aaa609c231b1078a223d4f1efccbd5cb9cf8b3fb34b1719a50e51b1a5ae34245

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.8MB
Sample260528-e3mhjaft2p
SHA256 aaa609c231b1078a223d4f1efccbd5cb9cf8b3fb34b1719a50e51b1a5ae34245
MD5 3f949ef4e76c5f00393605b07888dc22
SHA1 89284407861e3ccf2da985ecfc69bd6b880c3e65
SHA512 33be154a9f36757bd36d54ccded03e2a5f06af05953e2b3134e60a4f4daecdda3ed27607061103c2a1076f59356a173755029167b8bc5f61bd2b21db1f6255dc
SSDEEP 49152:XxKA15VC4s6BwJQRVp5r6vQCpJXXHQ/lFTjN4:X7ZCp5sLm
TLSH
T1B095CF17B29600EDD06EC17987564122EA71BC850730BADF17A8A7252E36FD06F3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
868	alg.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
3760	fxssvc.exe
444	elevation_service.exe
1568	elevation_service.exe
4944	maintenanceservice.exe
2140	msdtc.exe
3700	OSE.EXE
1692	PerceptionSimulationService.exe
1156	perfhost.exe
4580	locator.exe
3840	SensorDataService.exe
1688	snmptrap.exe
4252	spectrum.exe
3216	ssh-agent.exe
4356	TieringEngineService.exe
3368	AgentService.exe
4996	vds.exe
1352	vssvc.exe
4856	wbengine.exe
648	WmiApSrv.exe
4428	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c6f232711c6cb3b6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\java.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041338d6e5aeedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d1a316d5aeedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e67a7665aeedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b2c636d5aeedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0c8446f5aeedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7eae36d5aeedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a789c26d5aeedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f5ddd6f5aeedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c546a6d5aeedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
2296	DiagnosticsHub.StandardCollector.Service.exe
2296	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	3760	fxssvc.exe
Token: SeRestorePrivilege	4356	TieringEngineService.exe
Token: SeManageVolumePrivilege	4356	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3368	AgentService.exe
Token: SeBackupPrivilege	1352	vssvc.exe
Token: SeRestorePrivilege	1352	vssvc.exe
Token: SeAuditPrivilege	1352	vssvc.exe
Token: SeBackupPrivilege	4856	wbengine.exe
Token: SeRestorePrivilege	4856	wbengine.exe
Token: SeSecurityPrivilege	4856	wbengine.exe
Token: 33	4428	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeDebugPrivilege	3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3868	2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2296	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1428	4428	SearchIndexer.exe	105
PID 4428 wrote to memory of 1408	4428	SearchIndexer.exe	106
PID 4428 wrote to memory of 756	4428	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_3f949ef4e76c5f00393605b07888dc22_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:868

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2420

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4944

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2140

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3840

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1428
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2836 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2892 2888 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 90ad055492a7e3e40384cb6ebbd2f8badfa07d254a21858676f9471962ede5aa
MD5 40c29c1137196875ca043e81da9882d1
SHA1 495ca9d73dc81987da2748ca0d110773c626fe4b
SHA512 8fc43ccd69a8ad3eefb0f0c82684fff8d92e60852c3f08f28a3c84721ad1fee6f5190a38cb6996d027a93d4712ebd18e2cc66cc389cb160d1fc8518638949ccb
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqQ/lFTjN4:G3q6HjBKLm
TLSH
T178D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7e8846c7fefcb9bfd4dd98dbaac18092b2af18ed85b42de297bd46b38e7c3682
MD5 9b9c5578017dd12f1cf7d4ef19b8dc0f
SHA1 a6ad46e384d813f81a7fdcb44b23a3ef2ae328d1
SHA512 ca133200282fda53a7f37301fe90287b92a544b2131242577f3a5d5720e2df4a2d02336d538ed439743a8d6f3e6780bdec833839d957c0f57207f00fa77ff58d
SSDEEP 12288:O1XLsswWkxy2lRq2czApGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:8XYfDtczA5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T16F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c696c1f7e984e13e0ec6a16c500e60b42d133d742f58ed061d9341d8b29727aa
MD5 d474da492ab4f2e101c44426c6cd2f54
SHA1 31fbb941543850cec5b336d3c1f3d0ce2dc8f9ac
SHA512 eb07c64afc8842092359b7c17fac8096e232b19d5c12c950a150f67ec413dfb38c371699102e2f1f12f989388e593fb5f4af059e3472e1d586c005803debcfe4
SSDEEP 24576:F0Le5ji0hmxLrMinQ/tbw/2Mkjy6Fr7g0o:FPji0Al3Q/lFTjN4
TLSH
T1EE859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a68913a4ec21fd981beb5b42f7a76d0600b144ed19fd5d409ad07959234e52d7
MD5 ae53b3a22e3933f16cde50a215894689
SHA1 41de453b2f0d1278d2ebcdcf1f16c9f3be8fe232
SHA512 65d9ee558838dc4a42ab4dd2dd3b5a7fdcbea4e7b8a5a609ceca8b820875f13d72e947d450e16dd63647b6c433e256effe88d457c98dda6a6f7a99fe1939e611
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyuknQ/tbw/2Mkjy6Fr7g0o:d/ezSC6vUzPvxHjy7Q/lFTjN4
TLSH
T191755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8e7c1c30514c085936c924a9bbd491baaf6506ec985385022a0428b778d5e18a
MD5 b98fba1ad9a536c6b7b7cb1baa5ad504
SHA1 5e2359e5d74644e3f4e11c68927ebfedaa9adf54
SHA512 1ca1fcc98d0bbb75c5bfd8db543928fb2e470242054bbccd4c674656141e56724869b24e1460faaf157a4a8f41b676368597bc669411c6a0bc1cfb38b2ccf3e5
SSDEEP 24576:WVbqPb88hv/l+6VnQ/tbw/2Mkjy6Fr7g0o:WVO88hXl+GQ/lFTjN4
TLSH
T15E559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6cd308ccf113e6f5883fe472dd61f17aa925fcc3af5355ce80e1273148bbc428
MD5 f0d0c82bb8c663c810294959c000a327
SHA1 0e35dd9287da9c748c9396e5eb59187756e1fb39
SHA512 6e40d06745a6c515cd9c51d26b237fbbbf9696ddf62e68c1ab92823964f4eb01b0c3fc662ffa4ac17fc93db72b554f769c33f2147cef62d5a0053fbdb67539e8
SSDEEP 12288:azuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:azunQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D65523696624F887FF2B06F15CC38582AB7B0DC1AFD4AB4E6744322D853C39496DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7de280931ecc94680c61bfd6dbcdd952a104d6233eecb7d7f53ad12465ebfd40
MD5 1d1ccd2ce476acc16b27171cb64a9c8b
SHA1 7e16758c634d86c61b9d203b3cdd227d85747500
SHA512 d5ec55d17912a2cc10423a4ef183af14d9d885dd555ccc0b14bf54fe8bd1b54b96850fecec5d302b5d1f8bcd2362be940a52904e950210cb0b1f52b3b4ac6a7b
SSDEEP 12288:ZeBNUbTVO86UNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZJIUtnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C575CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 250817bd52a6aede7ba9173c81587b2a0168dd1e874a4cb1bcab3de91956b2de
MD5 7d9aefe6ee46196de817f5b586c435b2
SHA1 bcd0b2e2b87bcdb13f19f84a039a55ab9407e4e3
SHA512 af37f4a0426170d6cb3dd9f431eb1593af49dc8eea73b676801d75754dba3e50d1cecf3391e8fb8b61bb35182272229cb9d0b3188d273500855ae38699eb44dc
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:mQvGAdlCEL8c/yRNw5CHLm
TLSH
T160267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cb993865e870290ad156ed36f5c9f6a68540afac778cfa99307a66e346547914
MD5 7383af2e055f56092c8ee4c8b81f0a27
SHA1 0ae72bb1acde4d71beac20f06a7f6677e6095619
SHA512 553c57eb92d3f795a7ff7081b338472acc0be052663bb1834cab1eca108d8f8bf16346f12d486669476361ddfd016f946a5940c507c0cd10539d64637b726fd4
SSDEEP 12288:IAwSfxL/2Dc39DLLmt0LDQewsAjHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:tQewsAjnnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11175E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 519e6a81a4d50bf8bd31119a503f67ba6c7a69e64f3f3299b34dd80b673f2393
MD5 00d5fac4473af496764b92c318173bed
SHA1 2128218423a44aac255eb523e548cb8db96f34ba
SHA512 63d2b0af5724fccf8cb0e06b52711815a0b3971b560332963ddb24a225ae0090e5afee80a3155b46b04cb1e9fbba80442f646ca99727463990f28ca9037490aa
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkL:qUEtQevvqc2W1cpV2EI32
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9c0ddc2f95865d1d4ffc77dd84e88ceb801b6575b2821cabb4e88f3694cb2f5f
MD5 f308295ec95d2023c8e76105c6fc7932
SHA1 b8d7864721c9ba62555858c21fc08359f2c2d069
SHA512 ad5242385285490d14943a89728f41501bd7030a8503d9266804aa9e10daf1ff7541cd7b63c1101adb6b04d4f3c6a4b8521251da9f1ba6102a0489fb5e153a8b
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zHQ/lFTjN4:VoqtVjnmrLm
TLSH
T1FCD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 64ba4a3b01297a06b6f90fa6799888be94c3a1b7e8f1ffdce15aec53faa0aabc
MD5 fa9ff70721bd5f8da054083dceb27507
SHA1 754a70b3fcda23fe7d0c69ba9fc992e9b4065083
SHA512 e5dd04f5d0220a226b6febcfc0a676dcd15c19d5748d689a7dfe49ca8a161c8334c21b60070f552c0734f633f14060d7084d851d36c97ed5becb5b35a0721e0a
SSDEEP 24576:VAhGLJIFoiwtA5l7S53onQ/tbw/2Mkjy6Fr7g0o:VAMyFoiq54Q/lFTjN4
TLSH
T15735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 db4150d9dc18b1013080c73c48173076c97279e0fd9f11e065ccd8cd39247dfb
MD5 c9fdb8bac2fcdd7b9181937b15ef9bc4
SHA1 e9c3580972ade63bdf1e08b4900ec8e932a0fa25
SHA512 6ce8ddc0d9414bd6065fbc3d886d63eeb1f2edca4665361d178fcdf17225b905f9205ef4ffb5acb3be747b65ff3e6aa046e2b4ad931ba4f6f9f046b911bd81c3
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:bwuHOWbnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16365F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 aaebdc9d4784146b42bf151924ee32aad65c5c144aa28bbf29dfe266afff8f83
MD5 ecbad5f5ea7228c4fd83022b22deb0b2
SHA1 43f21afab8de4980a675fd92c4b3a532e8daa75b
SHA512 413a263870b3c555b156cce8e10999545b69a82b23d7217d4903b8fc00f2962eaed9c91375903cfb75f9842eb3a4cdfbc795781fe1c3652f3c6d4fc391fb2d03
SSDEEP 12288:4XZ1Iy3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AZuanQ/tbw/2Mkjy6Fr7g0o
TLSH
T19755126933A470FAE66742B8CCE28646E7733882677193CF275402695F3B7C11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 00a27979a8db2d20f75cc9fbd7ee1de14def9935aa921498eb7a4ed2cabb27b4
MD5 1876fb8a9a5363e6092bc89b9a794a7c
SHA1 efc3c37e702b9a5cfcf5b116e3a366dd26d63b97
SHA512 d659eddc32e3d853b0c3b4d5337d9f864131a04c287810b2b9fc335c1a55b4147248115522df1c26a48871812388282dbab74b316c34c79f2c9faeba08eeb2f2
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:AQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T174667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 339d9335dc45a37c785c1de98766f3007e9ef61ed3e7a642d928d2250d17e179
MD5 78c9a06b3b0a4a525e01b4ae66b1b192
SHA1 6f32fed1a67f88120b293b632515cea8ad18fa62
SHA512 33c0b7143cc9ad2565f4bdeb2c67975df0d29ca678685a58f95e6e8b01a1cd19db75240ec0bc5e4f652abb0b38d62980c88d1485259568ff8b05ba1ee84cd96c
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:EQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T1AA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f924ba2b108d109c6ebb8dd093b35422197db9d970081723e85e8a8ad569cb55
MD5 a798456dd282b8d6b6551f8f546db440
SHA1 24d1f477a559d15b190e593d83cefd2650024411
SHA512 9a206caa51759f710105d96c97e437273dfa478edbbf7046f77caa8ed1379169c9d39b28334cb9e398c02c1514f2aca77153389f38d1a7ba8ced9c4884a385dc
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qnQ/tbw/2Mkjy6C:968Qg55nhheWu7PNU3/3Q/lFTjN4
TLSH
T159B55A33B2F60099C44DE1769F46872196E27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 957c37d086c0988f9fd318b27c2d8617a1b30c65d5170365a9ee614e6c288819
MD5 7e9b9a1c25b6a44e16fbbaccfc435191
SHA1 c07abae407120e199567a3e658f9381bf6c4b7ed
SHA512 38d1ab0022ad135f2ed1f01cd0e74f35b5757e9050ac17b9fc0abaa494d59c61906ed84065618a9f163d1052619312f4f581c0789b9a7c455b21f5091c6bfc29
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:Xy5112gYy5azzVvL69nLKnhZJLm
TLSH
T1BC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e160a86c336844d49c100b1899cbf1b04079da04f42e8951947bb4ecb87c4cbb
MD5 c61418f184d9ab96bf3899367ed76e3c
SHA1 4b4a60db0928a498dcda8061d6e61033992c0a93
SHA512 f2dc39d764f4306fa3e5c35c5491d1dfd781b55b775e25d495117ddb45627ffd6c4e8e822525ca211943dca4b3cca16c47da9d8b334fb657ba0a807ec21d80f5
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJQ/lFTjN4:Iu6JmVxd2d+Lm
TLSH
T16CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb5c6d95c1b1f3f87f9cea753ef4e477d55d1dc39b41050904750af983da8511
MD5 412c83717657f64cfc79ccc1cba84086
SHA1 91ea8164b5835dbfeafd067b1987443ef0bdafe1
SHA512 efbd1c8725ec2b7996a7437c4a62e03625f982c06c9e012c744f5f709fa2cac9eb5c52f04e848c0e5731f8c62122f7da7e8131b5d07fc54d476abf30d50c3a46
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xNQ/lFTjN4:wmifPbRrLm
TLSH
T113B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0f0c96ee41d2c25c45417f9c5fa9c51d9c2a4b1ca35ca1b0e36e2eab54a2d33d
MD5 a6ca46ccfd39ebd00e68881a2846aa81
SHA1 c3387db576b507027c69903592988932e0766fcc
SHA512 f1081ebcb939181d010492123746d3e769fd2fe4243f3eabde4c817a25dd0060a7742db5bd0d0bb5be8fdbe7faf3bc48490318dcfbc12a7e9c244bf630f36b7d
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqaQ/lFTjN4:R5dKTi61VLm
TLSH
T1ADC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9f0f16a046c1d1caf3dd6381668e081a2f1bd45ecdf07259d73fa9e658720786
MD5 fb7f22210439e96ee251a859af721f79
SHA1 905e6dde3216eaeecb0c253acdcd5c6a3b7c64c2
SHA512 7192fa68e1cb87d0e4a568b41246809c158115435168cd1016281c0a89489a9e6d68b3826081791a362dfe49cf5af82ed48c2e90cfcc3bb3d227a210bffeb35f
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5w5Q/lFTjN4:DX2iyphfLm
TLSH
T1D495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ad1dfb3a3c91efc2c5c9aaeae598046601be466ad5d5897924e99159db03960b
MD5 6214c9f081360990dc39537857204fcd
SHA1 fd5bcf3a7a7ccf8e59d227c2400e89c166327b23
SHA512 b6bd62aa45e859ddd733e007033fc89d018d4b9450aeff8c774a0bc46149865b65bc4b0b738e545c25ca000ccae4903bff6f1836e1b8bf38b38337e215717058
SSDEEP 12288:VmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:VGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CE5523687965F98BFA1706F188838182A77F0DC6BFD1A38E77482129967D39016CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 97e42c1f3be821d20ad4376efd01505c92b530a57c115d6f41aa558d8af7567b
MD5 7ce6a30c2cf708a40157d222769516e2
SHA1 e3b18fbb5fa7f7b4df1db1aa3d8ef0558ac73d62
SHA512 432dd7524712834fb1562b4ebb406cb665484f576a30946631605e491a5c91f4847aee6c57cab12b50e748bf4ffd28145ed3cfc653016f66fae04109a5b7bcef
SSDEEP 12288:mTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:mDnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1425523687965F98BFA1706F188838182A73B0DC6BFD1A38E77482129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 30bae01b2d8406e355f8be84b0faf51c140eb24c2147ea614463c9deab21074f
MD5 f3346fd49967d8efaeaadcbe7471641a
SHA1 7a6b51db5157ee64a0e8437be48d587743f4a994
SHA512 c0c815aebc37976bbfdbd5af7c646b176f7286254e98063999a1afbe102cb01448f069e309ff05de82e06d4c4eb09bbf99b59cd781b02a455935017ab38688e2
SSDEEP 12288:OFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:OlnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1835523687925F98BFA1706F188838182A77B0DC6BFD1A38E7B481129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 628d2c9ca3b7ccd9caaf9196073904a32a0803c607025bf1376d325cf7d8ea91
MD5 494351ef39ae7d7c122c1c32bfe4ddab
SHA1 270029d014fb1a469bdd1cd5fa3d6b8e80186980
SHA512 8ebab47de4d90c08ea721bdb0b94c763d4fabbf243bd76d2da488b6a3260efe6ee0ec9cca51c24ac9fc9ab48796e11c4e34f2abc25a9c2eb432ed4d6d9190db3
SSDEEP 12288:uVIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:nnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1005523693669B4C7F92782F4CC938142F77B3CC5BBA1A7CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c102231dbfa4c3e52a34cdf1bd23d790802db63f4423cc3fa2a30df9f3d329c4
MD5 1144b441051142e5d4af90f73596c899
SHA1 8c5bad268011917fb64e0120eaa9711d5bbbc58a
SHA512 204bb333a52b480866609ab8ddec9788597583d2b863e3f14fa5a5401179d231dcf86d42b2f2a4db2c56e64a156746d2ab44d2203fe3b0ab1f679a5c468e8fb2
SSDEEP 12288:1wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:1QnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1995523687965F98BFA1706F188838182A77F0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8acf49ac53e61ca556883d07144f85c595ef706c134a7a07bb5418902c8071f4
MD5 b2d77c11c6797bbf6fc9e0d5b92e44fc
SHA1 858f5213153ada57afa1ea8e474d6dcea6a314c7
SHA512 3b989ce2216e35071d9ee22c2aaf22db50828854a480997fd366afb598fb8594e96012204a766a9c77b172dd85a93a3cecc2f6a573e0ef790082cc01852c5169
SSDEEP 12288:M/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:MfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1815523687965F98BFA1706F18C838182A73B0DC6BFD1A38E77482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c8ebddde905afb5fe2bdd9d5bbf7bd096a5c295f9a1ea785d3932ee0533f3cd9
MD5 95689753580891e4434cbda863b422d5
SHA1 9d20e86f5400b3163a1c5449096e4967cafe6e65
SHA512 22f6a1488ba3437330cc4828c6d47fc2c66fb07dd3db0160c7119a232799d4358ed2bd7a746889866c6de763f9100ec017f77048fd14f59f2a4897df10dcab1b
SSDEEP 12288:I7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IrnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FB5523687925F98BFA1706F188828182A77F0DC6BFD1A38E7B481129967D39415CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 928e6bc8872c9e5ca5c954b6790fd02562d9249c941772b2a6261a35308f84d4
MD5 9c4baf8c7d32273120e96aa22ae4fda2
SHA1 969cc6cdf312289681e7b149a4801625fc6322f5
SHA512 3148ce7d49a4d9514de75b76315505205b1bb25abf88f5a37d90b96ff7de289f2ea8c8d2b17eaca5c039d67dcedbd6b5400de08280ca11f731c2399a976132b7
SSDEEP 12288:yiZwbDzzFEoS2cPvyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:VZM3zFVSOjnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F67501A9B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4d8a56b3e6d1b4f19aa72288b31d535741837533cd245df15f451980aa3efcbc
MD5 6693339ddb4fac27040cbe77faf53dd4
SHA1 ff65f98753d97d8d69a958885c4fdec58f05b259
SHA512 420ea27aa0a7f35cc916184bc604ae39b535aacd33961d8e3512d87552a166824f8b306c40ac68eebc610685dbb004c16abca7676fd504804f7a3d8e9bd4b1e6
SSDEEP 12288:HKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:HKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1205523687525F98BFA1706F188838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 efaa70138f00e22389cc38a0ff8210b99715e4cb475c83f3fce26cd77b5b6f9c
MD5 eb08083696ab3921e84658d1921f1401
SHA1 556e1e34331f1413f1649088d0e8e0dd0a6ec80e
SHA512 93b4cce4e419bbb007a3ed9a3b6ce4eeb37f0227d3cbe2509affaf73259665249b99d9d1b5789a8e2da3853e9fdef35a938ae955666a2264f9120b8e71483e95
SSDEEP 12288:5eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5enQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A95523697564F98BFA1706F188838182A73F0DC6BFD1A38E7B481129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 68fa5aff9c9cc7dbe1e67fe0cf5ba9ac647475def1f0a4e5a39b0d7f813b8360
MD5 6a9362fda959e84489421d149a4b84f6
SHA1 1eb0eef89aa1e4353dd8304aad9e03234bd15349
SHA512 b6839484d55dd139fc6c36e07391549dfe8081551d0def3657e938bdd3a103b9d4c724d64d5408fd7afc65aabef4fb3b19a6f4f1a8d693094102655f3672361a
SSDEEP 12288:jyPz5L83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:OzyXnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D765021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 109f2aff480f698c984594b35863c9c7e79fa481773a5715ccbed6c1832a2b39
MD5 d325b688645cb1a05f1f9db2e71c1070
SHA1 52595e92bbb104e6c6e34a4abc9555fb3f7c0c98
SHA512 1628ed826fecebdcb05262d8db20d13f849aff28eee76f4a1dd6b08161e47137b0d6f54ed145161c9529ad4a5ee4a6a7b153c4a0d85377cf319adc1bc58d83b8
SSDEEP 12288:xKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:xKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1615523697525F98BFA1706F188838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 de5b87517a4b5cdb82826ece85c9cf953f444a505d73a8a094c215aad84f5f9f
MD5 c0b635c39af97e35d36533043fa30247
SHA1 826313bb4109ee190313e46bc084f4f786e72ce9
SHA512 6cbd26fd0b7f01cd2771cf1c8b4a82b5e9a6cb3f1ba6f6667808647db2c67d66a23e3b191a3b926dff573d0c037dd9d7c606fffe1eb12a20726f56f5af2dd96c
SSDEEP 12288:3KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3KnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16F5523687525F98BFA1706F188838182AB7F0DC6BFD1A38E77481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6e6924829e21fecba779062cf47b7d689a3a82ef31bd16aabf7b2c0f31abbe6d
MD5 d50a464cb84366d5418cf11f71aab621
SHA1 31008c8f26625c00328fb33a607d9e13b8b480b7
SHA512 934fa01e2f5c86996dd569bbb620dc217bb8879d182cb0f32dedaa3c52f26f5f4844f13ed1bd3008ce9a777fed679bb6863f7a92d05d537379bcbe22c4914c35
SSDEEP 24576:0CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvABnQ/tbw/2Mkjy6Fr7g0o:0CUxPTY+8Wg2lIL8lrIUJLWwQQ/lFTjG
TLSH
T1C665AE1DA3EC089AD4BB817589518A06FB72382E1B22D6CF2160C33D6F27BD55E79F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c3cce15b7cb5f0f5614b57c8d29919d21d035bd7f2f4b3ca0b05050f756c296a
MD5 9c51601a049130661f84999d26005f26
SHA1 4c4a7576ec2b8278b3ff29f0f4597d320bcaa48e
SHA512 3f43238bdae4702c67c2f7af35f067e6fa5b4b7372a66f5bc57f26b1a3516f75004e074f12779c33b13e7974b80fb1cc82efc5f9678fe137dc468f3c2b599272
SSDEEP 12288:IssfaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:manQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F565F119E29852D9D12E52B5CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dc2b8b29b476a7535cdb385880091e4dd550c3e9cdcc184467b8551385978797
MD5 8fcf3d542a16605c96c0ec9666b2d5c1
SHA1 8f07d545fa21cc78d528f2654191bfbcf32f21f4
SHA512 dbbcf8eb48433f82230edb0e7a367ea2ac49ff7ede5b1a549e6775be1737153a21b216c8d25fe1cc0c57113833b787bd371d74e557e55b71e85a6b1dd02875c6
SSDEEP 12288:AlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AFnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1445523696668F98BFA3B06F048938111673F09C5AF90D7CFBB442269953C3D01EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8f18153afaa3f0d255e0f120ddd0349235076bc2561055b081a50afb574248a6
MD5 1a79070ad4adb26980b18289a616a6ef
SHA1 19abbc1c14cce0de912592739f23687d3e1aa1da
SHA512 f203008b285050c2dec9e1b0ee8b56177feddc403279995b355f3d62ba5eb0d96c6f06e5b1cd3365c9ba2eaa56fdb914b254ac432405f33c8901cc4175a61901
SSDEEP 24576:I8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCHnQ/tbw/2Mkjy6Fr7g0o:ZRZwQCyiHiQEaaPnMCQ/lFTjN4
TLSH
T1BF85B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 cb76907d98459dcc5e494fa90b54077b150dfda350b8d3490240a8af04667400
MD5 ef9a13f2374900096570d4baa430dce1
SHA1 98a9a890ed35b69a3bfe27b9d02b2f37b0900920
SHA512 b13babe3ab929d89bf403f05cf47aa16eb13b5b2048e2599b13a04672cdc7cf0cdd1d5713e21dba7eb34672fb486301fcc6f34ec7e68b216f9a0c56dc9db2955
SSDEEP 12288:NbxA1U7KVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:NbxA1UG1nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AD55123E26AC24E6F536957988C28106D3327C56676193DF22C4823E4F3BBE45D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 50967ef29d39438b10598902b2cad29d3d0f7d7cc9a3dca17a7fed2101f6bcca
MD5 db5d4a5f38c0a112c1395f6aaad300ae
SHA1 c0087ecb4be3a3b5e960df9b96f17e89a41d5d51
SHA512 59103e61bc0ea4d500638c4f9e05c45266646d287bbf72acde4c6004bcdacc85fca7518cf2aa3dd24846e67f49dee59438e8eee831d4f6deb2df80e9697fafe8
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrn4nQ/tbw/2Mkjy6Fr7g0o:hjRP0yHfVqzlAsrn4Q/lFTjN4
TLSH
T1B645AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 74bdc110ffebc43d7d24f03767b561dec8e385c1f6382a2c22300e96dec427b2
MD5 3389356d886edbeeea60cf79fcea53dd
SHA1 4c2149885df29b0b9af41e583285db1da9985ec0
SHA512 de609cf753001b6bcda481bd6651dec4db2ec6b6dafa83d7e2fcb9331a1f130f9fd7e1d8e063bbe7a82196011fd9a6e88918f0a758674fadef816e522f79c217
SSDEEP 12288:sfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:s/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C455236C6559F98BFA2706F548838142773A0EC17F91A3CF7B482229967D3D41AFB780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 79c0a7b77f56c2a5f1174da6cdb2837ef3e6df9591f44ed11733e63d64f92242
MD5 533b7832504b345585c62bee2bc12741
SHA1 1ba4355a26408789d35fd6374fd267db144f89cd
SHA512 cf5a825936dd246b55262472e5e814969fed0004d57e4f74eb7c9056d9d6c991a1c08f87e19eb6fc427b0b4cd5575ef5ee2ce77f17f98a939975177ab8e8b37a
SSDEEP 12288:UOb4A4LWO+vAYFTpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5wLBUT5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B575F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a578e2d5a54bc42fd07c256272d778e5ee6e7937fe461f3c88cce85d9c79d2ca
MD5 be2872b44817300441a2e267acf4da73
SHA1 90b3ce203ccffdcfb846709e76e93dc1922f1af9
SHA512 cd5c7f0bafb8c2c6bed01c0c6f3fb1a0941a9aa446ed9c1f04f688dce5d0567425b742b00908fca533a09b664e76c20375e1e0b8fe8a01faf70397c576244be4
SSDEEP 12288:j70VmuIYNvUyBp2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:MKYNHsnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CE65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F27BE87D3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ea441243d900d26ca6a2651dbd05f50e9453b263ebd07870fbc01c38ffe8d597
MD5 f3846f2f42c295b2f769dbf258ce3db7
SHA1 d84366e673041a662cdf1937c8d4616ad4e794ce
SHA512 2cbc22b96bfc9544c252eadc997a4028f94ff18c0b41d5a356a69f2494e66a44d4de798ed07992db1d41d8cd81ec84f142a37c88068fc5e733dad215b15b0fd9
SSDEEP 24576:lnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKr:lnXoJJYH84VVS6AmEcJas+cHBjSSKHPb
TLSH
T1AF65BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1dfa7a32ff8d45b9f851775f7ff6f5fa4600311f3a74f9445b0bb71edcd8be25
MD5 eb5785e87ab65ab0f193959cf6810e4e
SHA1 deca54fb73dd52aff57e32ccabbbbe2228e35212
SHA512 4c149ef121e53262ac22a80c49a5ddc6bbc0cb087d1349bea1b9e83ea03e6a673e7e3c2d0edb73367cf1fe19dce2e5ee51ba419ab12920263b647092171888e0
SSDEEP 24576:rv7Xbxd9Tuycf8M/TYlSuxwr2PCOnQ/tbw/2Mkjy6Fr7g0o:rDLL9TuJ0M/TYW2PfQ/lFTjN4
TLSH
T1F4858D5EA2EC52D8E47BD6BD85A39047FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 bdcb79e06196e4b4f55f3ef10f717d58aa27924006e7b656963ec4f667129edf
MD5 6bc3bd65702a88c14f04758cce3a2235
SHA1 e064164f2e9b38e2d5f8e3c6fffea5256cbdc9f4
SHA512 f8c39ad89460ba07b3d3afa161f5327f579e2e40079b56734a5e7b49a0813ceb23cd97542c905af27de50de776797e565b01da984c9f0a2fad0c6ea0a597bf8b
SSDEEP 24576:kegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w5nQ/tbw/2Mkjy6Fr7g0o:kngOJOmPOHh5Q/lFTjN4
TLSH
T13655BF3FA7BC15D5E03EC17D8A938916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 fe3dd5c651b82f792fcbeb91579a522d8508460f4cee2c88e557a43c864327ed
MD5 78b09f79175a94fcfc5d40a796ee6c12
SHA1 e5775d2b44e15b3d475385239797eccae3cb71b7
SHA512 7416966d11e606626dd9b8599517fb0744ab20c07ee09821cda2f3124296b8e9e3d1c272cd7ae86294ff253285a5c0dfcbdb2cc2ea06f1044d962d2469b0b192
SSDEEP 24576:cLJnJiTk3R3waE4JrOfnQ/tbw/2Mkjy6Fr7g0o:cLJnJK8R304lIQ/lFTjN4
TLSH
T15775D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b90e9313c2aaa2c38b78deecf60a306e9013d0e7fe6462f1e48cf12e0c3dc1d9
MD5 1cdd4d01024b8960d88c3c9e43abdf7d
SHA1 1c7d5465e7ee0d56ad9a29a2f80aa9b32803e316
SHA512 09045a9cd27f0f9fd0b58a8363c21255c8e491a36101c971e4474856066ca9184b73f47dfed8f28030dc8d3415b46fd4e655677178853df0ba07255fd7d4908c
SSDEEP 24576:vA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pxnQ/tbw/2Mkjy6Fr7g0o:49GqCzDScAZmlvTcFg8Ph6rQ/lFTjN4
TLSH
T169955C15F7EB5298E8B3CAF1C96294159B327C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ad4d21770b03b12cb16887d2d77388b84fe3ffe6a2dd61a14d91c46b2d85b5d2
MD5 b7aaddcaf0ec02bc97808e797c4eb23d
SHA1 3f88b53322c3d2d66724192fae1c47c026999f4e
SHA512 1efaf646fafe9bd9bb3d1ddbd9e81168c7bc83066058c1488f80a584c357a6ee6bd99fb793609f11ea5f2fb41851cf7a793dc53be8e5503faeca173f6afb51a8
SSDEEP 24576:QlYJeXm5jUuEpnQ/tbw/2Mkjy6Fr7g0o:QlYJeXmRUuEpQ/lFTjN4
TLSH
T13355126D366C70E6E22F41B988928541E372B4A1275163EF62D0C27D8F7A7E51E3DF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ca9dbe0f8864419ee53016a7e63ab31ab94e8a2f5478b298549e0f407ebd4d03
MD5 7b9594680fbe4f3ddba1d34071aa0f3d
SHA1 1df3cf78850ff686f7ca29122a959776135ffca0
SHA512 b97df73416c7c4543574150b77612c14ff02d4b324c588fe7ef2a363a6e513b72851c4a39c24125f4967bae8106968f88349bf365a76f6e9b8a3162e1908964f
SSDEEP 12288:fFu6kyYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:fUtyYnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1686512183394B4D9FA7A0678CDA38191AF3A7C50AF5093DF66C0E23E5E3A3D06975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 813f274fc4356c8b160c8eb93f5926aea9aa220c54aa1299d68e2024463b4b54
MD5 50d78156ceb8e93c318cf7e677d7f74a
SHA1 14f8f46dbf69dfbcb519e222262e97ffbfe31b62
SHA512 f1cddb08451b420016d27fc2e9cfed37e5c2929a8d73aeea9e5cd46ca9eda16c9be5022474c9e6b26b58d6ef877025459f6e31ca084af360f121ac27906a6a0b
SSDEEP 12288:YPpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:o5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A055236C2624F48BFE2706F448934542A77A2DD17F91A7EF3684A139CB7D3D015BAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 708d4dd4188e50406302ee48dece125bc709c21a2247038c5e04829950dd8b98
MD5 ed05687521c0c84450ec47679104f8f9
SHA1 540da46c48bf28db80f9d5ed0625c761215bde19
SHA512 3a594711940110d5c4d8d96e5a9f777fb4bca4dc68ee14a5c12752f89711f367296d725652dc5adc01e2bdd220bbe47c01c09637c864b086e7fd916afbd5809d
SSDEEP 24576:JC+TyQIu93VAumZr7jm6nQ/tbw/2Mkjy6Fr7g0o:J/TfIq+Y6Q/lFTjN4
TLSH
T196558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 27c2ce6db19b6196d5a1d5926b94d55ceb72d1fb52ef4ce68162d3e71c124640
MD5 c2190dc5c0a65eef1b9cda136e78e2e0
SHA1 6a846a35dc1f993224a739b580b70b4cb2f44d76
SHA512 5964e30ced7fceb5096f7c3c10339fae3da051a9797ea3846e4e72b281483e36458146995257486bc5f3e170f37e1a62373f2ab9539931cf7d0dc1d5b67db017
SSDEEP 12288:WcyrWOstaa3kcsdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:PLQikZ9nQ/tbw/2Mkjy6Fr7g0o
TLSH
T17565F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9fa4a25dc2f6b593c3af00b317de535df36d8a69ee97355df06fd8a76575d548
MD5 e6a3117d087dc6f2800590a27a932867
SHA1 24673e8e773dae5a99bef51a6f921fa55a568f71
SHA512 f21be46553e286ffeef5f3e477ba7be6c7a0d9d490f763e50b2d9c214b31872d914add4e0ddcb6edc60437afc52e6e83387c5d09fcc1aa65ef4fa0db421e59ad
SSDEEP 49152:3pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPYQ/lFTjN4:8pC7b4+80GTkYLm
TLSH
T118A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f8e55f34944fa497080f8efbaa077dcbf81e473695fcd9086ae659b933b75dd4
MD5 c1c15c7bec592f1f21d1f55f7bfeca56
SHA1 0fd0b39ede9c777add22e14fc316429a1d18db47
SHA512 38e3c5e676b7b3bebc4691b0ad1219f8f02484c0f4d5256f50a30c4ac5809794e0c16921e5fbf064809d991d8446268b5d694e1acfcecf976cff45b8a5b7ce7e
SSDEEP 24576:zSAwJPE1IDAo+4Kt+l44135UQwnQ/tbw/2Mkjy6Fr7g0o:zqPCIo4Kol4/QwQ/lFTjN4
TLSH
T1B855B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 d012b2ff9f3d2e80c0f6f2c18721be41f3a8128d970095175521cab8598d2461
MD5 e51d5ed458ef3068f900782973c8974d
SHA1 5c8d95b35d2a31fd1e31c02c6f377d5dd634f141
SHA512 6138c5fa340363d6bb58c3329fe34f8d11ca16309c1855c8ddb34c5a2bc9359ea6aee77fdc3e01f7ddcb984ab60285b8c57307a479609279d974accba04115aa
SSDEEP 12288:fSsyLCFBoPLCRys6NQ4tAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TyLXPLcf94tgnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18975E03EE66C08E5E57AC27CC6A38506F672389D037166CB169091791F7BFE4693EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 1cf14a929ffaf8328145eb28619f84b7da389b6e8e1ca6d8256ebbb1a5eb1a3e
MD5 50500860f1dfd2cfb80dd8ee31a2272f
SHA1 f7400c6425f4d8b09ebae489a9c94e92de1e4cd1
SHA512 d767fa6a50277a95d74979a576af1f3484b6c8af1c3106d6a03beceef32f12d941adf1c4ad6ada5f32e4e7f0a8199de00fbc292decc236527550c31c630cde24
SSDEEP 12288:+9lyvj3IkxjbBztGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+Wv8qjpNnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C465125D26A474D9F53A43B4D863811692767CB227A4ABEF72C8D17A8B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/444-33-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/444-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/444-39-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/444-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/648-376-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/648-172-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/868-101-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/868-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1156-166-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1156-102-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/1156-108-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/1156-107-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1352-373-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1352-163-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1408-406-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-380-0x0000027D79E70000-0x0000027D7BD8A000-memory.dmp

Download

memory/1408-401-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-400-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-410-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-399-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-398-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-421-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-420-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-419-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-418-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-417-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-416-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-415-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-414-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-412-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-413-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-409-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-411-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-408-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-407-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-402-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-405-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-404-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-403-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-386-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-387-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-388-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-389-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-391-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-390-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-392-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-393-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-394-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-396-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-395-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1408-397-0x0000027D7C410000-0x0000027D7C420000-memory.dmp

Download

memory/1568-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1568-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1568-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1568-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1688-226-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1688-120-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1692-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1692-162-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1692-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1692-98-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2140-68-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2140-153-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2296-17-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2296-26-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2296-25-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3216-145-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3216-135-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3216-141-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3368-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3368-155-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3700-77-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3700-76-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3700-83-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3700-158-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3760-74-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3760-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3840-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3840-182-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3840-117-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3868-67-0x0000000140000000-0x00000001401DA000-memory.dmp

Download

memory/3868-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3868-8-0x0000000140000000-0x00000001401DA000-memory.dmp

Download

memory/3868-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4252-128-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4252-131-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4252-122-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4252-308-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4356-152-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4356-367-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4428-381-0x000000000BE30000-0x000000000BE38000-memory.dmp

Download

memory/4428-384-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/4428-188-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/4428-180-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4428-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4428-224-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/4428-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4428-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4428-204-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/4428-382-0x000000000BE20000-0x000000000BE21000-memory.dmp

Download

memory/4580-116-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4580-167-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4856-168-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4856-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4944-69-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4944-64-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4944-71-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4944-61-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4944-55-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4996-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4996-159-0x0000000140000000-0x0000000140147000-memory.dmp

Download