Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 04:16
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe
Resource
win11-20260513-en
windows11-21h2-x64
24 signatures
150 seconds
General
- Target 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe
- Size 10.1MB
- Sample260529-evsdtacy7w
- SHA256 3b23d93bd77ac819f2f7d9f6380c6f778e3b2ccc578e32244ebc52064fffa0a3
- MD5 9f2bb570cf0d7a198834208a046c6eb7
- SHA1 3c9e248ebea181b85a0f53d3ad917403128fc5f2
- SHA512 ef6c5ce2967245a5c59c1ca275adbfd84ed963a6d5f938b4b75e33f81d64be1d2649a79a29afeb9d48178c8f4cc41336071831ca953c8820c02ccbbcc92aea28
- SSDEEP 196608:PwTi/4hvRad8AOwj30of9lN5hitTQbWK10o+jGH9wM4j75b+gVk88gbJCDDF4Fye:Pq2evRad8vwjkof9lN5hitTQbWK10o+E
- TLSH T1DDB6BF6A72BC00E9D4AAD178C6575227E3B2785503B197CF16A496EA1F37BE00E3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4496 netsh.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 23 IoCs
pid Process 3512 alg.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 1152 fxssvc.exe 2520 elevation_service.exe 1688 elevation_service.exe 2636 maintenanceservice.exe 2076 msdtc.exe 4340 OSE.EXE 1332 PerceptionSimulationService.exe 4032 perfhost.exe 3720 locator.exe 1524 SensorDataService.exe 4600 snmptrap.exe 2748 spectrum.exe 1980 ssh-agent.exe 4024 TieringEngineService.exe 2500 AgentService.exe 3204 vds.exe 2300 vssvc.exe 4604 wbengine.exe 4508 WmiApSrv.exe 3500 SearchIndexer.exe 4780 ASUS DriverHub.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2606948ee7fc2e30.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin spectrum.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\ASUS\AsusDriverHub\ASUS DriverHub.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe -
pid Process 1760 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072e3a5ed21efdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bf215ee21efdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3a4e8ed21efdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ba407ee21efdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043c84cee21efdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf} ASUS DriverHub.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf}\LocalServer32\ = "\"C:\\Program Files\\ASUS\\AsusDriverHub\\ASUS DriverHub.exe\" -ToastActivated" ASUS DriverHub.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf}\LocalServer32 ASUS DriverHub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf}\LocalServer32\ = "\"C:\\Program Files\\ASUS\\AsusDriverHub\\ASUS DriverHub.exe\" -ToastActivated" ASUS DriverHub.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\{6D809377-6AF0-444B-8957-A3773F02200E}/ASUS/AsusDriverHub/ASUS DriverHub.exe\DisplayName = "ASUS DriverHub" ASUS DriverHub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf}\AppId = "{9174166b-1133-f6e5-c35a-a75eed7fbabf}" ASUS DriverHub.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\{6D809377-6AF0-444B-8957-A3773F02200E}/ASUS/AsusDriverHub/ASUS DriverHub.exe\IconUri = "C:\\Users\\Admin\\AppData\\Local\\ToastNotificationManagerCompat\\Apps\\9174166B-1133-F6E5-C35A-A75EED7FBABF\\Icon.png" ASUS DriverHub.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\{6D809377-6AF0-444B-8957-A3773F02200E}/ASUS/AsusDriverHub/ASUS DriverHub.exe\Has7.0.1Fix = "1" ASUS DriverHub.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf}\LocalServer32 ASUS DriverHub.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID ASUS DriverHub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9174166b-1133-f6e5-c35a-a75eed7fbabf}\RunAs = "Interactive User" ASUS DriverHub.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\{6D809377-6AF0-444B-8957-A3773F02200E}/ASUS/AsusDriverHub/ASUS DriverHub.exe ASUS DriverHub.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId ASUS DriverHub.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\{6D809377-6AF0-444B-8957-A3773F02200E}/ASUS/AsusDriverHub/ASUS DriverHub.exe\CustomActivator = "{9174166b-1133-f6e5-c35a-a75eed7fbabf}" ASUS DriverHub.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9174166b-1133-f6e5-c35a-a75eed7fbabf} ASUS DriverHub.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9174166b-1133-f6e5-c35a-a75eed7fbabf} ASUS DriverHub.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\AppUserModelId\{6D809377-6AF0-444B-8957-A3773F02200E}/ASUS/AsusDriverHub/ASUS DriverHub.exe\IconBackgroundColor = "FFDDDDDD" ASUS DriverHub.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1760 powershell.exe 1760 powershell.exe 1760 powershell.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 1808 powershell.exe 1808 powershell.exe 1808 powershell.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 2656 DiagnosticsHub.StandardCollector.Service.exe 2656 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Token: SeAuditPrivilege 1152 fxssvc.exe Token: SeRestorePrivilege 4024 TieringEngineService.exe Token: SeManageVolumePrivilege 4024 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2500 AgentService.exe Token: SeDebugPrivilege 1760 powershell.exe Token: SeBackupPrivilege 2300 vssvc.exe Token: SeRestorePrivilege 2300 vssvc.exe Token: SeAuditPrivilege 2300 vssvc.exe Token: SeBackupPrivilege 4604 wbengine.exe Token: SeRestorePrivilege 4604 wbengine.exe Token: SeSecurityPrivilege 4604 wbengine.exe Token: 33 3500 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3500 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3500 SearchIndexer.exe Token: SeIncreaseQuotaPrivilege 1760 powershell.exe Token: SeSecurityPrivilege 1760 powershell.exe Token: SeTakeOwnershipPrivilege 1760 powershell.exe Token: SeLoadDriverPrivilege 1760 powershell.exe Token: SeSystemProfilePrivilege 1760 powershell.exe Token: SeSystemtimePrivilege 1760 powershell.exe Token: SeProfSingleProcessPrivilege 1760 powershell.exe Token: SeIncBasePriorityPrivilege 1760 powershell.exe Token: SeCreatePagefilePrivilege 1760 powershell.exe Token: SeBackupPrivilege 1760 powershell.exe Token: SeRestorePrivilege 1760 powershell.exe Token: SeShutdownPrivilege 1760 powershell.exe Token: SeDebugPrivilege 1760 powershell.exe Token: SeSystemEnvironmentPrivilege 1760 powershell.exe Token: SeRemoteShutdownPrivilege 1760 powershell.exe Token: SeUndockPrivilege 1760 powershell.exe Token: SeManageVolumePrivilege 1760 powershell.exe Token: 33 1760 powershell.exe Token: 34 1760 powershell.exe Token: 35 1760 powershell.exe Token: 36 1760 powershell.exe Token: SeDebugPrivilege 1808 powershell.exe Token: SeDebugPrivilege 4780 ASUS DriverHub.exe Token: SeDebugPrivilege 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Token: SeDebugPrivilege 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Token: SeDebugPrivilege 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Token: SeDebugPrivilege 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Token: SeDebugPrivilege 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe Token: SeDebugPrivilege 2656 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4780 ASUS DriverHub.exe 4780 ASUS DriverHub.exe 4780 ASUS DriverHub.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4780 ASUS DriverHub.exe 4780 ASUS DriverHub.exe 4780 ASUS DriverHub.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3468 wrote to memory of 2704 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 82 PID 2704 wrote to memory of 4496 2704 cmd.exe 85 PID 3468 wrote to memory of 4680 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 99 PID 4680 wrote to memory of 1760 4680 cmd.exe 103 PID 3500 wrote to memory of 4840 3500 SearchIndexer.exe 111 PID 3468 wrote to memory of 4780 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 112 PID 3468 wrote to memory of 1808 3468 2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe 113 PID 3500 wrote to memory of 3788 3500 SearchIndexer.exe 114 PID 3500 wrote to memory of 3280 3500 SearchIndexer.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_9f2bb570cf0d7a198834208a046c6eb7_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name=adu.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name=adu.exe3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "New-NetFirewallRule -DisplayName 'adu.exe' -Direction Inbound -Action Allow -Program 'C:\Users\Admin\AppData\Local\Temp\adu.exe' -Description 'AsusDriverUpdate'"2⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "New-NetFirewallRule -DisplayName 'adu.exe' -Direction Inbound -Action Allow -Program 'C:\Users\Admin\AppData\Local\Temp\adu.exe' -Description 'AsusDriverUpdate'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Program Files\ASUS\AsusDriverHub\ASUS DriverHub.exe"C:\Program Files\ASUS\AsusDriverHub\ASUS DriverHub.exe" -driverhub -notifyinfo2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-AppxPackage B9ECED6F.ArmouryCrate).Version"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3512
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3288
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2520
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1688
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2636
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2076
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4340
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1332
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3720
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1524
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4600
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2748
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1980
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4544
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3204
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4508
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4840
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2816 2688 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:3788
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2852 2828 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:3280
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ada1b43236ad8d27c698a02e9ed6f0768092f5250fc4228485988a555ba88542
- MD5 6cbfbebacd3d8a5c961bb400a9febb31
- SHA1 570c2a2dd607b68695dc0f9aec132de6eb735238
- SHA512 e44f547a2e8ae655de3616eb223c4432ec0f3d2a35818fb3fc9d2bfe8f9b08a47c8b6751350fa363a66ecfbaf2ebd503b159bd2468f8000312bce88eab7de003
- SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWQ/lFTjN4:+3q6HjBiLm
- TLSH T14DD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 597c010a4abf3a858664fc5c6a0bb31eba1ebdd17dca5bc225dacac8ebcb277d
- MD5 708a3044bdbc229d880342ead0d07384
- SHA1 119445b37998e94827ea10b574416fb055855945
- SHA512 e215be323852fa3539b54075adfe57dd104920953fc75b6dfc9ff9e8ac62b5ab0ad1468da0b859e513cea886e9b4d96b2ec2026e9bf7a466d63d0e945a2e561a
- SSDEEP 12288:Z1XLsswWkxy2lRq2czAZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:3XYfDtczApnQ/tbw/2Mkjy6Fr7g0oB
- TLSH T14365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 1c4d4fc711f87fbcd0fbfd163b8ca9a30b47746ef2e98cc4f3fb5f80ce137db6
- MD5 e9b2e7b4b34d6fb9f8b924c1d593615e
- SHA1 b2d43b3334e4276d28e2374d6c62512fba2a9788
- SHA512 0a0b7558f91bed86802e9ad0b1c07a29c1346be5e384ffcd95c0c9963e5ea591c41e62a5f453c0d45793114c8041515d4dcef59f646e496ab950e37b7de4b6bd
- SSDEEP 24576:Q0Le5ji0hmxLrMunQ/tbw/2Mkjy6Fr7g0ow:QPji0AlvQ/lFTjN4
- TLSH T17C859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 178801d850e316d1e69c287ef20569012e818f04cd5ed8e2d8427ba9231321e6
- MD5 bbdc5c4c3937a858f53e9ad69948687a
- SHA1 95d3f1c893e90d991fa271743a3aaeedd709597e
- SHA512 f7ec933d31fef8d81c762de9c5287ea2a621aa812b6fe2c7e9361776018aedcc670ad86fc0094361de0aa4ed8d11dd435c5fd0da5e1899b522853ed208c6a7e3
- SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyuYnQ/tbw/2Mkjy6Fr7g0oN:M/ezSC6vUzPvxHjyLQ/lFTjN4
- TLSH T102755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a4706ac110256ca8a1deee09e6a443415ba697f397fff33f3bfb4d59475a3a32
- MD5 0d17575081455724f815a029e308738e
- SHA1 b133d1a854b910eaac3a4923fbb46ece5e54d7ec
- SHA512 0c959792f3470ff3ebe839efee84f79d44402899fb2761b545251eb39c0538a7159cbf42c21799c47a96e24f66e481f28e390be22b1be4da81f3d25b2d5083c9
- SSDEEP 24576:iVbqPb88hv/l+69nQ/tbw/2Mkjy6Fr7g0oh:iVO88hXl+qQ/lFTjN4
- TLSH T1F7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 421e92fecada1e8b16c3b6e78b0a43b489fe47d84e695d6f16e5345cdcbbcf91
- MD5 6ba259a77a1c67ec200c6d2bf1323b4e
- SHA1 5789391f6773fa3ee617911102b5d1e67079e765
- SHA512 394b1ed0e468f43a97791bb0e6db238612772e2388345745479fa6c7b08a03e24d96c6922d658fc0bbd74f7c6804c54759bec5c0adadc9411885652dabedd9c0
- SSDEEP 12288:DzSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:DzSnQ/tbw/2Mkjy6Fr7g0oA
- TLSH T1F55523796A24F897FF2B06B15C838482AB3B0EC1BFD4A74E6744322D857C39446DB385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ASUS\AsusDriverHub\ASUS DriverHub.exe
- Size 486KB
- SHA256 9598f60564340d2e495c86ea172864c7268c38a84f374f42823dcc3ceee23cce
- MD5 8e413a9ae53990c5a1c62eef35888880
- SHA1 23e4af7ce4cfeb2dbb7a741f5e484eb6f9e0872b
- SHA512 cc2c57b9bc615f491bd80963abb5c3e23a4cad33f39afdd3d63f06654078298eb4dae4737a95353e83ad1b05838b50143143c2e069bc91cde95cf65785823601
- SSDEEP 6144:+ffmr9yvSCKmvoiAxNabaSbaCBtzCDszZZ3ApADkiikDiw3+1af761+rCabR:SfuySxBSbLBDz3ApADk9PgzV1bR
- TLSH T128B48C1633A8C595F64F4732E87035A5667BAE2EFB12E6C6148CB91D30F2745C2227B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 f6b1be25e04644b415b13c3f5654f430ee69f5764a72b235416f17f0233b5cb4
- MD5 dfd83160d541eab6e637b162e2094d9b
- SHA1 c8e418ad6a01f04345fd5c9eb37cd5434c52b062
- SHA512 9e5816ceb32ea7c5294cd8b72e242de986d3c0b8a5895bc5f4605f31b5640e4f05c4acf39b8ea249e18e870abb56f2c960aee2fa7b1f33da2e202fac270cfc2b
- SSDEEP 12288:5eBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:5JIU1nQ/tbw/2Mkjy6Fr7g0oR
- TLSH T14775CF3BEE28FCD2C67E4DB85A918640D77278704F61A3CBD164820EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 fe62e9768e5a16a8e849d917349caff85f11a926b3dca30ee3939f231bbffdec
- MD5 e3668b4f14d8fc6d795e851e8215392f
- SHA1 04fef10ab0f30b13f3f7993203c0e6570f21f4f1
- SHA512 851487696058917e4b84e3bf1af66181b85a439120e1ce96956093339165d4606323bbce94931ebca9ab368739d3fa113a2823a7e209304462a1101c084c7324
- SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:3QvGAdlCEL8c/yRNw5CLLm
- TLSH T14D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 2e48328788b1313a1e4cbeb9178c05fcc2722b7f3beb7b26ad5ff117c3cc331c
- MD5 76487a188456439dea9bcce78f95b473
- SHA1 c26c80b997269f8223b03dd38358270b5b10e94b
- SHA512 499d348e89c04c41e1d6b9cd147638409a3ea94f21b3f971a120bf0e6b39e22cbb00f4ae4a99988367ab4be26601c018fa92f6ef722540a4be72c687ea1c0048
- SSDEEP 12288:sAwSfxL/2Dc39DLLmt0LDQewsAjfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgf:RQewsAj/nQ/tbw/2Mkjy6Fr7g0oF
- TLSH T12875E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 2aeba4de069d183e1176deaf1040ad7d76f0e3466af0fc983441fd44daa52146
- MD5 1f21b1e1c8d5b3de32108ed23d2107a1
- SHA1 5d836b2ac77eb8f21cfabb1cf00784ec0e78691f
- SHA512 73d0dca4e7ac06e7c561be491552fc895c5b35f0cb1fe5fe1a73ff59b78e929672d72201e6ef1add5a95e5b320926a6ea3f11006d338d6d31a104963c78733d2
- SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHML:iUEtQevvqc2W1cpV2EI32
- TLSH T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 0eece1d16ee3740422b6a564a7e2af9d89dcb0a2430e053f87bce202de01b990
- MD5 7d55075ed7dd7837f395acdb7ab52783
- SHA1 9708b5b4bf0612cdbd17bdab6617f44cc913d06f
- SHA512 19c36d80f725c67d0e41ebce8f61893159045225c168a0fb010fc62e175ffe8b79d4475576e20c2c1e97efc32d20037f01b680cb723f6ae86ac351790c19a175
- SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zfQ/lFTjN4:WoqtVjnmXLm
- TLSH T1DED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 29a851a0bc48211b7cb37531a7cd3fe05c642545d61a0fbc771c718fd4c0d5fa
- MD5 9a87041bb28c63b5ffd692f33b43518e
- SHA1 913b08ed5bfd81b7c7b8d83cc9652c85baad829c
- SHA512 b56d3779d36dde42093059b335e298d000a60012b604cea0b9fd808b4d7f77f7d6e1ec01de3823a14028bcde20a2a2ed53a0daf2708bedde937329048b6e7ab1
- SSDEEP 24576:QAhGLJIFoiwtA5l7S53EnQ/tbw/2Mkjy6Fr7g0o7:QAMyFoiq50Q/lFTjN4
- TLSH T1F335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 46b3b153bbef5ea772b3cfbd374fb953372c86527ff8e0da3a2a0596e57de484
- MD5 6a25a77e079ad2dd97f849b6bcc52bd6
- SHA1 9ea35b2548122e619ac8bd8a981c41283d22f278
- SHA512 fd5cf0a1fec162316527af3d9dff90265326af6dbd22fd98bcf5ca65a9c7aaa056ae5b62575a8460a2be9fefba917c1325370d09e15c17a83c04296cdce1b240
- SSDEEP 12288:Rmw5HEjsChN2BFgl0WDm+C4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM8:MwuHOWrnQ/tbw/2Mkjy6Fr7g0oB
- TLSH T1A565F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 601796d8682d524ddc0642589ee8fe6e7d8fc515eeba543f4858b2af05fd8654
- MD5 dbbbca0864e25facdc8ec7bfae4ad66a
- SHA1 b07bd1b9b6d4727784bd3fb2e4c8b0e23b220774
- SHA512 2ee069783062d1062a680c99be175107e8a054ca2081441973d4eaa75fd3ad96807e065ab6bb0c0ed51eac5c0482a3227e31ed40485227bf2d91f493de2b232c
- SSDEEP 12288:mXZ1IyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:2ZumnQ/tbw/2Mkjy6Fr7g0oI
- TLSH T1D755126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f62579f1108e889259e19860b7e77e28892e00e2727f75ef3fc0c48237bf23bd
- MD5 122e8e70864b044f525a3bc919c1bc77
- SHA1 b2c8b0e20d5a44b66262e97b6d5bd6297cee4041
- SHA512 b7d11b35b9a1ab76a8e723ac51c7e4a4bfaad385a8fe61f5e2ad6c61896dea9b3a0ae41e2d27af61bb90e860dd10264273f5d9ece276fb29799fad82585d0080
- SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:cQRQyi36YOcPQLvw2gAf+PN3mLm
- TLSH T1FF666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 1c7bb5ff62ddeba92f16d5e3e6207f623334163caedb4f1709a80202f6527549
- MD5 671fd1ef36e364e6b45116751d6b7c17
- SHA1 be6acec4f8f9df0aa899833cff85e2abacb44433
- SHA512 43bda4aa1f9841edca3214dca318bcbb5e79001b64920d28e5a62031d2636bdb7b910a02591bb87fac0e65311301aa796541e560aaabb90573c9965fc94ddef9
- SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:6QRQyi36YOcPQLvw2gAf+PN3mLm
- TLSH T1F2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 38a33c2e601f24ae235bf3110dacfc38fc98f8c79356fce26f6d1bb2d9922204
- MD5 c790533a89ec4cff97ea8d027fb314e1
- SHA1 366662890b87616ef37c3d3a6b8b2da5ee7973d6
- SHA512 7b45b2af7ba060b3481d54b01bddf134d797d257690cb4d2312050a019cb1ebf6727bb4e1073a48c723fe5d39810628f3fdfa8af9466e2b1c6fcb5e17b2c88e5
- SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WnQ/tbw/2Mkjy6K:068Qg55nhheWu7PNU3/vQ/lFTjN4
- TLSH T1FCB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 88976487ca217218c6fe6835f6bfe8cf385d087189a3383c30f4e34b966c6753
- MD5 49caee01b8f1dbd443752103e53f28ba
- SHA1 619c1953279525afa298be4188c308152b4b0e4f
- SHA512 601309c72122f8660e9d65ea9baa562d4c714d11a28ceba0da75b2f575097ea055556b4098075a1a555df02860430911bf5425b1b4330449f28f591f28bb6e0d
- SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:6y5112gYy5azzVvL69nLKnhZdLm
- TLSH T13C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 dc9ab58f37a6fa1540787068456a2c768a1ba703a1114799ec5b1093d0870859
- MD5 14d05596e1f2a31d93fb8b99e75952a7
- SHA1 49f2299eb0c18010dc99a4dba0d24d97b95f1056
- SHA512 8934eecd441a0bce05047997f41149cb5a58aa5d45a1edf04b3b78e3d62999b7ccb89ac2288e8eccc544546fcf711f77091d77e863fc70e0171ecf335d69cd7d
- SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZQ/lFTjN4:Lu6JmVxd2dOLm
- TLSH T1EFD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 735c10a95665209e6c558687b741591ac1adc5ea398ecbc404e098020eeb7658
- MD5 4a5a7c0068282a3ebce1886bcdf8ce51
- SHA1 f22cb7afa4d5897c0dfe3399ae789bd11399f933
- SHA512 19e139d7ee888b625c763bd30f08efc926c90013d09de0eea6c119fc7056d2c25f6311618f5bb27a128b22c832f349c6c04371a884b16ac806861640c54cb8b9
- SSDEEP 49152:u1hpsNoJpF1A6UU44CwH7R4xVQ/lFTjN4:umifPbRXLm
- TLSH T1D8B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 587d80fb16487464440f37f91a293e5e1e54a2415c8fe1e27a0c3b682fce5084
- MD5 8faa86b824d1e85e68ae7fda49a5978e
- SHA1 fc62f79bc16db0fe63f58b4106ac4b24d7fd4b2f
- SHA512 ce3b9eb9be1e04feb2beec6b30a380cdcad1cef7d1662c4cde1bb02e9e15c4a8ccc03d1169eacb6cf954f451d1bb0ddaf235bb7d5caf0dd5e800fc238b626cb5
- SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqmQ/lFTjN4:L5dKTi61xLm
- TLSH T1A5C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 dd0c7e1a26caa6f0e0fe4c34081fe89033197e990ea08bc10572c68dc6c7b7a9
- MD5 00e5ab4b4fb4768b12068b37efb9ef80
- SHA1 13e926f0b25a9f594af503a7caba1fccd4ca2ff4
- SHA512 7eaa5d67df5531b370e6d2928f2b0a7e51ed5a3026b1b8a4f1e8691b441d88403a60f40d8e26a7debe4b7174aaf636f7428be33c3c88227042b52add4889ec03
- SSDEEP 49152:whtSn8EApI0figngiDn0AP5wpQ/lFTjN4:hX2iyphDLm
- TLSH T1C595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 9e2a6beba0b6de7c441ae7842e386feb1c3dc008999199cc55b19eb1fa4f83c2
- MD5 bfa739bbc1ddbcbbbf87af48cff88d56
- SHA1 d68cb5a8adaffb010b21405ae72275833b2eae6c
- SHA512 7328bab0fd628d6d4dd8b66bc2f72b043c7ded797f49bda425bb60e5058592c838b3d8af132a9d69ebc5a305a3fc0e12d43c2066bb7b5ff1dcff106fa55fe94f
- SSDEEP 12288:bqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:bqnQ/tbw/2Mkjy6Fr7g0oD
- TLSH T1A45523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 d6f22b530ee0e85438f720ecc2c6d9417b25fbec63e2fb5c8a46a85d05804bb8
- MD5 48d513bfe9d1d4948174feb7a4c951b2
- SHA1 9e97ae42d12ff83442322eb9c320d1a85ab0868e
- SHA512 87ce4666f43d18486b67b1f87f907af527e5fdd6a34ed8877797ed58028dd0b718c81960dd78af29f9b0428d07e028423634c2899a7eb2f5d144732d4cd53e18
- SSDEEP 12288:YjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:YTnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1B65523697964F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 06c0171587e760a2436f08720e8b3f4ecd32ceac4034bc95ef0400edefe01690
- MD5 7bf0a5f1cc3300ef34c848b176ab6531
- SHA1 75a70310b43c004c92c44655feb3f3bfefe9cf9c
- SHA512 153623b87cebed1bd4880ab10159cfa84ac1919c90b51837665ee343cfb6c810b6694c2c4924817c211a35d68faf81b64d6fa443883e651b9e200124132fd1bc
- SSDEEP 12288:pNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:ptnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1C65523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 e581390705be23d67d1e247b4d52d6912fd059450be016b6e1eed4f22a03bba8
- MD5 5a046334b03091ef2e2f5f6c0a706b05
- SHA1 4f66da975e6311c23634581695a040073da6751b
- SHA512 4ee19110d002798a6f6aade25b6cf27efb20a03cc176d04239fc461067e7306f53a773b20ea4493c7c7c7f86afbab5be202a4668366583d5dfc5f8ed4cc0c9ef
- SSDEEP 12288:DVEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:OnQ/tbw/2Mkjy6Fr7g0or
- TLSH T1085523693A69F4C7FD2742B4CC938142E77B3DC1BBA1A38F6B04111D4E793D41AA6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 d47eb354045688119e218b3050aef14ab48030eef596d2e9837350e284c4c102
- MD5 5f38ee9d2aba73a5bd0461e1b059a66f
- SHA1 3295270a2a1becc233f2a086c2238e7f00373d33
- SHA512 7cc5e839e7e1286ed5d5a9ae3b1de4e7e094324786dee99e4aa99d49f2252b49727d6a1ff0f9db9305d3d6e534b3d01921165eb074d8b7437d1bdc20c1c43c28
- SSDEEP 12288:ksGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:ksnQ/tbw/2Mkjy6Fr7g0o4
- TLSH T1485523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 bd77c914db39ac0a3af6eda294bdbf6c946d9468031af2c806de039844cb1aa6
- MD5 1b08429611135ed955f01c1e329011c9
- SHA1 e92cd91f525630b3c344cb6a657cbd93dcba18ba
- SHA512 637235654a4623d8755044e0d68af5810f9960c1e1264627d4c6275f7875ee052b7cf921d118a861c510748aee988004f2538bafe3ae87a18de806d10a0c45a4
- SSDEEP 12288:SXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:S3nQ/tbw/2Mkjy6Fr7g0o4
- TLSH T1135523697964F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 705370c2c4d01afea9ead8aa9f3ecb1a55ee74cfe588cbb5012c2a6cc7145959
- MD5 4c454d83ed7c5322a56a8a402c80243a
- SHA1 92523cdc8ecc082a48ab5af90cedc3a11a7b001c
- SHA512 8d68081a7c1ebd77f9a2880583ce76022e5672919e390b35f1050a034a4b500169164c4c361384ac8d143dca996c93930b750a29d02c2e1a64bc45317a5d2630
- SSDEEP 12288:RrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:RbnQ/tbw/2Mkjy6Fr7g0o/
- TLSH T1745523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 10bad34b886ba1d8a21b29b7066f188660c7ad695a373d409c4fe910ef2d6f58
- MD5 f75ec5717b8e4595818d7195f615954f
- SHA1 4cbc20627a13ae7541bd14bceffee4efd0628fc3
- SHA512 3b8e266051e2331894a500ea6c546fe1f3815961cdb62d87d4035129b58af1f9bb1a41c392fff1c84d53c0e6bfd88479b3bb98483bd14b3c348237970333c2ab
- SSDEEP 12288:giZwbDzzFEoS2cPvyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:jZM3zFVSOznQ/tbw/2Mkjy6Fr7g0op
- TLSH T1DE7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 9242e74b1c00b08c89831b6d5264b3f44a5e5ac202efc8415b5effbad873c052
- MD5 530ecbc3b6ea89a8f190d01aa9dbb252
- SHA1 f2df1295f8300ea89dd499a907d08ce352350524
- SHA512 ccf8f6e3a703a473cbb48b3aec3203c2c61797a69de1fcf6971bcf6792bd72de9c55c31613a7458836fa0015ebb6a772b035d09f631664bc00def1b7b0a075e8
- SSDEEP 24576:9CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAxnQ/tbw/2Mkjy6Fr7g0oU:9CUxPTY+8Wg2lIL8lrIUJLWwsQ/lFTjG
- TLSH T1B065BE1EA3EC0896D4BB817589518A06FB72382E1B32D6CF2160C33D6F27AD55E75F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 b87200e27e94039402311459678010d01d7b4a7d696789382043a119244c2418
- MD5 36b078e3d46af9cf99154c6d7e897465
- SHA1 6b7509c572d9192b6cc86dac9064a887344d0285
- SHA512 4e880ce9a04792005245489e6d39a9e8ec4a0393473f64129cfaa5c723142f52520c4bfb111d2d6a33e9cb4187cfd8d1abe2201afba2e919590080e75881fc33
- SSDEEP 12288:+ssfGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:omnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T19365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ASUS\AsusDriverHub\setup.ini
- Size 40B
- SHA256 289f99b17d13aab9e8a2e6a5a017e051355c85610d70561278b1c4305d4f0282
- MD5 0a74701be079b874c2120d15d85bf637
- SHA1 107189e11c6be7d4bf695202e46b4edb0a162fa8
- SHA512 86369eaf7566b0085a497429213a5bfa6145dc135e266bd49048c1088dcb5e08d86d0a9034513e80c4662b681bb84cbb53dd97f6b9b0494cb2b6d9ec136a8887
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 97ccdff47a34337e54bf2df535a2c54070b0e2e8b7e07934ecd7f6d83140efd9
- MD5 d5f91e31fad63859fd0448f9d920a8fb
- SHA1 2cbca9e8dbbae365bd098b63711d5b4faeabdc3f
- SHA512 326596b74b4843753ef821e37aa6b2a244494a30edfc1851bd3109ff0e520f5ec282857a45711fc85e2ea0745555e576ecd4741b2d283f1ae0f47e1ee320e1f9
- TLSH T19181CE323375B0D489563F07192C19C463AF4396EA54AF4CB65C620EE92B14BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 da665d24507f785499c4d4c425fa082cdf7400a82c14d30962961bab2f09f9c4
- MD5 72a049105cc8ebb917fd8a017769f3f7
- SHA1 f51e15dffdd3adb5624222c945e2e335fc6abee5
- SHA512 03005ff3c8a8c21e8f4fe5b85bd3d58b1140e27e3831e61dae7ea4e8edebbd73146021744c1aeb9c6e8eb7d1235a3a89900b16ef8c618dede064b5c42973ba58
- TLSH T142217533B3ECC426C8D911BA208CAD00B2A5C7C7449E8F8B7B84C619957F9CACB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ksjbtnf1.i55.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 897fbd21440d05cdb86267371aa180406c0e13e000b608e9c75baa094d87308f
- MD5 38dbf6eb0db8aaf194b1e5340d063031
- SHA1 64d23dde7ef6c0a0d74546b480bbc3cd3f92f7d1
- SHA512 090af21532cc69d2b487668b880c1112f75cb195624477f2b7a33b0989f8cc042f9260daa67880624a08493f96b88b4e7b5ed00f3cc0f1d21171884c0300bdf1
- SSDEEP 12288:stGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:sNnQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1B55523696668F94BFA3B06B048938111673F0EC5BF91D3CFBB082269953C3D41EB6785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 bd11f695135b633f6f262c0eb95638588761babc29682e0c9a6866d402b3794c
- MD5 b059a8506376653f65d6b8b658395d4c
- SHA1 c20777b76b591da87b6363c5ba4d163ba4a3d32d
- SHA512 ad5717fc3d2a5a02e9c9285e0ee4c92c394134b799061e4e4240b70f576abd896174c38359cdfdac28ed55265da7b712a5969c8744283c0505a84b0cef21fc15
- SSDEEP 24576:r8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCfnQ/tbw/2Mkjy6Fr7g0os:oRZwQCyiHiQEaaPnMOQ/lFTjN4
- TLSH T1C885B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 edec46f55494fb74f2be137514468a82f039c828c4657b9f9cb4325f692d1b51
- MD5 6762fbd2bf9c6f3868cfa80791347e6d
- SHA1 69d132fcc9a6c043f0c7b8cffe620d7cfa9592d1
- SHA512 70aaa5035e5aacab451599230f46ea24fea1e0124e15ffb67ab6fef71e1f5f0a3d08d45aba48b151870655248046911f1b663559c99dfd18c4814f65dc2ca0ad
- SSDEEP 12288:AbxA1U7K9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:AbxA1UGdnQ/tbw/2Mkjy6Fr7g0oC
- TLSH T1D255123E26AC24E6F636917D88D28106D3327C56676193DF2684823E4F3BBE41D76F81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 ee31433869d88a456726f0459c7ae121a94673ec6817f5dc0fdd7a89de347ce6
- MD5 9e86c7696dc81c94fdea9e5fc9a72651
- SHA1 72ae6691748b19fd2cebef24c81a20425d2751c8
- SHA512 66f2817e4850d779ee5d7be3848be32004f0af4d13d3de6ccf55b609eda132ca95a20db5c724e0ac48d460d65981e7e19fb99fb61a86fe5ed670e818d578790c
- SSDEEP 24576:AjsmP0yHaqrVqHra44KDzMsrn0nQ/tbw/2Mkjy6Fr7g0oy:AjRP0yHfVqzlAsrn0Q/lFTjN4
- TLSH T16845AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 2d71f723223b8180d464d875cd89ca3085985337d3a042b1cfa32dbca4d4bebb
- MD5 c806b868d0d560f17fdb9d4d91cb1365
- SHA1 08793098ee27eb9c07a97146417511e2beb5c727
- SHA512 9c42e9a46246659d673e9aa88f792fe2f9b2dafd87b646ac5c415c6fc209fea67a8fbf067004f21aad1b8ea162c0c5d679d7a8cf1074ff0f5e418f6bf2f7e365
- SSDEEP 12288:p3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:pXnQ/tbw/2Mkjy6Fr7g0oq
- TLSH T1955523697654F98BFA2706F54C828142673B0EC17FD5A3CF7B482229967D3D40AFA780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 580a4a6069bf51c2a7e4c3242b2f1dd582ce3b202b88c364c03b8f39cffa3444
- MD5 7f2139a2b2fde48badf788f36f83b893
- SHA1 6735df309cfc7af57b47744aa4a02c632e35c582
- SHA512 11b6ba15419bfb283c630d32723bdfe756b4e1cc27c8ccd988d12928a55fa26fe5bc1ebe3950deb066181f2cbe7aebff3dcb32ee72853215e947c4e1056f8837
- SSDEEP 12288:hOb4A4LWO+vAYFTZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:WwLBUTpnQ/tbw/2Mkjy6Fr7g0o6
- TLSH T1B375F155F7A450F9E92B813CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 f76de97876f4248db0bc9742aa5eeb9d6f5e663b0c120d1297e583be89e4212c
- MD5 95f5d05ff3eee4f94dc0c00c642ca60e
- SHA1 07c6df50708d2391eb1fe18125d5e286400222f5
- SHA512 882a8f988b57c97a25a82d08c99446ed818864bc858002bed3463b5eec754ff89054d8a7b59fbe906a090bade9343f039541b417b03188e37b0f88e5351ebfe5
- SSDEEP 12288:c70VmuIYNvUyBpaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:JKYNHAnQ/tbw/2Mkjy6Fr7g0ow
- TLSH T19965F12E62AC1CE5E53B91798AC38209F2737896175193CF15A0827E1F37BE87D3A741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 94e17be88a6eab726ad458c8f0cd352d7ba6a3d1b8bedd84c88e5f7f788517d4
- MD5 3caa7031263a76ad3397f2702e88fecf
- SHA1 129b2e36c65cc2111978121cf531f97b831357d2
- SHA512 6608ecde308383affea80c25c55cd9de9c5794472ec9d1b4b83e63369dc533cb66d470f1ad883dc099784ab82648fb5906d12fb93fad713aaabce04aae27f6e0
- SSDEEP 24576:nnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKd:nnXoJJYH84VVS6AmEcJas+cHBjSSKHPL
- TLSH T1D065BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 e8ef9671fa4b3681eb20c948f2fa88daf79905f8495295dd4944ecd1925e9458
- MD5 70fe3b293b2a4dcf1fbc490b8e54a2cc
- SHA1 e334e13a3deab1770805b1845cc5cd244eb4932e
- SHA512 c79f654f24866230ecca1ce2f2c15f146d1360419bc2c1748bb263ba8593dad914f8a3fc876f832581a707bf78d4259ca8fd36ba18de839825554c6233c792b7
- SSDEEP 24576:5v7Xbxd9Tuycf8M/TYlSuxwr2PCynQ/tbw/2Mkjy6Fr7g0or:5DLL9TuJ0M/TYW2P3Q/lFTjN4
- TLSH T151858D5EA2EC52D8E47BD6BD85B39046FAB2B895273081CF1250856E1F23BF05D3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 461978eecc09e33216b4821aa94df082a5e5e03d12528531e5c83f2ad81c2c60
- MD5 c9d86d80b4638f38353923ce723c1f4c
- SHA1 14b2b8480b51a1f2f7d62115688f122f5d36d6ea
- SHA512 88a8303ad918eaa65a63ab45c029a7c4a5706e392de2b490c2dbbf820f1682a09d3a540c01e7acf534fe20a702e5966192e27a8d7399e2cee7ef1e0aeb527154
- SSDEEP 24576:XegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wpnQ/tbw/2Mkjy6Fr7g0oZ:XngOJOmPOHhpQ/lFTjN4
- TLSH T10F55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 db622cb3a333eb356896f3e1873f7c310eea0d149f915de9fa26613db6e019c4
- MD5 c6bdc855fa1a262258a597aa8e95f04e
- SHA1 c52449cc7b1050dcc496f6147cfd2d78b4979374
- SHA512 ddcf9dd455d29f02d08f32d538062173b09eeb8a9d43917f4e84c462fdf331943faa1f9bdd134571448e700739506969f3686326d00685318512a69142175b09
- SSDEEP 24576:dLJnJiTk3R3waE4JrO3nQ/tbw/2Mkjy6Fr7g0om:dLJnJK8R304lkQ/lFTjN4
- TLSH T1B275D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FD06A79F48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 51d9a50c19f144f5a383fbf88dde1fa8bdf9b9fd8d4526362830671bcc58a106
- MD5 08ae5069a19ae91b0d38a086ac07904a
- SHA1 2eea161fac336aad3b57c5922178e6a8bba4ce2d
- SHA512 c7514c26f546d87af4d4bf3db2c468e01966d6251212da3e9c883e2d5e503538a6c3db8b915f9311082aa7ff1134b73c180df5ecd99a6fa47c87b9196b823ac6
- SSDEEP 24576:0A9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pBnQ/tbw/2Mkjy6Fr7g0o1:j9GqCzDScAZmlvTcFg8Ph6bQ/lFTjN4
- TLSH T1A8955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 5a33e4a8a26a3794792d0ca2a6f49df4dd570dafae65cf78670d89cd30a84518
- MD5 6cd74f767811bb4baa2b7615dc62b6ef
- SHA1 1bbcdff55401ad696cf7a4e9709d8653fc48ff86
- SHA512 e13741cbb6bed472cb33650cab2433d7364b96519d5b2bfd0f17dd96fd661592811d1f77862dc11f674ea31b3468a74348774c73a50f03cf9c5df46918479c69
- SSDEEP 24576:3lYJeXm5jUuE5nQ/tbw/2Mkjy6Fr7g0oU:3lYJeXmRUuE5Q/lFTjN4
- TLSH T19455126D366CB0E6E22F41B988928545E372B4A1274163EF62D0C17D8F7B7E51E39F80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 23dcf0c86769eff0342b993968c48ecf7eae780a629f12a1f56c8b0e720fc71e
- MD5 686ca2a38319f414078822e533757877
- SHA1 5c204cd61ce7d80647b801c8487c1d7ca16d0a45
- SHA512 99e2889b4249e96dad30e0b7d99ad69fcacaef0c7a8c159a14df0e1ef1ebf2bc7049a7cfc4a5f69a32e9889d7ae6d9499d6c71f0efe9bea22dde0f48c796de55
- SSDEEP 12288:FFu6ky0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:FUtyUnQ/tbw/2Mkjy6Fr7g0o+
- TLSH T10665121833A4B4D9FA7A0678CDA381819F3A7C50AF5093DF66C0E23E5E3A3D46975B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 7ec479ecf62c0c3c8ed6f65ed4d7acb9ba683d2821e4b19fbdcede52562c3491
- MD5 8402a1d517ab5ac7e7f0cd6aab2e0b97
- SHA1 dcc27ae975155cc00ea4c0927ddb106f21bcf0df
- SHA512 98f3d75ff9d6c216155f4fa0948fc28f99a75961c8f337e51a15381ced9c53de6f5e4692c68f40bea83dae8118333ac20ef26394b47afc0d4a3be7679f95bc76
- SSDEEP 12288:uPZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:6pnQ/tbw/2Mkjy6Fr7g0oW
- TLSH T1B455236C2624F49BFE2706F448524542A73B1ED17F91A7EF3684A139CB7D3D01AB6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 432d1b4041d74d784dd80b4375fc99f733e94bb56b9d51c8459bb974e3891757
- MD5 f37cf1e71f7ea640e54ef3a71982d99d
- SHA1 353b67eb48c9dd722f9c55418330ce34778bf93b
- SHA512 3c335206f55d0a31e54fd853a1ed0be3aed27c1bd8739defe9279a48f49651656987b698d5c58e685032bd91afa29c9f9dd342719c3143c221e2f82b085d48b3
- SSDEEP 24576:sC+TyQIu93VAumZr7jmGnQ/tbw/2Mkjy6Fr7g0oT:s/TfIq+YGQ/lFTjN4
- TLSH T1A7558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 fe20057e229f36240c2513efc2028f140304903269d3f1f70fdf7b58ac927a7c
- MD5 008066d441b0bd41e54bcfb8d5d311ea
- SHA1 70db1ed3c3bd1b5f02b5e44dbc5101629cacea97
- SHA512 f55690ba69e533c18c92e6f63064da912991b3e40f9e5497de009f9295b5c79b16edb1e9e03b340135afbd49a7fd7718ece59b5425dfa8144583e74061d93e49
- SSDEEP 12288:/cyrWOstaa3kcsFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:GLQikZlnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T18B65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 765728794ae758d568a56b857c7e193be7776705bba15b7c8b9061d7327ec7e5
- MD5 9142931804acd317bd1b6d673c5833c8
- SHA1 276083bb24a97cea8b42740551857cdab8294973
- SHA512 a46090d4fb93c61bf0f0176e54f2ae973944d4b1687817b11537cdc3ea6b2630b2cd613c4afc82c44a137347cd78de6ebc08de1aad98e241a3ea2965b2395383
- SSDEEP 49152:ZpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPUQ/lFTjN4:qpC7b4+80GTkILm
- TLSH T1D2A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 83f0b7a012010a86c687b595e7aba049bb3ac77d578a4c599aef7725f3828476
- MD5 4e123ff01e5f5c4760aed3883aaaec37
- SHA1 847ec4f19d5efba64232c79623341a237b8720cb
- SHA512 a340ba96f40a43ee36f48adfeeec6ed77a96bf8565cc97ef478a8cd5a8da3f9abd4c4814bc41c8d13473704376679566561a2270d93925b5bb9bda294a61a4d0
- SSDEEP 24576:sSAwJPE1IDAo+4Kt+l44135UQMnQ/tbw/2Mkjy6Fr7g0o2:sqPCIo4Kol4/QMQ/lFTjN4
- TLSH T1DA55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 2f3dbca181355162f5d48e86b09d660048d89b173df0d0f5ac9dbd485b8e0c35
- MD5 79b11833cc1ded03b02e9ce7a22852f3
- SHA1 cac961e9b9efc69248bea0875bc1c8d0d56c62a8
- SHA512 3000a8df20a043e4804b90021706ea52ba8b4755109fe69c30a2fd6c22c345c471af9d120377c162f79e09390694b0fe1ed331ace7ad8af3201218834cc88195
- SSDEEP 24576:2yLXPLcf94tcnQ/tbw/2Mkjy6Fr7g0op:2y7PoetcQ/lFTjN4
- TLSH T15375E13EE66C08E5E53AC27CC6A38506F672389D037166CB16A491791F7BFF46939B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 528ff12c38977bf4bb649f70f1cb3ec9300a94e29d88330b61190294e4ac2248
- MD5 f6fcea5c0545492c934a3a88206406f2
- SHA1 a851fd24d6baa03d891e89abcc2a07259af04be6
- SHA512 59f3068bd6b0fabb49184d156f3b7d9da078b035a9086dff886a7fcd4c779315a92f4572b0c05b55370b0e99d61f0c8f2c352be24dc6f0bb4a80dfd33b50dd31
- SSDEEP 12288:h9lyvj3IkxjbBz1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:hWv8qjpVnQ/tbw/2Mkjy6Fr7g0ot
- TLSH T1FE65126E66A4B4D9F53A0274D863811592767CB227A4ABEF32C8D57E4B393C0953FF00
- MD5 SHA1 SHA512 SSDEEP TLSH