e6055b3b3cbf52881a73541802e1581ebb27ad29f3616a339236b4eb18ac0691

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260629-cppdvsa14t
SHA256 e6055b3b3cbf52881a73541802e1581ebb27ad29f3616a339236b4eb18ac0691
MD5 dbb8ae1e885e0c6cd016c4f674a90508
SHA1 03b41783fb058acc2d3d47074dfedfd845b9eb99
SHA512 90089dffb858455ef1fd860ecea2ca1d7b60d6ee83074f4fc02323699b826d18f992659934541e90194b834b8e4aa4af04988dea32119bacc84da1b7482a4b0b
SSDEEP 98304:QZnuomZBBBBBBBBBBBBBBBBBBBBBBBBBBBBU2lKWLm:QZnuomZBBBBBBBBBBBBBBBBBBBBBBBBJ
TLSH
T1C1169C97B2B500D8C166C1399742E577E7727C150BA49BCF12E16E2B3F279E20DBA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5084	alg.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
4476	fxssvc.exe
3636	elevation_service.exe
3460	elevation_service.exe
3936	maintenanceservice.exe
4556	msdtc.exe
556	OSE.EXE
4460	PerceptionSimulationService.exe
4868	perfhost.exe
2032	locator.exe
1140	SensorDataService.exe
4532	snmptrap.exe
4672	spectrum.exe
968	ssh-agent.exe
1876	TieringEngineService.exe
4396	AgentService.exe
2684	vds.exe
4624	vssvc.exe
3844	wbengine.exe
4244	WmiApSrv.exe
636	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\880ca2d17c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000583fc02c6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc623b2d6d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a717ce2b6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045e3ea2a6d07dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e39162b6d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
1084	DiagnosticsHub.StandardCollector.Service.exe
1084	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	4476	fxssvc.exe
Token: SeRestorePrivilege	1876	TieringEngineService.exe
Token: SeManageVolumePrivilege	1876	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4396	AgentService.exe
Token: SeBackupPrivilege	4624	vssvc.exe
Token: SeRestorePrivilege	4624	vssvc.exe
Token: SeAuditPrivilege	4624	vssvc.exe
Token: SeBackupPrivilege	3844	wbengine.exe
Token: SeRestorePrivilege	3844	wbengine.exe
Token: SeSecurityPrivilege	3844	wbengine.exe
Token: 33	636	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeDebugPrivilege	4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1084	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
4620	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 1848	636	SearchIndexer.exe	112
PID 636 wrote to memory of 2324	636	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4620

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5084

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4572

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:556

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4868

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1140

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2012

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1848
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 64bfb5bec5da84ee1ac6d7f06b623ddf302d914569c14e8dadb20ec7d9a407d1
MD5 fb892119d4abd24fe287c91a4cd6c660
SHA1 5971128fd233745b452756345837b7f85f16baf0
SHA512 37c3b2097a2acd58dfc7776f9a75c54a7d47cba5338e3ea85a5e47897961c7c1568b12fa6a25ceb57010d94823e58daf882f6bcc76c34d5a8dffe56b26835ff1
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDQ/lFTjN4:F3q6HjBLLm
TLSH
T103D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 954f6e01c44f4d198ae19a6985a9d603028c3332f128454d501b139e7bcb21e9
MD5 3d15959a52c092a748c2abcfc84934c1
SHA1 1d0c457ef195355e0df6062e571804cee217373c
SHA512 aafd208378e95f611dbad51184ad32b23510467b73afe51e185d2dcfea4a5042b36dc2702598c27d91ce1c82b7a2b3bcea88a5f3a7da2f552e73aeaf18304b40
SSDEEP 12288:M1XLsswWkxy2lRq2czAEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:6XYfDtczAknQ/tbw/2Mkjy6Fr7g0oj
TLSH
T12965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0f237326b68648a17891b5b1ced1fa84ac3f11d9e99b163c4a8583b4031ec66e
MD5 11ef2ddfe9ca2cf2ff3d99594c3f0d0d
SHA1 7e8c86ff735c07c3dc4e1f246facc1dc96d3d840
SHA512 de166cba02715d927cce0d60dc327e6201190c0ef379e70c1691290bcd1cb479336beb03a5ba4b088ce1ea40115f8d0985921dc171c92ab9435173cccf1f51e6
SSDEEP 24576:10Le5ji0hmxLrM7nQ/tbw/2Mkjy6Fr7g0oP:1Pji0Al+Q/lFTjN4
TLSH
T1B5859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9d1a3e842acfea7b9ca394fd455f09703dc24f428eb1eed0542397537f313ed9
MD5 531bc4d93d49722d1220c606b8deec20
SHA1 31dc73cb8fdc8d19875e1599853d231c273184a7
SHA512 a2dc30d782e2ff6adf42f79edce203c4077696cb446ae38f733447d657c2da80468d0b087c40fb96db2341f9f00df03495e525d6be322d2d51953d43daba32c3
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyu5nQ/tbw/2Mkjy6Fr7g0o2:d/ezSC6vUzPvxHjyaQ/lFTjN4
TLSH
T1BE755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fcc63c5577e732e021cd74bf90c3ff7a8e621ea11013c7c3798d8ffc02b9e07e
MD5 f4b61bcb3546e32b272e6688f19f7067
SHA1 a95785c37cc57388fdc5aaf84ea213885124f7ba
SHA512 b31c3eeaaff80456060576f349a08828cc1b36ea33b5ebbed61d4625277b7f089c00863028c6c71f4aa2f8a9a630f7ba5fa16b89e4aeb8c660bcbde2bc2cb784
SSDEEP 24576:5VbqPb88hv/l+6YnQ/tbw/2Mkjy6Fr7g0o+:5VO88hXl+HQ/lFTjN4
TLSH
T1B7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5e8395cf1d2a50b96d9847746615b9b1931007fc50952dbf002bf393fdd66578
MD5 9ed40652ea46868d77edd858152c56cf
SHA1 32334675c56b54c7851b913986a58b0a8f1e5702
SHA512 a7eee1410e0dc23953016e9e4ae8d100f45f1e48784b25f6b4e3e084cf9e63088628a01be6c159ca38d4e1f88f369ce903b3d544e52d8761926becf36cba31c9
SSDEEP 12288:ZzPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:ZzvnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1885523796A24F897FF2B06B15CD284826B7B0EC1BFD4AB4E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 929877ecf8801dfe9c62b6aaaca172a373b594438a67e49ece4f8ccb5c0e20a6
MD5 1a8e6ad795ad906a658d6e664e440cd1
SHA1 308be40570e113cd0f7302c3a3e6516471e5e67a
SHA512 88ff27f8928322f38991a3010d334870b8d5aa9cedabcb5edae99eef2a19da7cb53abfce709c8ce4521b7c3901c5e84ab39c2bf79c73154bb4e88059ca9415d9
SSDEEP 12288:seBNUbTVO86UQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:sJIUwnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T16A75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 88cae40149720b8cfd637c864012d8c9c4ad5d55dd7d94bded20189d10da1236
MD5 659fd3f98080a47579874b7c8dec1d01
SHA1 5375e2d46ab06f385f6ec770ce31460fbc342aa8
SHA512 b4306f0044b70b9236b014c8db184a56e305ae06e991ef6d906937b8cb36b475aa978e0360676a7f90358692d14f486ffd8cefb61a9d73253b169f41f5c06c87
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:JQvGAdlCEL8c/yRNw5CeLm
TLSH
T1F3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9ec7e72929cd602c92349284c39623ed5f913ba44ac359b60c1cfccf1207518e
MD5 69befb53c2a97636a2a0a53e0d56e1dc
SHA1 9ef6efeae322f2ea37473d7fd7e723650e6fdd5f
SHA512 d681f4e17181ca3e83d69ef2556c8a5a62bc976f0b9d298be9946d7f818576930f095c19afd68b77d2ade9de55b40b0e517ff8124a33b5b3feb8d32c977bf49c
SSDEEP 12288:jAwSfxL/2Dc39DLLmt0LDQewsAjuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsge:cQewsAjunQ/tbw/2Mkjy6Fr7g0oM
TLSH
T14675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a659901f92c00a4879d5c8ed1b050a26caa8d9913414c05d7f538f28002b75a8
MD5 de8c270b9cd3a9e94e9578e180c7d51f
SHA1 b73ae3dc14c298f6b445797a528084e15fdac008
SHA512 8cdf72cb1bd678687ec278337fd2b88e0fa9b28bb3c0561f6f0530a0c98e604af3cbba05da034314dfad976af7f9fe27ee66e96480fc09425acf8715294d5cf7
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHhL:8UEtQevvqc2W1cpV2EI32
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0341e231d0282a80a5d6964741f31e2b24550b6a4b875c67f05d09e13f160de3
MD5 7f59b7165c6a71baefebf05bf66bcf01
SHA1 f94f82d7929761436deb083b6f7976fc30a4fd1b
SHA512 699e9340be32074f196669d56c801543bafa7f63cc2ffe4e1c36924ef42c7ad675fe759d92e16902248ff7dceaf9a0b9ea892d9f34485805c8a1e373f202fc03
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zOQ/lFTjN4:QoqtVjnmqLm
TLSH
T19AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a18ab5621f68bd80ef56353261770fa38ad585a99cd7699413908b0c1d7a6bef
MD5 5bd7ab8f1820bf661f309a683dc83eb6
SHA1 e9b3c512c2986d97dee9e65301085587216d3ca3
SHA512 333395bb7be0d1d0af3654d62fa011723ef2981f2587c1e9043c97acfeb507b6ddaa266123f33f3a231695b006236e25156e12ca441632bd55ebeebbe6bef5d3
SSDEEP 24576:MAhGLJIFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0oP:MAMyFoiq51Q/lFTjN4
TLSH
T12835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a7afc9b8ca574e7cb941c3cc7613914d83d1d759e5c5ceac320cc76aa608d258
MD5 5e7ca46dada6e4539d9c899425975e81
SHA1 bfc2b7e25ab83b8cc332438fbf4a167c60bab22e
SHA512 c6d5f48140a55229cd02af5dbd08d81ccb0af77294a2ea2a5be6b78a953ca243263b939c0063481fb22b7e496c522cd8b3e197c95b100592ca6ded192498d6a2
SSDEEP 12288:5mw5HEjsChN2BFgl0WDm+CJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMo:UwuHOW6nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1BB65F14A36A45CFAE96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b48ae93c1cb18c15cbe95888e86916d4af369ee8c4054abe9d7213e424f05f74
MD5 dff47b14a2999b9bf2399a69df78931f
SHA1 b0b9cb96301f407e0f8e7f7e641354b743503373
SHA512 7ed8aff518ddb09c7cf1dd5d16f3cccc42fe63763895e6df98cb832f83453e748f8a435d1dfc6750663e320049f754887f670dba856040ef7cb5bae22ff893d0
SSDEEP 12288:yXZ1IyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:KZuznQ/tbw/2Mkjy6Fr7g0oW
TLSH
T17455126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe687a5ef43cd51de65673937b67460812cc916d75eee42f38e3dc835dc3a1b3
MD5 d7de1c2f6589299f91c879074f7b339d
SHA1 a8d149159fa92207689916b5e3121d58647e2d76
SHA512 b9757565df3146949733303b87dabbff24296a819e77d1f40e956b3d1bf6b22eace0635dd04b593af8fb47f0eaade2bafede9935b7adea5c72b4fea503211872
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:WQRQyi36YOcPQLvw2gAf+PN3/Lm
TLSH
T1FC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c0921e996cd43842abaef3f184a85c417baeb0f3d48fd6cc31b1d821c0963cae
MD5 9e7cff980f6d6a9d97384173398662b3
SHA1 c36a545c91d67cfd5671cb6fdf8b0238823b4b77
SHA512 46467ef8e7557197ed7eb06ad55a8343e2d81ebff885eb8dbb480847dfb927e729634133246b265977f1ec1d76d2a4e97538de181794c2228c35627cbd0a9c55
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:HQRQyi36YOcPQLvw2gAf+PN3/Lm
TLSH
T13F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1e60f3e9e8023943f08daa35b2b1f15baff5c302e5cee2efb9536cc8512f1c65
MD5 7a5e6179481e56d4da9d50cd44dfc328
SHA1 ab51416cd44bc53ff3c00a7f3342399a83a89814
SHA512 a1e6f22f8ca9e4949c6fc80fde841c6fd14564652287cf373f78299837b2bedd1dace2e5e38dd6a978dbb796b9e743876c1af3bd71ba6c9ece95b27dd31da2ce
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DnQ/tbw/2Mkjy6M:768Qg55nhheWu7PNU3/+Q/lFTjN4
TLSH
T116B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 60003c139d3d43f4ecd2f9cffd40186838fb45139ce5f0f83bbe91969c8929ed
MD5 e786d239476b95920193739e278bfa49
SHA1 81b1e7312c8fc4dca1b8993ec60e69cf7512f249
SHA512 29c69ebbea151d5e1264dc9704a65b3191223520414650a5b5e80a67c6cf309ea2b7372b0bf514ae732c6e3b1e658a95ac4e2ee0e36c69218b6d7ad80755bbb2
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:Xy5112gYy5azzVvL69nLKnhZkLm
TLSH
T138167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d18e5a8315424c944c9a8e4f5ca919e6774337f3f1150974d5769567a32d8e6a
MD5 85c3b2719000a587cafaffba4cd154a2
SHA1 65c2795005e087b2a93cd670e82dd1dea6f36d93
SHA512 5f3e62e66d703f0effdf62e407a51ab68297a65c919a37dc41d2413e24ffab33f28bc82aa3f3c0baa09ee484bf70348530aaa8ebcdb2f054130f4e27b1e9eaa1
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0Q/lFTjN4:/u6JmVxd2dnLm
TLSH
T1BED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1985df6be482dbe6c7f6ecf23fcb849f94400bad2ffc7878de1412d37e64f894
MD5 87e841d8d95381282c05707d344af78d
SHA1 652f3fc654945d7a827e78d9d63c2d0db1b8c9e8
SHA512 8ec22cc7e285a424cdaecab0d07794f7ab0f143d1077e244eaf1b14e0b6f4840d12fb87576fe133dc7be817104e43f9d3fb875a87f341319f47a5910cfd24d99
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xQQ/lFTjN4:amifPbRqLm
TLSH
T1F1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 50c146365d59e50def473f7ae051ff608660773c2cfe9b7d2a8bce7fc7390e96
MD5 d7674be9d66f944cda9c94cf924c90ff
SHA1 4eb7114304fbdcf0d95eaa1c3581e41f72502265
SHA512 122edbea3f21e454134fc2eef42699956da2247b6b8c1393c2514df6a4d43b190a5316b5559fcc5f84f976202da513ec8921d00685796b467ac2d129e9020e5f
SSDEEP 49152:1SuZQIY0Be2KRRVtOnks6NMHqzQ/lFTjN4:b5dKTi61YLm
TLSH
T1C2C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0baa37bad40d196dd0f376c20ee7c6a903bfa9b08411b1e39c906719e7a22f33
MD5 adcab865757c8937d0513e76401f0542
SHA1 7f7157aed20ddd1b3d5b9606d34fc094912dbfe0
SHA512 2b41c031e95b56485a64d345090c98f362d826e0fbbfdfc94e11df515bd98f4e03e6b1397e831884fb86ad9d650c5fa32f016453ce15830fc7dc6f29dd9da576
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wkQ/lFTjN4:BX2iyph2Lm
TLSH
T14995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1585dd5e49aecc53377aea26b673c52d9fa77d3671032a84939629f884752d62
MD5 3713ebcb8e21cf579058a88c874b36c2
SHA1 804456427f8a1dd1d9f3a06b6b9514b5c21d2b70
SHA512 b77186d859616c79f077dae557bd924009bb5b1659548e62cd15b4620bae9f0f2bfccaf1f6d16b902eb7aca508f441142d71617637609834c38584cc373a6b65
SSDEEP 12288:gnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:gHnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1E25523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 34aa602b4242867038659eaeb88f2135ac45b31082777bcfdcf84a817bb4fbb4
MD5 c5ab41b4b0d71095d54ad6d8ec46cf40
SHA1 361ac16391d8fdffa1fe98914e8f8740213630df
SHA512 ba4f7d953149340af8914696a93a2f2dfd56d0bfaa68e8a1a8d5a276756d18484ca04a74748c0e7b13fc2586de129a31ec49278877b685c6f4c26c646ec38ab3
SSDEEP 12288:4CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:4CnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1B65523697965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c583f6c510e0a2699186b2d9ff471f136ad343c9c1b568837214029ae3e99b52
MD5 8c130fbfbbe6b0aac02f2c417dbedc63
SHA1 506648715f7649e4a090c22bc517e40a07bd4d03
SHA512 b5cc30eb542934af8cda9913e043f97ba8179b052382fd0adae321e8e6280a43dc8d0483a781b6a36f9b7f59193fd607ec3a0598200d9c3228f8ccaec37e3b39
SSDEEP 12288:WoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:WonQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1D75523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b67ff979d5e2abf4e9dc747a6622721ec25e6a727fd996e0d7b9e526a471e091
MD5 8ea5d7c197391e0884d7f678e913d120
SHA1 fed0bc2459e57d70628bdf04fb4b2a72d3698fb6
SHA512 894716233fd287d3910e07536109c433f632be26fe30a63486a45aa704df3e21581acfc3fcc680f146a805652dce6504c251af0cb002674cfc79c9cceb5d795c
SSDEEP 12288:4VlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:YnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1385523693B69F4C7FD2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d4f5a0c05581294e4f04459187ad77c0c2352a75c6607f51587672156302e567
MD5 8a30748a5d9c28ef023c97c4622ebce0
SHA1 c963a9fa75a5d903dc3354733e651000c911ce46
SHA512 ece1f8569fba5687e66fa39b915c78b3244dc136fe2fbe23e84d34f23f3738034fadeca1ae80c6f33b8adc0e1e453344310d6cc3edca86ee4e719bbef2f7d64e
SSDEEP 12288:DNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:DtnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1085523697965F98BFA1706F14C8381829B3B0EC6BFD1938F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 18ad35a3b6a200b5831c2e98ef1a1be71f543f4cd4c9ef56cbedf1c18e8e20a2
MD5 b60f4e4c903e5f5d9d704cde81251944
SHA1 486e23831458707fbedbecdd0738c1dd8e31dec0
SHA512 0bf503f2d4552ab90cbb0a36fb2219cdf79df419db8d6f85695e3d9f9b7c76bbc9be08b26d950e0b987f5ed2314fe6b6680790263ee008937354f1a66d41c5c9
SSDEEP 12288:mmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:mGnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1ED5523697964F98BFB1B06F14C828186973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2cbb5a4b1b5546f715d3fc478219a1d0e72e27717710e0b8fe48b99b1ee49d3e
MD5 a541b60b417f771da4c9d1351bf5263e
SHA1 70f09ddb2a4db44dcb01dd8a1cbd4cff6751b1f7
SHA512 ca5528457f2c643e89b9ee365f217ea8a74ada6ae5d9696595f8670e900465cd4060a4a37ae09a1a2a8f2dd218e80d0b7efb7f25a84b987e7033adbb0d418e17
SSDEEP 12288:7KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:7KnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1125523697925F98BFB1706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3e88f4ad6ce10f9b906516bd65580323883535bcd949a7dc21ba9aa4680aabe8
MD5 a5a90a45997a5f308696c6c1ddc16aa8
SHA1 00d10bd0b02c231d861ba9468b3cb3235d4f505f
SHA512 dcd7e1140b2f1b0fcd52572d9a28012caa800ea93f33d9c6337df1491c66343d36b844738882a31fc7b08c73fcd45c34d3d9aa04ef14db19dfd66ef946c82a5a
SSDEEP 12288:3iZwbDzzFEoS2cPvyiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:yZM3zFVSOinQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1BE7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4ef39c02009ee6c3bf477c57a3e559a1136ec5b6f89b9f78b0451d3973057c9b
MD5 58ee52a6c7cae299b6bc8590cfc8fac4
SHA1 f38fa72a5b94745a9847fe764e518d83812467c4
SHA512 24655ada983cd258b069ced3ea6aec61d3d63fe3bdf4a472b28b10222446c01039a058799f3e764ddf3b87ad319c99aa9b8e9c62bbe5bc2e61f52633b724776b
SSDEEP 12288:czGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:cjnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1815523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8e1cd852140a79840b6197ea2213149eafc857cde3e9d77a0b12ba5df5f0f072
MD5 7680520858023e636df9e9d10b01a787
SHA1 05de7f366fa514ee2b4b7312951a2af8fe0e9573
SHA512 5b74fdb0a0036a8b841a4d18251188d415ede2c9b6ebc3bbfcee1955dbe3701d541c17169ef88a97a1a374d719a5353135fdc394bfce37679f3bb3ddda5ddf30
SSDEEP 12288:J/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:JfnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1855523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c1fc551e905dd0ebe490cd4291ae85384ef31f6efdde03ce02b64c766e7e2cae
MD5 1c42a95eec0ac8bb66c57348c1ad8ddc
SHA1 f90a1942d4f33d9b5c8e7bbc342301a732d17e4a
SHA512 ced5adf5e3fba31cc2dd5b35a4339e9d87c203ba5908fcd11135a140ec64369446bda24965318037744681845597e09216ee4053b802df556019636c9853808e
SSDEEP 12288:fyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:SzyenQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T13765021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 af6016dd5f1e8adf9585a8fa2a0a744c98bc7806ace499fc85130616fdd8a8cb
MD5 1398dddbd9cebea0c3081891b38a33d0
SHA1 86c3e09f65300072911c87a69f5492634281bd76
SHA512 106c0898e2440ad15dd6078337a29dc7cbf4969a864032245877342265e9489c7bdaabeec25420e792a3e6b81376c04123e691f506f0d283b54e0f43e0303e07
SSDEEP 12288:SzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:SjnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T10D5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9fcb699c40680cafbfac48b0bf6977cc907e1be151150a1402d63b6d4a6503b4
MD5 a630c215c1ecfc830617ba459ddcef4b
SHA1 b46a99a8f9e6cea6df2536def6620cbc34089c88
SHA512 660c85b0e35999ba99f51e1715ff1cd7b3e189716471829b4c281e54f34a96f09759524171c76fdbc1e01ac903dc781d2a096b3f9c36ec472193e8755fff9c4e
SSDEEP 12288:lzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:ljnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1405523697924F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 defb2c3bc705a9b4a858159477748638481b12dee7aaa810b9966f90c6534e77
MD5 f43f087ba73e08d986a0ac1205006205
SHA1 22e7f07a6ab426c0ecb690974072b0bbc38038d3
SHA512 e855aa585ba56f420c272b8f1c77e0cc98d2fe4839444c51847de63efb09268ed470045a67b8257912d23f75b1d2ab822041e9b63769bf26bb34b75a40bcd8ee
SSDEEP 12288:syPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:1zyenQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1C365021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c4c71b547480aa52094122281389d987c472487bb2cdbc70cf3763af845c5cd4
MD5 8f59a022b220700617cb5646a9b7f222
SHA1 9764d398d2949539339833c5bf6fb825e5a983bc
SHA512 f51c653dc035ad757ff07e7470abf5130ecc3fb3b82c382d31a1dd3e7225d99d25fdd4bb7f4aa301a62b4c2fa3596a5977676356b7c7bf1a673f031da0afa974
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71nNKbrh/8KBLnQ/tbw/2Mkjy6Fr7g0oj:8P4m4IpOO67W8KpQ/lFTjN4
TLSH
T13365AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9c9a29e5bdda3d5616f22425b7e3e71fbc2c655d0d1108cc83d2ebbebc499650
MD5 3040831524cc6ed2e1c365b5c57657c2
SHA1 c45f6fa3e847867ade5854b195d5cb4f7f9c9ee1
SHA512 e7f80b2da25c9127fb0d776d0353bd3ec7bb418ea3950f3e98658cdffccfb5fae8b47d774f00b5f4db9b777849afbeef3956c25124d21b3e165e4c3ad25e5412
SSDEEP 12288:EssfDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:qznQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1A465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 63a50137d98ce36655a5845f57ac39cb13a40079905c7748546388df54f89f32
MD5 da3c0f953fc8abbf244f0886738b7299
SHA1 17d1ab1bbe95ea0beb06a3aaa0997978488f3e4f
SHA512 88e5147db185e20705d3f7c2a657ce2644e365e8fbc7125ec1e64bd7ef7f24062c6abacc08eb968bc64717ab55ee48dc5ece429310899b05756b04372ca467b9
SSDEEP 12288:xjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:xTnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1665523296768F94BFA3B06B05892C151673F0EC5BF90D38FBB08222D967C3D41EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 885726e9f5bba844e0995f1cb4bb67a5645a8fa0a3f2ea95cb14eb91143cc591
MD5 29ce4b58f1b1b001e69b30f21f82370d
SHA1 ed05c47f07ec0f4c92bd821ee8f42024e418362e
SHA512 84f84842895a8d32c68c51d0fdc11cdb5ab1167cd35c2dec5a5defafaa6b797ca22ea2c4f0c60c251329a1a696c326c43e863d904c5a1ccc336eb4a7aa0098ef
SSDEEP 49152:ba0h2GEkuAe73q3pp46zwwQtQ/lFTjN4:ba0hNYG4JwhLm
TLSH
T1C5859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f141608ea6d957b329b351e05b3aebf7ac442158c098d4a731a9ae4488294453
MD5 4df37eb57b493626b095765e56939a9c
SHA1 551337c3155e175f8e7f663bf7ea85053a307556
SHA512 c16d47255e65b2858e18f68c1cace07b85f6118b4f681d98f9b8ac2d708f74697b726de83e7c29d1bce758dc1bb6ed689a9035b3968c23b23f52ff551618021e
SSDEEP 12288:WhbHjfXSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:WhbHjPSnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T17B55027D26AC30DAF63692BD88928546D7327C552B11A3DF2381823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 708abf681de6da52b92522b9e1670e2bf8b64b73ca98cfcdd4dd2b341f458f67
MD5 ced5baf1cb4f32836ffa1fa19c1aaadb
SHA1 97f59814bbb471bcd2f03738dd2de773ee690765
SHA512 cc057f1e9ada87a8e84b2a197c1c3227f12d2af6b17a62f4f2db18691045654499180c39135922e115a2941ed778769aaab071290fd40c42478ff3f33a061e0e
SSDEEP 24576:R3YgnJcRTk4yti+R5dBR/6nQ/tbw/2Mkjy6Fr7g0oZ:RIgnaTk46pBR/6Q/lFTjN4
TLSH
T19A45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 644331f782b531f453879339ccedfbb06c5a14d20575ccb9cfda8ffb0bacf77d
MD5 29983f188c6c14310c4fdf78e4a57f5c
SHA1 16558d00cfb71564386c500bce7754b57bf53207
SHA512 07df02d9581f58e447d2052995b3cec8d4df5b64c972ce441392b36c0fee0d2de921a8326ccd8d642303e15e9605f2245f6e4e38f2f090141284e7d41b222927
SSDEEP 12288:9vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:9PnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T12D5523687614F98BFA2B06F54C838546673B0EC17F91A3CF77482129967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 f4aa368ab7576189067e69ab651a306a5324af5948910cce584a3f959a513a18
MD5 1caf28deb05b225d046fb0e3204756ae
SHA1 9f59d065e1c02ca55eb0d1f3edd37686ab4a2a29
SHA512 55c0ae7b7ef9ca4e267ff07685ea33ba8719e9c2b5285ba163818b1f1a989543aac753c8a4be308a899ff3c94c2607716a4e407e581460275873331c42d874ee
SSDEEP 12288:pOb4A4LWOsvAYFTEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:ewL3UTknQ/tbw/2Mkjy6Fr7g0oL
TLSH
T14775F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 228a8ea022b11f1ef05651d08512092d8281698d550264a019dccf5e94fcb5d9
MD5 ab80c2397ff73f7d11aa14633ec2fc88
SHA1 40e572a0d3b9c55d80240003e6e71b7e1623f6d2
SHA512 471d3b446dfc66df4ac86985d9fe29ee9eb09f58389985c07fbe9bebff39e6db6f1917a2086689f0eb51c6415e430c36a0d404632f2056d74de91a4415a72106
SSDEEP 12288:fpFtCOwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:sOQnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T19B55022D36EC60E6E53A527C89838249D37278961B6253DF0780817E5F7BBF81C7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0ada49bfbc11af69ca61f26078e3194c6c01bc7e1fead7f1366b826e1d2c150c
MD5 f2978916c37efb01c2d2f85901e91820
SHA1 8b54ac010070a05467c0a0a14dc3b54cdf393ad0
SHA512 eef2d7508df501086893f41997ddd344541b9ca05a6b7d47d629f4a34d1bd950597385beff308fecce7ccec44f83fcde89f879eca03f748737e7d45108f622db
SSDEEP 24576:W7NM9YqZqmWMUkPjZM48Mv6bEhsjnQ/tbw/2Mkjy6Fr7g0of:W7cBWMpPjN8DbEhyQ/lFTjN4
TLSH
T121659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3c5bb4e74f603488314f9c90f71454a71bf52260bc98ec9e6730854eddc7f252
MD5 e58aa699b3b3b9cc9c4cd406d9244934
SHA1 c505317975ae292659d4e9172485ce52e73756e7
SHA512 2aa959ed9c40b322785751953d09a735e9763f0e0405cb1bf20ce12de439a8ecaf34bab6ff44f351d708aabf4282e0ab09c8d36f1daba94fdfef767090fa0879
SSDEEP 24576:BW6BApg2YuyuNDYTabvcdvNYf8km1hnQ/tbw/2Mkjy6Fr7g0oZ:BF2YuHNETovAvNYf8kmDQ/lFTjN4
TLSH
T148857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 df86ebc8680da9e6ccc010ad0f117d94d87f2adabdcfd5c04f04b0144c6e78d7
MD5 2a8002beaf6d296036bb59ce9b278133
SHA1 f4c48a3ac71ce2108da668931298ea54a3cc43fc
SHA512 f491834b6c77040f55f59e16f60fdaac33f8188c64f69d0ebafcb6528d1396e565c9fb4860313bfbec04b963040305892c37924ebf6e21425d1c9c2218f9c40b
SSDEEP 24576:qAFs06+Omlf3NXEbTo8nQ/tbw/2Mkjy6Fr7g0oX:zFs060lVXuNQ/lFTjN4
TLSH
T1DC65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ccad7d985af6bf4ce6b5e2d745c8b8f9e85c22e6dc5ea22873c4307502224a78
MD5 be189bae5571929f9bff3a58b96c1ee6
SHA1 6a5013ea00de76813690f40c5ca9fc9a412340f3
SHA512 bd8dc11a61eb929a526b8cbb3747395ab303efa2b572bc911f755c0131110ba36fa4e10b1a745cce2917ae5799e364f6b584ade4299147c8de4a9c1b8b278d8a
SSDEEP 12288:hCJnJ5D3VkrqzxTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:4JnJ5D3WaNnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1A675D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1ad52c31f03ba14416497ec642b215f9ad130d4c579e4613080edef03ec88c12
MD5 7433e795ed58c05ff9686783348b8744
SHA1 46602b27eb629802f9c800e22cc3e35ab4ca9b78
SHA512 639fc7f78eb5dfb9b85c37ef2f0d3066757fd1a7100589caa92ed4930a49de0eab7607c92d84dd6e7f6997a6e793b4355cbfc6a6e30397c2f238d344c3c0b47d
SSDEEP 24576:rEPghm6/7IIXdwcXrif7qQncjlP65i3Vu6nQ/tbw/2Mkjy6Fr7g0o4:Mg06DIKdwc+eQnSt65aVHQ/lFTjN4
TLSH
T1A0955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 af6a1eca0d0e41098b6fcd1e1ea539517373b890eb8c0e672c7380c9b8fbf23d
MD5 9ad00c70bdbbf720dbb5970cefca83e9
SHA1 347a488563bf62b5c6cc8c2ca5c1aadbe1f86801
SHA512 2685570b07500b436fe982dcd91f36d42f22895f2eceeddb74a0b538e58c2c7aae4ee00472933f9f40bc60fafde37f803e174a33da068825464502239a8143d4
SSDEEP 12288:kEP3RSJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:fSZnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B955126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6c6be21f75c0764ebf682564055d7904cdc0087d081a96e8cb586ee403adb791
MD5 78613b97d513dfe87229917b5d8d48a8
SHA1 966cfe9e1568c7402e43f28f3a1dfba4573ef856
SHA512 68a9723b8ab4b7417976f9bb22e7a902110db8ff1863031019eaa5b622e10aed015644474ea6cb2a1e95152a67f44d12e4f674c1fa8da55cca115dfd529a4dc4
SSDEEP 12288:CjkyCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:CIyCnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1056512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 47ac1537bd48d3cc6d4b9cb3ccf430560c18cd5294e9ae8ae748fe05413c4676
MD5 91168d3d24d0a78247bf9f3f04516507
SHA1 1d5df8443370c57d80a051952b2e27e8a71ff9de
SHA512 f8617579c384f13234cb9c80269d3d531ce8e9a1ad60233370198040f1cc814a9c4d308659a74f5d3da81d7f59e9744ecbcabc0fe119bd8e505cd0d3f8542004
SSDEEP 12288:L0gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:IAnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T16C55236C2625F89BFE2706F448928542973B09D17F9163EF36846239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2ab6b1fcaa49f31108825da6617f359b7cef9faf123ddcf13e0229b52ef68b05
MD5 206d11922ed7ab5d6d52cfa40e10e613
SHA1 1c87aee562ab7dc7b20faedfd5d11835dd04acf0
SHA512 bf7d809fbb4db721b5e3f7ab47575bd69fd3d91033d8f16e8c496af5c5581e7d18071f23e2be9acf7c68b0270dc6ad111daed643b5431b1834543bbfc879cddc
SSDEEP 24576:JQ9MxZKdcz9dw3bnQ/tbw/2Mkjy6Fr7g0oG:JVKZbQ/lFTjN4
TLSH
T195558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1115829cdf92c4d49caea16dad6817a0972e373fe5d080203cf3d4105a3c8882
MD5 2756cb5ac636897256e7e908881a1828
SHA1 b051cff1f59d99a54a44a698ded8c6c0cb160454
SHA512 05efbfa5f2f2b11e4e7e9678136496a2e2b02c336bad8c7f14ebfc5c4ee89827cccfba2a7899316085462b8af251483b9dabe8f967ceb796c3171d4d5fa81134
SSDEEP 12288:MyoKo20Rple9puGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:MyocSApunQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1AE65E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 36daa6211fa1329c42492f87caca46a2253895871af7e3a5dff81b27c7d3b751
MD5 60eddb98a595ac87c9ca7d7dc9c6d0cb
SHA1 3814a227b331e64b168b59490da52e49e6aa0717
SHA512 a1433de923765e474648efac613d94e166146fcd7375cd7f08f1c7dfbf1b4908bae832df00e2aa8d96795045394bb4208115c6faef5f480c921c02a55cb02eb4
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKuQ/lFTjN4:K0zuNIXLm
TLSH
T1EEA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 66c262bb1f262118f2222a03f3050efcd793763eb148bd8610d7541f6b6d744c
MD5 e07145019eaf838c21278073328ab666
SHA1 3ea53af2fa03feac41ce6d1e0ffe688c5a83cd2c
SHA512 a3b4ea74e4c1aaaea69aea2d55a3227b08c11a95e26085fa34d9716bea04ff6238b4989ecd5fa01bbbe34d161a07757d1f350470e352346f6404f05b270161ce
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYtjMqbZnQ/tbw/2Mkjy6Fr7g0oU:PTDxR+N5YzTfjMwQ/lFTjN4
TLSH
T1CC55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 cb7803f3a0ea4cb035ced1a8ef3892b3c3f83c68865ab42a762387c9e3ca13a1
MD5 9b3553592fd96dcf0e92ac1b83705622
SHA1 b2de4b8aa937252dac44c8905249526552b9c834
SHA512 8322812a3d6870f148a0d25a9c538ecac58c94fe3b244ca27e4c047ee0c41e9f2bd260ad1ac5ebdf4f816c0272def47f7229111c965c30b52a27a1e588dc5249
SSDEEP 24576:DTMdOz0FFS+1mSLFnQ/tbw/2Mkjy6Fr7g0o4:h0K+1mSLFQ/lFTjN4
TLSH
T14075E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 fe221d7603bc8f9fba23ec9c06e18bc3a69826ca587a2cd820d94c8b9c1cbb29
MD5 01556ffe95c8e944c673373a7c902c1c
SHA1 eed51838de07a3579eae442d7939bcf422b13e56
SHA512 5fb1cbb4c50dab230f06d681d7ba9ce677ad2b7a0bc5a9468d571d0e02ea483677c8153b9918d88035e34f72af1b915e0ed032d3b42ca2ac0f1ff847067489ca
SSDEEP 12288:A4TEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:XknQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1E555122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-88-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/556-157-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/556-79-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/556-85-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/636-485-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-174-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-215-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/636-181-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/636-197-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/636-364-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/968-138-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/968-145-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/968-139-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/968-366-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1084-20-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1084-29-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1084-28-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1140-418-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1140-173-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1140-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1876-149-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1876-367-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2032-116-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2324-394-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-373-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-392-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-387-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-370-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-369-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-371-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-372-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-374-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-397-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-375-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-377-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-380-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-379-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-382-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-384-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-383-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-381-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-378-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-376-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-385-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-386-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-401-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-388-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-389-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-390-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-391-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-393-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-395-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-396-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-398-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-400-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-399-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-402-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-406-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-405-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-408-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-407-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-404-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2324-403-0x000001DAC47A0000-0x000001DAC47B0000-memory.dmp

Download

memory/2684-368-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2684-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3460-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3460-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3460-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3636-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3636-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3636-42-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3636-36-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3844-419-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3844-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3936-70-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3936-64-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3936-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3936-72-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3936-58-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4244-169-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4244-436-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4396-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4396-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4460-93-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4460-161-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4460-94-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4460-100-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4476-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4476-33-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4532-276-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4532-122-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4556-75-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4556-152-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4620-0-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4620-10-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/4620-6-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4620-74-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/4624-417-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4624-162-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4672-349-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4672-126-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4672-134-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4672-132-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4868-165-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4868-111-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/4868-106-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/4868-105-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5084-104-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5084-16-0x0000000140000000-0x0000000140155000-memory.dmp

Download