ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ca259345ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c23e76345ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df62bb345ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1b64d345ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000392e44345ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a772e23b5ce8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007609ff335ce8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
736	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
736	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
736	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
736	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
2944	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	736	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeTakeOwnershipPrivilege	1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	1108	fxssvc.exe
Token: SeRestorePrivilege	3868	TieringEngineService.exe
Token: SeManageVolumePrivilege	3868	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3828	AgentService.exe
Token: SeBackupPrivilege	4288	vssvc.exe
Token: SeRestorePrivilege	4288	vssvc.exe
Token: SeAuditPrivilege	4288	vssvc.exe
Token: SeBackupPrivilege	3416	wbengine.exe
Token: SeRestorePrivilege	3416	wbengine.exe
Token: SeSecurityPrivilege	3416	wbengine.exe
Token: 33	4384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeDebugPrivilege	1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1224	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	2944	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1224	736	2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	84
PID 4384 wrote to memory of 4996	4384	SearchIndexer.exe	110
PID 4384 wrote to memory of 2244	4384	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736
- C:\Users\Admin\AppData\Local\Temp\2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\149.0.7814.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x1407abd3c,0x1407abd48,0x1407abd58
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4144

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4152

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:972

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:636

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:520

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4996
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8844b9eb05e11eff45f4aab26161abf5ae842210c632fcabdee266bbabdf31f6
MD5 e2685fa7adaea4d90c445d08cb3dc6e4
SHA1 77be7cde96d64d5e4bea3ffb0fe7fed64805c11d
SHA512 398aeb6b1d93116f4291f3164757f518706cca797cda71ce762679a0fb5c1ece5e3823707bcd0ff463b39db1882e707b59d33aefcabdd93390772ba9d55f0928
SSDEEP 49152:6b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:s3q6HjBSLm
TLSH
T13ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a3066cc8a52e2ad2bc06a084d603ef9570b973820d8d3ff09c8a8414bbf131d9
MD5 10c595e710a15dca07e9f40b25e642f1
SHA1 51f6198ad7dfe283cffc7a2f78632a3d515d7c3e
SHA512 e92f0f3f172e4728eb552e17cfac682fab484f1ec1266040dc3dddb56b7acfcc9c41ad840e3a2151644eaef72b5b093efa031508c9f7090131fb8a4146f12956
SSDEEP 12288:r1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:RXYfDtczABnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T14C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 03ebad1b57c349e8e82f3e87051f33cba86e7702fbfcb9bf0cf8122f57f95b4a
MD5 3b41562cc5405051c2f6d87c9ab9c19e
SHA1 92c9db7720b5a4f14c31fb39ca5ff69ad8e6d764
SHA512 f8951509eed4bbe7a1e363c861cba00578cbb4f12fc49d7c226a8a6c9c357e4246e2af554be43ccd286f4d4827543e06c927cb4fec5d86e059446ffa027b8525
SSDEEP 24576:f0Le5ji0hmxLrMOnQ/tbw/2Mkjy6Fr7g0oS:fPji0Al3Q/lFTjN4
TLSH
T1D4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b2e2aac9c5b95635b37bd9412d6a40837de9547be2960e63f4ea4e6e63a82f4b
MD5 d623c18fd54ae93c02fd936b7940f0d1
SHA1 f30f7318ae2c8ee57bb6bf30bcf99c830caedaa8
SHA512 38ec8b0410f2c878979293525039c5c6f40a9c080d5dd2d08848d007cad678994b25ee9f78d48e86c3906f01c805d4856ff668a8234be41cac11c00e88496367
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyu4nQ/tbw/2Mkjy6Fr7g0oR:G/ezSC6vUzPvxHjyrQ/lFTjN4
TLSH
T13B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c94cac9854534ae388e1fa959db8be5e7fb95f946b22ae1521df2247377bf54c
MD5 6cd05fdbff3d684c81c828791ce059e3
SHA1 f12ee8ba4a4fcb564f0dba203835d4d543edab35
SHA512 572437dd231991e48a5226d9c4b2dc5dd0db02c21748b2647c8b439d5b4d4eb6e7edb70082ea0b9843448af5f5a50bee767d22579187f61a5a1eb5a914b998dc
SSDEEP 24576:ZVbqPb88hv/l+6NnQ/tbw/2Mkjy6Fr7g0oH:ZVO88hXl+SQ/lFTjN4
TLSH
T1E4559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 18bcf2ee09a9f5fc398fad1027b9e5ad71ae9dd2ac009e3d5b1731aefb7ccca2
MD5 252109e52d2ad6dbcf736e979d3ac102
SHA1 1a688bd4c7a198f04ba8ae39b927de23a9d99d25
SHA512 8c52dbc194cf0f84a7e9aea44824f57642e13ab990f61d3a1b4de38dd34d6c7b9ed121bc9d8e88f4c7efa5e7c2f4499bd62a0e2ce72c0dd5aeb4a04795c72755
SSDEEP 12288:rz6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:rz6nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T15E5523696A14F897FF2B06B15CC384826B3B0EC1BFD4AB4E6B44362D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a3f7e9a8cb532cabc1096f97774c7d044c256cbe5cb71c97c9b6bd297c44b244
MD5 d9b93b61f9891367dc566c54ebb1211a
SHA1 a0d6e892958396ad04f0aa6671f63cbb0b72dc86
SHA512 4fce9fc4d3530d191c8563c8bdf11b3a83d87d423980e6954e01119a84432778283e878d960868714d839b7f1054eeed577998876536a3e3fb2c36e4c3023bd3
SSDEEP 12288:meBNUbTVO86UFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:mJIUlnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1B775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a0fb92f33e710c32639ee936c4a598edd980dec679b2949d13febbe2232208d0
MD5 218d1d2bfc1e85e86140f8151e731aa4
SHA1 7950d6583fa6aef15a42629f821b69f5f17450d1
SHA512 3606a639d91bd978c3cd42ae76751dbd18659936dfd7f367d690d46c2b10920cc9f745d4dc52cdd33f890cbdb8c222ab43fed0f55414bac004880e0b58ff1c70
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:lQvGAdlCEL8c/yRNw5CLLm
TLSH
T122267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c09b7d7130b5a92799dda58a4f218904da44c7fb01d1b515600a9950854e79bf
MD5 35df251d9e3ebd1072f44f8da0fde76a
SHA1 3ff0aa4ee79a31e86ce9c7dfaa45d96bd7d488c9
SHA512 efcfaf1dc2cd8720b6ee87345735ef8d4dc209c28c456f7523758037be655892a8d23d253bc1099b8d854905088271985caf3cc8ce311301f4886466e36dae73
SSDEEP 12288:GAwSfxL/2Dc39DLLmt0LDQewsAjHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgY:bQewsAjnnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T19575E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 546d696d340d6e4b3ece4c73181adda0db6971c22e464bb4a6e1aeb3a39d16a9
MD5 1db7df9d8243ae90c6e987fec7ed2d6a
SHA1 727c914b9690f4f69693a88b876c86f078ef03c8
SHA512 05cbb799640e32958f5749b74de8c720893914b0ab0a4de9e502c23e1bed578f5150f88282265e2a3fb8246ef173997d821b4e0348f50e2d6760888783c88246
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEL:0UEtQevvqc2W1cpV2EI32
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 adce43329e8d51beb116a7c32af4dc8fe968592d860aba8c554df02037dd242d
MD5 f3b4ed2e6b6e6fad413bd3b9190099df
SHA1 531149095f2c04090572cc7593f334f00f00d2bf
SHA512 b3cdba4573007f5c67e3c5349bf94eb537db8e70c8abf8e53bc3e90fe139c40bad1e66c89c13c3ece10853e8a928d0b638244e6b463c2bd353b1540e5a087037
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zHQ/lFTjN4:KoqtVjnmPLm
TLSH
T1B4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 95d1e7491bf30da091dab4d1ed61f213a177ed97a5273f03331f05afa13ec1ab
MD5 8d08a42f8f2159b1e6ec6a770c6ccd35
SHA1 db8446b1f321c6e975c13a350db08044fef6e3a6
SHA512 7afd6971b21ee9809efa8eb8c4b8cf1110e165d406476b741d1466bb84af834e57f68bb403420bc9b8711de1f0ebb0ea715bcb9c4718204d1f28b165d63cbcec
SSDEEP 24576:qAhGLJIFoiwtA5l7S53MnQ/tbw/2Mkjy6Fr7g0o1:qAMyFoiq5cQ/lFTjN4
TLSH
T19B35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 47c71581c913168194028999dddf0b660ae9214f357c60161547da7d3c92be79
MD5 8a8e494919ba083123b46f91dc6eb1b5
SHA1 9e94783874783817f4c397f2b76eb96b5eb60217
SHA512 1542d4e9a24d60b0948aac3f0a68b999aa95c71812ac96b64a2414f07381bd8f11738efc65bfcea5f227d34c6537f26cb1c9f5af376083edf6a6b2cb0d96114d
SSDEEP 12288:hmw5HEjsChN2BFgl0WDm+CYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoME:8wuHOWLnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T17865F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f0096caa68dd5a79288418288a217a80159546efef7644b5cafe51a0a6a32437
MD5 d6ff7e59d925d2c7f264c4bafa28e74a
SHA1 472b77e0e16e9bde10e0a7289f6aad232a298370
SHA512 cfa659a10e54f21fef74ce1d35351c015e23561b87791efdf5408f7bc805a90512f378ce9fff27201c7d1dcf054b08680a2b054448b8641dd71b2616fb996294
SSDEEP 12288:7XZ1Iy3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:zZumnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1E255126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 044743fe4a713422526deb6ab7d24789513c482aa48ae84b843b4c774cd254a2
MD5 2197b1b4564cfbeb7da1798998c45f34
SHA1 5ae19ead9bf1f1d3bca1f6ba42864f2c6e5d019a
SHA512 9cc46befda16ba57ca5643eb71e6b80019113d94a7a877f0a4356d0f961b063ec307463ef3e84464f812a5d34139a68c19be07c4909a2b2bcb81871fe9ff867b
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:AQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1E9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 10d841279aac18cae34ec271a44761602163fa847f578653a52268538f3c1a3f
MD5 32c8ff7595c3c497f2e86da9d05a072d
SHA1 cc14238bb50243de01c7a01f78ae062aafc7a2c3
SHA512 2b6a6b6e8fac66bd455d4230890da5214b6be2c012ef22c309d918f4cd1349ca23985936a3eb5c130218724b14d677ffaf991151cf7362d8d5fc0209714f0d38
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:UQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T132667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d302aa167c45117e9fe190130802592041ea440a679dede91960dc45de10c930
MD5 bd7e0334ccf5fac1bb7fe026d7425c0e
SHA1 3cdf11281dab89a6558fe808cc68a490265ac135
SHA512 d7592dc781f375b9ffe26ba0f04688763397159b950b8904b6a61757aa5c2a26fe5186ab2adde0a7dee13a638657c4f380c9e7a414f27dd99efd770c777fd0fe
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02nQ/tbw/2Mkjy6t:v68Qg55nhheWu7PNU3/3Q/lFTjN4
TLSH
T17EB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1b160ffdeeab941308186df3a71f7fa02f6ee8c8405a9cfc2ac8441123762439
MD5 ef2e0bf30630d0260b9d221c5b6cdfec
SHA1 c0296250e2c75bf254a1bac370d8b69e1a4fb3a5
SHA512 96236489ef4f56c402be44319f5afc0f281addb4d4dee9961f3950d142089e28afccd3b0830e2eb751abb418807792b287db891cc62c645e483cf8ce5fee90ac
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:1y5112gYy5azzVvL69nLKnhZ1Lm
TLSH
T195167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e187f33675949edf90a63792b17ad556fb1f120ff62f12e7219fbd68ce164f49
MD5 04bf578a424e47fcaeb071e6cf21734a
SHA1 d863537cf1ea446f9860eccb6b9fea7b7c0875d4
SHA512 69d664e4f4cac99412b5dc5879293dd9534ec9d05c6a8d606fc9fae1cbb5d1dd467879d3ba7314d5bd4d34f74dee4b02f67f2bf0ec0d42f04600a60e3805cf5d
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRQ/lFTjN4:2u6JmVxd2d2Lm
TLSH
T1FAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 793f10ad0185dcff5cb876df7fdaf7021de26ee1936e59f519598708fb54ebb8
MD5 65f16c551bbac7c97a94a5d5733e3148
SHA1 ea74bb3af2c8e6dd6e906ae431b4a821b6c2c9a5
SHA512 74442216030886eb8a9a704c2f04895fe5c1bb8d06a0e186c50d51b313be15707bc913063d336ff0a43742608e6283e8fc9db3753edac9a43c6c1513ebd6a39d
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xFQ/lFTjN4:ImifPbRPLm
TLSH
T1A6B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 58f777524a62869f3682054e8d72dc43ae4e0d427066dd0c1741aa26efb8834f
MD5 426e00ab682de7cab22b629035d04860
SHA1 5817da783eafa4e75775c8ba545c517a86791c57
SHA512 9314b28ddc2f74c44148e62c6e88b6ecb9f2334a480d5eece4b4a15feb0454f7089e6a4d552c02d9c1c40be33c44e858529a624402605ebf1f95f84279bf5d3a
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqmQ/lFTjN4:n5dKTi61xLm
TLSH
T1D7C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 307fa6e300a907c1d487ae66f9741a85d58df7081557c7aaa8630062e36d8f48
MD5 0f1822ebd59f40a53b4f537f609b9c24
SHA1 d4ec7cdf71a940ac2365cecb2188630a0c6b7241
SHA512 055fb93d5fefebc849257893643b399c0f5cd3b530902e9ef17acd2584fac77bbc645fad88d91797148f75924f69f2e69a68e029154bb3965acf190ccf9cc570
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wBQ/lFTjN4:oX2iyphjLm
TLSH
T17195BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3cda9858c2cb410dfc3fc6d1e24cec683dfe9c1ab6ed84c2b1fb181fe5439dde
MD5 071b364de13a911f3d0556080e57914c
SHA1 d43555454d338755c4c6668b06206aa614456ed2
SHA512 1e2b6b6031f88b8217e3574827fb6c68dce39f026147463dfda9d721ce11a556c792009d1e2b6cdfc78bf903b39bb91b0b2455e96420a98a7b0b6b7a7a91c37d
SSDEEP 12288:hSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:hSnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1645523697965F98BFB1706F18C838182A73F0EC6BFD1938E77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f762aed275e3bc0204b1b4565bfaa0579ad305098fc692d1f6b38cbe2cc0b894
MD5 0704a9a41fc80aeb8de4f04c014af232
SHA1 26b10f0cf59ec2c5663838b42ec01348ec30212e
SHA512 7bcf0cd77506b958461ce538eded425c9af497a5829e1176a070e911943a398d2817b9ddbb372e8b11b79bf63754e3e86eeff01c68fce4e5f1e6f26384e29b11
SSDEEP 12288:9jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:9TnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1555523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ed8d6b66f4dfe5e5086286ad97403df9c1564e70e0997139fec4e0943839f97c
MD5 287eca13dedf6d5d6196249d3e561b72
SHA1 6b1a508f89faa049aedd228bf47fd229695131e9
SHA512 6577067f87b87846f3847efd76aae51f766f72a128cb77f49c474a8d42d365fbe85cd5b40431f39858cc9e4c0960f5b9ef1769efb90f9e388236fbec38e7b906
SSDEEP 12288:O9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:OdnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1DF5523697925F98BFB1706F1488381829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f1f6bc49019d16e2bf32222de61b9e286c09470ea079822e6af54443bf2861e9
MD5 6e488b4c686cf1a8f27ad6107160928d
SHA1 9a75b44d2561dca7215e3cbb5cd6939e04da2c0d
SHA512 456a9733a0b2f7c9e31c35f4baf4ab307d1e6ddaf8c5f588e868fdf0195d0220fd8d53e2e77cb6c583f9408d1aa8f58c5de32b31aba7e50c13b3479a492e8c26
SSDEEP 12288:lVsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:MnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1C05523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e5f61bb5501854eda61aba89ca7d67691ca8ee8e4c8b50ae907f312282a43238
MD5 0eac742bacb693890b812245139fa479
SHA1 7fde69476c0fe6373bc87f5cef2ef37dac55c4f8
SHA512 ec01fcbd269bbd64213142115cf808c3bcce1da4776e9e1c9db68dbd295c390f35207799f01d8c76edef6f59b40e4fc4b2ac0353c853321b45d32485f98cde4e
SSDEEP 12288:DUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:D0nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T16A5523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6f317b962131f9fbcf93111e901b01620303d5d112e136182a57e7442544d3a3
MD5 6437c3e441f45b66bbdde5c6f4616b6d
SHA1 fccf655c8ff42c0849f7b7c82cd0ca3f79570898
SHA512 1fe853ebd922d2703a9af68c4659d61ef0144fdba35c361e7c19f3133f53aae8d40b5ccfce7462b20b184304b7cf8739e1d515e92e4bef955d46da047c4f3af5
SSDEEP 12288:IfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:I/nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T10E5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fb30afe2f7c8f81a73e60a9720c8898c145adf6f3e396b58da570a96c1a336c9
MD5 babd2c0f5943379ba6634e07247b94ae
SHA1 21f5b446393939a29cce4a82ae1552160daa7252
SHA512 c77a2afb6d8d53cab13a831e43ac61833c25bb2c181e52813878025cf63ba090ad3a9d3d92809dde8114211c95fd2e384c70b46d9435ab764b8d14ed31ec974e
SSDEEP 12288:BrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:BbnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1515523697925F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6c151e239a02a85a06503e01dfa322a153fed99a825bc8247d29f469798590ba
MD5 e15230a02d5bdf19d7b5d1e50727af92
SHA1 9287a5944c84ace0fc354105c1d57cfe2d53f543
SHA512 eda87a93a5e13c291e0ef4873df33d0007ffb64fbf37d83fd8306845ffd2d69183355c2c1bf1156f0394589725e0b2eb105cd7935c33ca56a884fd1751ed95f1
SSDEEP 12288:UiZwbDzzFEoS2cPvyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:3ZM3zFVSOznQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1AA7501A9B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 548681309bd77a6c2a21e7e9100c3d4bfd0ceacb8ea61708b7b19c28732872ff
MD5 73030ffd6f9144f9772d387b3e38a421
SHA1 a7ab930b2688a69ae49e8d746bd08e87e371e357
SHA512 0463b15d600d57fb46558b130161e31f0e05fda0ea2c07072626c9115b99b079520989658cb1d41e14404a29cad503cc24f180c68785b40bd9a6ddd03085215d
SSDEEP 12288:h2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:hWnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1575523697925F98BFB1706F5488381829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c62bba4ea3afbf09de4a24b2e483b3c3b89210fa217e0d522f63e193d55eb84d
MD5 5a30da98384db850d15ee787a60bc4b5
SHA1 18bb6ca61345ebbbbc9afdfe763f8338a3021f25
SHA512 7751a71a7d8b9c632a039fa0138937576c21e94b8d22006622afb3f6a4e0ac20bd8108f6f680723b7a80bde3ee121738b2383db091ecb7f8a95ca5a97bc57a5f
SSDEEP 12288:uqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:uqnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1E45523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9a332aadb435594f2ea77d3a2f0b4eaa56f1ffb4b617f780a1ba8820930355e3
MD5 6287cd01a50c7d57b53b588f307ff50a
SHA1 238b2110034c094c7302736c6f36152724b1081c
SHA512 d75f55b538567406deec64e1a79bfb900c40fc1ab60bf205a6aeb8a4688efe046970dcf9b27f7f6c2a08d841285ccc26065512923db1bf7561f055da294e9e41
SSDEEP 12288:NyPz5L83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:kzyXnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T15065021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 cb56e2ac932844ad3fa6704a28ab273659cfab374d94a217dc59b04ef7e9a772
MD5 0c806119f7a351b34fc68978d63d323e
SHA1 fc1470f36e88609d4fccde24c593310575f82e59
SHA512 2aa07bb166d1993dc6693ee69fd44a756b34c44f11b6db6b108f72883d337f2f2bf16879cbbee1e8b67c0b2562d526bdadc393b03ed4d898c71aae14b39124cf
SSDEEP 24576:0cP4mcvIjkGOxhKP2l71nNKbrh/8KBenQ/tbw/2Mkjy6Fr7g0og:PP4m4IpOO67W8KoQ/lFTjN4
TLSH
T14865AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 93f1a5fc90c94bb8b48089bf426e131366f180029abc1e98ddf9b5065326b658
MD5 14e7ce1963ffbf8f9630113f83e40007
SHA1 7aabbc209861bcd035012ebc40be4b34ad51f81d
SHA512 bc41fb2b0248db45f7439ebb6fb8ba53b9635200718c32520e1eebfbb71c75576fc3f0033fd9a8b22094e027aa0338e7bb3ddc3c3891b1c5325dfa91de193f6c
SSDEEP 12288:KssfGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:MmnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1BA65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
Size 3KB
SHA256 22e3ed131fe6e88c47666233d076d43debe7dce875c929ecc277692ba7a8dcb0
MD5 484f5b45f79e86c79c8a0107a9998b02
SHA1 c1c5f203834f49cf63c59eaf88382a89a89bd373
SHA512 2ba5c6900e7040e3aeb2fab7fdadebaffa8c94d9ca6ca8b8302e30cceac54c0c9aadfdc638b8ff3b63607c7eacdd3895f25579536c9e69e54ce1419d614bc839
TLSH
T1C451EDB1793BC9371628DC6B7B22369E91A500C483D763A1B3CA540CB69BD326ECD11A
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl
Size 1KB
SHA256 ff7d2b363f8c29fc4f961ec32f22722d245d38ca9e7f71607347ea5638a55c00
MD5 73c89a350eda4266784484d1840a2f09
SHA1 a52da49e5275e374bdd0c052181f3af2f1cf5c1e
SHA512 90bd83618fdfca365d6a7a7fcf5d2abdcb3a2228fd00b551cbe2dd74907c71769d5efcaf8ec5e92496869d01b357005889c82c601f711a95d2c9a8d4ee76a7c1
TLSH
T1FB314562B01FDE31EC2A62A4B3E5376FD1B1100CE6E997C01784DD1C19CA95F79E9127
MD5 SHA1 SHA512 TLSH

Submit Download

e7a905ade52bf895.bin

Path C:\Users\Admin\AppData\Roaming\e7a905ade52bf895.bin
Size 12KB
SHA256 838b4e382e58c48942c414f4377b5a00ab6a7409711a25ddd5919f129802c281
MD5 d1b3e0f43d09ea119b89a5429e5ef9cb
SHA1 63ef13962f3b0b3df800f74947e4117f77a65b8d
SHA512 a87558ec3f7567a8f15229a07bc9b79622e01d29b37bb05e71af1f56bf4e098397dec47fc2c759630764c52520b3c879cb063ab087d4b0cde18ae8640c326949
SSDEEP 384:9VYKliL/iqy7jiINcdUzGHHzaqzoMw93b8L:zYKlp7EazGHHbZw93QL
TLSH
T1F342C1DC14722EFA4593094BB3BE6D134F59EBFB19C28118DCB8C7808B191862D437C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5dd896221f87b89c238b9ee4bfa6cb3ce6303a327426fe28f6f3274613eca985
MD5 8f1e45801962fec5aa01f4d7da7d5a63
SHA1 edc05f64395294b7661d30c61ec00c5555bcf1f5
SHA512 407a54aa8c60b4e6a2a5eacb7653b0733a0f0fa4a9902c8ce507e9f73a0ded83b064740f43ea632a5695d55fd0c6545d9e7d92ad271cda24a7f1b4b4b259832f
SSDEEP 12288:TmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:TGnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1A45523696768F94BFA3B06B04882C151673F0EC5BF90D78FBB08222D967C3D01EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 de41e69692b1de6b5b4787b087abfe1440ca169818a85d030eb168166a28301c
MD5 412e3fde417d3ac51c0528a1740c63be
SHA1 84b3f65d486de9374979ceb3c1b264343f737be0
SHA512 9a0096b19b94490224632d591b876a58f75316b40dcec648fb4a8e12e68f010585828ebacbd85cee4c7a0a3c27dd1969cffb1b5a2bab8b2cb208e7c82c7ef78b
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQ0Q/lFTjN4:ha0hNYG4JwELm
TLSH
T18A859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 26b74d62d8ace4d0bd9345fe49a96096efd92e05bdb45dc676b21d86465f5daa
MD5 625cc7bd0b20ead1bf4646c79f34300d
SHA1 64ec4e4900dfa34e2df3319118eee83815c0d895
SHA512 eb1107053542425152f66006ceef7d9eb39aac7e3360bf569556c0e9c2cd93ffb95fb46e9a851a5591892172b8e08b47549008de71c83933b6a30d9c34ac981c
SSDEEP 12288:QhbHjfXzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:QhbHjPjnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1C255027D26AC30DAF63692BD88928546D7327C552B11A3DF2381827D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0c23eeee9723af21985aaeb108e2e778c1e4b55ac5875455325bc472ef72aa36
MD5 73c61d938e933169f2a0e1fa14d92790
SHA1 dfafb49e17973e603c179d7009576142266c616d
SHA512 23a7bf59a2631a03eb85f4d60f7b919220cbc75bce804773d81afaf94f431241cc82bfdab6561cb84c135ae5e0ab4e5a0fd7dd687259ba29b01d27ca20de3a73
SSDEEP 24576:U3YgnJcRTk4yti+R5dBR/LnQ/tbw/2Mkjy6Fr7g0on:UIgnaTk46pBR/LQ/lFTjN4
TLSH
T1B345BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6d0ac896288d18213eef49ca55da5fb673fa1956e3cd52187a9da5209cfb5a9a
MD5 63c1c34e4e5d745be67c52c11e11f61e
SHA1 d88557a4d23dcca7f0b016de0320e8b4a4972aa1
SHA512 e96cacc8c5ecddae11d3a5dd12c35b1b951af891790f9c61c0369ca6dc297278e177b89e0564f0bf8f30be216b080bd878a6e5ff68c8ed3154da66a5bd205090
SSDEEP 12288:5aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:5anQ/tbw/2Mkjy6Fr7g0o4
TLSH
T13F5523687614F98BFA2706F54C838546673B0EC17BA1A3CF7B48212D967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 9743600192694c83831fcb34b447a0f9898cf4ee8ce1c0f9d6e8f3959e2ccfce
MD5 04a778b17513412f2dfb8a312a046dab
SHA1 bc8e87f23e9db48d8b17a64805b449e6fa9720a5
SHA512 321f1d3b93764785a72287a63c4fea17686ba262c0d3b7fd2e1269e3461d5abf5d71d6eb48505cdf87e82b24305ef42c3aaf478ba536fa271b0aa025ea25ed59
SSDEEP 12288:MOb4A4LWOsvAYFTxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:xwL3UTBnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T13375F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ca099bdf063ee1a1f8b27e73dd5a4e99e27ae6122e5bd7d941f4ed62d034f507
MD5 cc67a8eca400507d33a8337f3446e2e1
SHA1 896bba89d257adbc0014166c7e8e180b56d7f469
SHA512 b90766bcb07c3546da1d5d5612f45355a1ad40473dd6da7ae80627287359a2b5a216578290ab590f5d8b05c1461a3a9ab0f5550f8dc8b602f9a97c2f45b1f0d4
SSDEEP 12288:QpFtCOlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:5OFnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T11255022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 027a34d5e56d7c8fbdbaf7d10e6942cf9b5a2db2880198db6d54f5fa9725b21a
MD5 ab141757255a656e6d7933a79b4b193b
SHA1 ac8538fb63650cc3c2e5700d9a089699ee93df12
SHA512 23f1c8255a42401688e2eaebfbb51793b2fd73752edaa23a5ee8717ad4bb5a53c75bbb4951716a1a6a3bd83e480c9bf4db41096c6d8289e8b08948ddff71157e
SSDEEP 24576:d7NM9YqZqmWMUkPjZM48Mv6bEhsWnQ/tbw/2Mkjy6Fr7g0ou:d7cBWMpPjN8DbEhDQ/lFTjN4
TLSH
T145659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d685150d3ff69aab8e2edbaa197153a2375c34cad47d1a0c2ddfd5ec8aadad19
MD5 741637a9f8ef407ccecc9d27918759e7
SHA1 a5120d917789fd41df94d83fb81d6ba405e4c7f9
SHA512 6e7d9e778e6fa8b7cdbe2ecce8e1c393844d1cfe445ffc3908cc62f37d55187cde69b1d3e9eec56e7615db29938bc68861bc4ae7c33e3572936bf546d2f54da2
SSDEEP 24576:WW6BApg2YuyuNDYTabvcdvNYf8km1gnQ/tbw/2Mkjy6Fr7g0ot:WF2YuHNETovAvNYf8km2Q/lFTjN4
TLSH
T147857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2b37b941a99efa7dd6479c9c0b46e33d3cd4798b19fe7bbc1fbcbe5a9a0bffbd
MD5 a25fcc88c1beb4b0b95d2b789c015850
SHA1 d2f88dbb216bc79d902046cd7e295fffaded43f1
SHA512 e3577b5200e2e39881c0943c92e4901686a26a8d4c8d2f46a9aaf440a48c56c3ca0090888c097643b02e831d759815e8f7942a9edecd1958c58371c082a8cf3d
SSDEEP 24576:GAFs06+Omlf3NXEbTo5nQ/tbw/2Mkjy6Fr7g0oS:vFs060lVXuUQ/lFTjN4
TLSH
T11A65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 128f6c4c9d2b68472c33ec15bcd1d1aa1c786ea2537d3cdc3fbeef8ca1b46f50
MD5 2199139336d00291840ba70aa770d7bd
SHA1 53942c2f84d46fb008b8715cce934ac39337a5ff
SHA512 11d079440e40680320b058bf2cd0a129105dfa78428a4281c6aa33d347f1a518981a444cac1416e9a9c95ec7feeca2dbe1cd6b925157969df7ccbba27d767f05
SSDEEP 12288:ICJnJ5D3VkrqzxWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:9JnJ5D3WaUnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T11275D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6bd4c9675e910ac641a03cd93448cf4a403eaf8762330e7d545402367e79a20c
MD5 b2dd8f33b6d85da9509bd6120cf6f9c0
SHA1 b4d19b5eed8ab853095b2d0129b6d292bf8c2fad
SHA512 7e32446c87b4c2e0650f9c875c9375848b8a5d7821f2894c754af71abe25ade4443ad2c775c82dd671ea3e77071b8c492a2e2401bacee1e8f00e187725d262e4
SSDEEP 24576:oEPghm6/7IIXdwcXrif7qQncjlP65i3VuLnQ/tbw/2Mkjy6Fr7g0of:Hg06DIKdwc+eQnSt65aVSQ/lFTjN4
TLSH
T10F955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ee414d781c05a113779c9b926e4d5fd1abbc966ca02272adf2b5f469f19e43ad
MD5 dc63b26bf441b62229b00fb7a52490e2
SHA1 4b7f4ee8c2ca980bba5fd8e667484f2c5f799a3c
SHA512 67b62ee03886df7fdf8a7ae5b3625bf48eeeb8b2bd2c819c20665a301685b8c19ee204fb37c2eb3386f8e409643456eb38a488d233fda4d279439ddf63e15df1
SSDEEP 12288:cEP3RSNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:XStnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1EC55126D37ACB0EAE52A517D88918145D373F4A12B5267EF2680823D4F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 0ade576f2a189e24e4d20a90a1243f91263580dea3a363796906daefa6599004
MD5 f2b2afc2883f39316813e7ac2dcb7cb9
SHA1 abc3569b92faebb4ae7af93d0f85bf9c915a38aa
SHA512 20863c982ff891d69ff4fe775c9fe19b1b5ca914f020ef45bb064d2e6d4b8db9a8038f240f834fb7caa07c2609cedd7536efb85de747274a8400f1d23b4721e3
SSDEEP 12288:zjkyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:zIyTnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T12D6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 572923835af1f57e4e1531a1d97458534c3e7ca9909e15e6f38569b0d67293b8
MD5 b1afa961d5a0ae12c9096502c3f241f7
SHA1 dfed5d7fe24c75a3b7504c50e54c2186c9bcf02b
SHA512 c85d4f95aa6f7787fb627b763c3667ee29a76062e0bf70dad4d53232cc9478a343a4c86487c800da8f6924666836a96c1be029ea77c5b5e2b2165ddf2f1fea39
SSDEEP 12288:O0VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:p1nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T11055236C2625F89BFE2706F448928542973B09C17F9167EF36846239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0882fffdbc6eb7392ac623ba077322f1a83408e8210f65abef65c0b39465fa58
MD5 e3e87d8507fe615a7f2265bc3cf0db35
SHA1 3a866157a3a03e0720b3c6cf1f4e600b76842a0c
SHA512 7d8fa3c0f11d2cd9f49e9ce0c77b38d1d221deb9da1d53c9447257bf5be3e426df7af1628f7c6826ecdfeaeb855816808ff4352a5d48084a03e2cd9706cee517
SSDEEP 24576:uQ9MxZKdcz9dw3unQ/tbw/2Mkjy6Fr7g0ol:uVKZuQ/lFTjN4
TLSH
T1AA558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 22fe021dec774a1d7ffc46675a008e34d4f1eb023d4a0fdaa81cb751a62d8b99
MD5 9d909ee1912319e92bfff8fdd75cb2e0
SHA1 db7423f63360fe88302e8a262df4060a4687b8f8
SHA512 8a64a1315656bf3bd73e53abf519f7d6c26f6b7561033849b3b57eae980be4c511bccd2d9c675d66b15a84a3b65c78d8db789171869ca3f10b5c2561a360997d
SSDEEP 12288:nyoKo20Rple9pHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:nyocSApnnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1F765E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e0a41c6ee4ac695f14e2663ddf19fe3dd1e71f2b7529f8d868dcf07c4503b880
MD5 973a95b3636d39b5f9b08706dbfc06e1
SHA1 81bb290cd442ffea9d3c93d2580f48334fffbdff
SHA512 9305bb405fd87f5c16737f0b9e3cfdc03e6ac13226f423f71d993da6aa9cb44b03e1e2d4d9593c73cd5c99b4c225c881dd40bce2333a880946dea1c4d3c746c2
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKnQ/lFTjN4:L0zuNImLm
TLSH
T132A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5a4f4898af107ea3e99daea0b0df2d01f6ec5a055de7cb332782d7e6b166871b
MD5 57962b9bdd3ad41d47fb8ebe5ca242e5
SHA1 3ff0ca452144160159b7d05c7ef6406f562902d0
SHA512 4229f832badfcf477379ef0a970d10b6e425cbc6d9038a748672f77d1a5c6704659d0c85b61f441dc86068f5e7008e47113cdf72a2793052c950f2fa8d099383
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYtjMqbYnQ/tbw/2Mkjy6Fr7g0oN:bTDxR+N5YzTfjMlQ/lFTjN4
TLSH
T13055B02EA7F855E9E17E85798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 04cabe46880a8611b3fb025633f50b2ad8b2feab372ff08eb5498ab0bce194c5
MD5 40b794fa00f4333d5bbb1988095a1708
SHA1 af8aa8a31d0147ba1340510fee462903ca4c1a6c
SHA512 94e4d86e468040c6e38cf0b91568b084f79207b970151eb0d95645ab84e1bed07ffa652e74ea055c077f62b37180390d53568c730041b8fb46250aef003fe52a
SSDEEP 24576:+TMdOz0FFS+1mSLsnQ/tbw/2Mkjy6Fr7g0o4:K0K+1mSLsQ/lFTjN4
TLSH
T12175E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 28f56d554c1c041eaa23821c2c6a0b49eb8a55f64e7725281a2bf794e58ab64e
MD5 75949eff22e150b2684f5716ffe12012
SHA1 0a3adc8ea75f8e6ba5a04624f82bad20b79338d2
SHA512 18137888d532d1ad8a454c89cbeeb10f96cce46098abf6b1d86ef7f8c5550ca057672d5a12ea9b2e91b800b27642586732d21a894eac2e782c6aae1a6dfc596b
SSDEEP 12288:T4TxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:OBnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1EB55122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-366-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/636-305-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/736-6-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/736-27-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/736-20-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/736-0-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/972-316-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1108-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1108-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1128-304-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1224-10-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/1224-16-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/1224-26-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/1224-362-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/1780-308-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1780-142-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1780-136-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2004-307-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2004-131-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2004-125-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2244-405-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-407-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-409-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-368-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-369-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-370-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-383-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-382-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-381-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-380-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-379-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-378-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-377-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-376-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-375-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-374-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-373-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-372-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-371-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-384-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-385-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-386-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-388-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-387-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-389-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-390-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-399-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-398-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-397-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-396-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-395-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-394-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-393-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-392-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-391-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-408-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-406-0x00000299AC580000-0x00000299AC590000-memory.dmp

Download

memory/2244-402-0x00000299AC5C0000-0x00000299ACC30000-memory.dmp

Download

memory/2284-310-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2944-32-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2944-40-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2944-31-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2944-367-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3416-312-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3500-109-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3500-303-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3500-114-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3668-301-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3668-92-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3668-86-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3828-149-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3868-309-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4080-105-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4080-302-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4080-99-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4152-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-79-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4152-81-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4152-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4172-306-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4288-311-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4384-363-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/4384-401-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4384-314-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4384-200-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4384-164-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4384-180-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4624-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4624-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4624-315-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-30-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4640-365-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5076-300-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-48-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5076-54-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5100-400-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/5100-313-0x0000000140000000-0x0000000140171000-memory.dmp

Download