d4fd61aa9a793c20dcb64793d8b32f9a4ea794f2fd9b1c8d6a8ae846a3b58225

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 8.9MB
Sample260629-e6ft6ac17x
SHA256 d4fd61aa9a793c20dcb64793d8b32f9a4ea794f2fd9b1c8d6a8ae846a3b58225
MD5 9f8c4e1399e2b962eccc110e46172600
SHA1 94a91d4efc875c83450ea0823aaddf7d95cc78e2
SHA512 59f1fc77d2f89881ad4c1be33ff0770a0a3b8d1741a77760b112984d0dc7e4cd036a93781b6aea15ea19fc811526a73505c8909169a80264f3ae6f8724adc99e
SSDEEP 98304:QAW3TxgcOcB5PezCSxHUo3kaW6GoOMDdxaJ97DwsCUa97P9inmJZNZ:QAItcddzIHiY7D8UU7VB
TLSH
T12E968D23F2E601E9F06ED1788B6A9232A972BC854B30B2DF075076551E76FE05B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2688	alg.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4364	fxssvc.exe
948	elevation_service.exe
1680	elevation_service.exe
4436	maintenanceservice.exe
3248	msdtc.exe
1488	OSE.EXE
1364	PerceptionSimulationService.exe
2240	perfhost.exe
100	locator.exe
1804	SensorDataService.exe
1588	snmptrap.exe
4932	spectrum.exe
1540	ssh-agent.exe
3064	TieringEngineService.exe
2016	AgentService.exe
4304	vds.exe
2420	vssvc.exe
1620	wbengine.exe
3904	WmiApSrv.exe
2860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\35030540f77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ad66b678007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c90fe0658007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059fab0678007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072255b678007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000d303668007dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018c8fb668007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4452	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4452	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4452	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4452	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4452	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	4364	fxssvc.exe
Token: SeRestorePrivilege	3064	TieringEngineService.exe
Token: SeManageVolumePrivilege	3064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2016	AgentService.exe
Token: SeBackupPrivilege	2420	vssvc.exe
Token: SeRestorePrivilege	2420	vssvc.exe
Token: SeAuditPrivilege	2420	vssvc.exe
Token: SeBackupPrivilege	1620	wbengine.exe
Token: SeRestorePrivilege	1620	wbengine.exe
Token: SeSecurityPrivilege	1620	wbengine.exe
Token: 33	2860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeDebugPrivilege	1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1400	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	4124	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1400	4452	2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	85
PID 2860 wrote to memory of 4284	2860	SearchIndexer.exe	111
PID 2860 wrote to memory of 4340	2860	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-27_9f8c4e1399e2b962eccc110e46172600_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\149.0.7814.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0x1407abd3c,0x1407abd48,0x1407abd58
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1400

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4092

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1804

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e875d5528f444842e268db645ca00fe29163609a313fbe8f22663604f647fc4e
MD5 36c2a656b285e5c024e130a2e1d4b833
SHA1 3b98a09397183c5ee90ae7e08f36d4e7f39ed250
SHA512 e14bddf0f4749c2b0f0c7e6b80b52f96d1c067c54d2b4bf1a6952cf6cd5cfa6298957313b36478bf37ea27146e3b7f5c6d642389339a371e4047e52c99dce6d8
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNarh7P9inm4uLZOkZ:E3q6HjBma97P9inmJZNZ
TLSH
T1EAD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 bddda32b69c6aab21c459b7c84285a390bdb5fb5020290304b642649b06346bd
MD5 5bd0294b3f1cd4d503c184cac5434b44
SHA1 255d3374ad27e9af086bceedb380c76f3cf33773
SHA512 025a1e1c3036343d018e31601e0d6111dd6adab72ddd0fd21aa2c5e9157a6db9b58fa525da3431a06f3d134ca965481a397fc1bfdcdc1a202ac129f206ed3d04
SSDEEP 24576:dXYfDtczAVMar1PcYc89inxLs3EL05q2Z/IrCFFZ:Itcjarh7P9inm4uLZOkZ
TLSH
T1A8050128A7A408F9ED678278CC928511EB337C5447A0E79B03E499261F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0c1ea11ceb6338bcf4016d96d4f1e92961caf858558a7a2a100ab4365ee78a61
MD5 d5ecd1c4e84c64552726fba1ea85a11d
SHA1 63d01647a482d55f6b7d3ee4d23796755381f480
SHA512 03002417064691a9c1a76ca4005d08dbb2ef46fd9fa40ee6e0fc8e6e6a98c82c49a50da5123adb756fe174f2c24dbbddebc45e9ed692b9a552bb7578ca22672e
SSDEEP 24576:10Le5ji0hmxirM8Mar1PcYc89inxLs3EL05q2Z/IrCFFZ:1Pji0AcMarh7P9inm4uLZOkZ
TLSH
T10135AE15F6788331D073C0B9C5D2A69AED7230855B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9681d36c59741d092b592977d1c061526a189d0c858ec3993148748da292e72a
MD5 b5198ce3277ff052cd00594489841a7c
SHA1 ac7fc0b3d5dff1dc51c959bd94261cf2a7da32b3
SHA512 dfdec5e9623583b6801255602f8e8ca625b1e7b612c4e1570ec1cc9fb715eb0ef4b6c06cf1a1bc15879dadd50b33f6340164be58ab193e666575ec9260dc69de
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyuqMar1PcYc89inxLs3EL05q2Z/IrCFFZ:K/ezSC6vUzPvxHjyYarh7P9inm4uLZO6
TLSH
T12B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cc720c18d9a5295f8616ce975ecae60e37a32d9bd5734f4bde134c0ebceca692
MD5 55d33ade971dfcd7dcbb3fd583dbac8e
SHA1 e1d7dfa9961a2e50a833bac0b04a6c178ef2e068
SHA512 ed543eb2e4bc24eb3f6723110d3bde33750b411d0700e854ec6a691ec21eb2bbab08f290efbd6a4f80a7eed08742fafd23e7af1a0493554a3404c5306d6d84a8
SSDEEP 24576:MVbqPb88hv/l+6RMar1PcYc89inxLs3EL05q2Z/IrCFFZ:MVO88hXl+Rarh7P9inm4uLZOkZ
TLSH
T15C559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D72C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f3bbfb3d889fa6926b9c442c4bcc34bc1e88c2adb92e04451c005f8bd5db6bfb
MD5 28607296952f484a2a75c70f190ecd65
SHA1 ad20ccb8fd6440b27832ea079caa460e42471075
SHA512 f496f18dd6a65cbb3b88675b6a06b5dc245c5b0209756d3f45366affba10c36c43dcb7f070fef5e1667eb1bde158dbf550856aa02e44c1871b0f2d88e4ad9b31
SSDEEP 12288:BRYTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:BRYMar1PcYc89inxLs3EL05q2Z/IrCFj
TLSH
T1E7C42311CB1D50E3EBFA177079898020976A8EAC6DC4DE13F2657C1B85FCD98AA37103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e31eacd6b79c18c95377d47563583c7bc59b791accc24865609d97052a1d003d
MD5 28c7130dd4a4cb0ae559b612ea5fbd95
SHA1 091e73aa946acaf97e582571df8c0ab9bf0cc509
SHA512 cda6e08cca54a125a2001558e0a28a05e36ed85418f1bf5d84a708dd42929c1d399c4ae14539d8446b7fb65dcd1c7040972a63578ab5989326f7e14242304aae
SSDEEP 24576:rJIUJMar1PcYc89inxLs3EL05q2Z/IrCFFZ:rJIUearh7P9inm4uLZOkZ
TLSH
T10E05CF3BEE28FCE2C27A5DB85A918200D77278704F51A3CBE175820EDE275E45E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4c95b7cc5ed114972d46bbf6ca86c5be13ad904b576fd56afd1f5814345e2569
MD5 cfdfc1bd6a992cda9a8726ef6be57264
SHA1 1e3c716f37a3d4c5821748c46f3ff0b4c31ea7c1
SHA512 5b8e9acd638c01387b31a1a4e2ea63b2c548a502e88d22b823dbd54733c63ee3447174976efe4d1183d9227d534cc99eba8997edc35a31895f9f7c396ca3ef64
SSDEEP 98304:dQvGAdlCEL8c/yRNw5CDa97P9inmJZNZ:avyEYc/y3w8DU7VB
TLSH
T10D267C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0fe38fef978f6dbdfe5ab62a44ed5ac9864301ee7788ccc9825cae90d5021aef
MD5 eba906ae0d40974604a81e100c222256
SHA1 24951718e73425e632c38865ab11f46f4937a5c7
SHA512 0c353a080b3085b65117fb63787123974e823a2b460d50759b58c56a204c3acf4d56ffd52567ec1328b7ef1d507e9fedc514fd6ad77651f27aa6cde253651bf1
SSDEEP 24576:0dewsAj3Mar1PcYc89inxLs3EL05q2Z/IrCFFZ:slj8arh7P9inm4uLZOkZ
TLSH
T10715E031FE78E032C3BB0DB22B26C716542D7E204F911AC3E3A85D9E59746D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b7ea26634124760b1636733bda576bf39472975e8b580d7d41d9d5395c52e637
MD5 7462e0836b24aa931ba6b325f78f46f4
SHA1 1655868a8e06f6725f4e7d81cf51a3afd64e7156
SHA512 c4cec218724e2373866f76309feb9c34ed77551c7c4b58210906b2b05657b7abd795b9ebc5227925507730f5a7968db5f4063de1122d95f3c84cb4c4b26ad5cd
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0U7VB:wUEtQevvqc2W1cpV2EI320U7V
TLSH
T10E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7097f459d4094e850af44b4c5d8e8198a6dc97f9d073f59b9cf3c22361599acc
MD5 e4fa8ed45dd69f76f88a9891e2132040
SHA1 2eb4722f5ba85ac58f769de9484d6dab20c89b50
SHA512 1b34503cfde7798a64d423d782edd1e29d023e2f078fbc6be3fadbf6333d2cce8133350b02472456ed80fcb2abf85132213cba3a55403840fcaed01b25ef819e
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/zcarh7P9inm4uLZOkZ:JoqtVjnmva97P9inmJZNZ
TLSH
T1DDD58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ea61b102128061a95eba802716d3436a007cd007acea17665788d489017e325
MD5 92cb463f9257614a7ae71abd09684ded
SHA1 b52f1f6661fdd061adb96bdf213cab261849d38d
SHA512 0abc0976c519185df8e5a05b301502d63f80df81a2bcb685d0539877f848e0595a8acfddb4cd299a1a01873061612aa87d7bacc6605bdf64e9e78581a1cab0cc
SSDEEP 24576:lAhGLJIFoiwtA5l7S53+Mar1PcYc89inxLs3EL05q2Z/IrCFFZ:lAMyFoiq5farh7P9inm4uLZOkZ
TLSH
T10F359D81E7F955D4F5B3AA78A9B68170EA76BCA95E31C20F2160D11F0E37E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 bf7bbeba2191a723c656bab7e0439eef1b396766f7302717982dc803d70f99a9
MD5 d559dcfcaf3fbc027ea2c9868df207a1
SHA1 47c189397d416bf5b22bf911b2ec055b8c97d7a9
SHA512 2c18cb376e8b2955b5dc6df3393ad3d26c0a8f7f686ccff1a4b0b9f99a5cc655fd11c6f8faf8132bfee5d7ca42966dc177606c539b378afb858a4db41fd6dae6
SSDEEP 24576:kwuoOWLMar1PcYc89inxLs3EL05q2Z/IrCFFZ:kwDO7arh7P9inm4uLZOkZ
TLSH
T10505F10577A90CF9EAA782388587C131F7B2BC152A61DB1F5360C61B5F77361AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a524ba1b9a7591054a05760c924c7eed99a31659c346e98e9afaf181e5d8a563
MD5 6a65e81d55c9aa9819ae9e9911174b02
SHA1 557b44ee86fdfd933fbf13a2d02ca450590e3131
SHA512 35539d905e671e606209a56529d0be7d0c8add36f25435806553e3ff7c425a359578f4488bdde0e8d68156b0ee674a1b17dbe6714a4d9bc645467cd6e308d261
SSDEEP 12288:cBZ1IyHTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:qZu0Mar1PcYc89inxLs3EL05q2Z/IrC1
TLSH
T1D7E4121523AC20F6E2A75378ECD54200D7727C6927B183CFA264591A5FB7EC52E3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 621c561668164b98c3ce8993e75fca97f43d7e6b7f91c68a19aaf9039057f7b5
MD5 d0f5a55465cb82e98badd568e93806f8
SHA1 2600f0fb5d3bfc358f600d6c81fa028c7f3f96d0
SHA512 70429bc27b212526a1a9125732a02855bd586b789e8852e40bea44152a06fdc442ad91abb7912a3fc4331c1219b4e86da5dd145c6b6bc2bfb2d27f89c82c19ba
SSDEEP 98304:UQRQyi36YOcPQLvw2gAf+PN3qa97P9inmJZNZ:7QyiKayX+PN6U7VB
TLSH
T1BB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 312e489bebb224a461f6e851c08b26504c8d531fa4e172080ae1df3542dcdd9f
MD5 de2ffe9d4f9a1230b4f5eedaa73458a4
SHA1 e4db65a039869e43085c52c9aed21eb6ae95db08
SHA512 8fd2dd340f060aa6dfb468887fa5fbd242669d0e33c8af375d81dc78f0d386952008bc6022133ee46339a4d6e07eba2405d821a445a0047066bb2b6af7704b12
SSDEEP 98304:PQRQyi36YOcPQLvw2gAf+PN3qa97P9inmJZNZ:+QyiKayX+PN6U7VB
TLSH
T1D0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d33792392b03485b1d4378bde98ff6060c1c9beed9b1673ae6f37098db23bb87
MD5 567d5466009e5884511914b781e1ec4c
SHA1 875b05ce4b10085c0c62576957af2eb5dc2349d4
SHA512 0b2e99cf787f6b197b6d7a1a46eca5abccfc1debdb35eedd7f13565fa7c2f37d261fb117d755d38ec94b26467078e3994397afa3aa9d9e01334997469d2b8e54
SSDEEP 49152:v68Qg55nhheWu7PNU3/Marh7P9inm4uLZOkZ:pthWRc/Ma97P9inmJZNZ
TLSH
T198B54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB815572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6da77061d3b76008e0a6b46c55b12c5196a13d084e4c25e21a293fd8afdf8854
MD5 34b258554cd780b8701bb1f544bb9708
SHA1 ccc40fcd1f6d4ba1e41246e98b47c055921c45b4
SHA512 562b4d9f30d8a7dedb44fe33f7a489d0f8c6e75d690d8d3bd95f70911deb88c1d4627199506941ca90dfdda2d793ab3a6a85ba893b0dac128fc33d09fe7a3053
SSDEEP 98304:ny5112gYy5azzVvL69nLKnhZpa97P9inmJZNZ:6LIHmWhnU7VB
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f0fe15d4fb1edf3720a84972509c00196cb2d4a6b4ebf668a51a059473676af
MD5 eb061e4b0f4c440ee5467a4aa36ea2f2
SHA1 548ab005cf9b33c5877a2d4f2c6524d112901b14
SHA512 979f329eade04dc046c7ffe8bc7019a8b8260f883e8986b274a0f132de94918ba4ef20400310ca0c8e9b1d549137df30a165b3cca63154afba3c563c1c4f287c
SSDEEP 49152:+B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyarh7P9inm4uLZOkZ:su6JmVxd2dya97P9inmJZNZ
TLSH
T1DED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a79cb106b385ba57c091b91fc626f283d63d9e03be05dfd8ffec0623f8507782
MD5 482bdd18e8eed0c5fcf54c99f69e3d14
SHA1 c412d6746ce21d99fd13043f5c531a1e19ea8e46
SHA512 a11eb3f6f277440f5972dc4a44696a5b65322497ef296242cdfdae68b5d4f2a16797fb96ee5374bd2e8efa677dd1207453ed2cfd9330d85a0af11854050a3d92
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4x+arh7P9inm4uLZOkZ:DmifPbRva97P9inmJZNZ
TLSH
T14AB5BE13F29900E8D06ED17887569232EA62BC450B34B6DF0690B7961F7BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 704ebb1ff55dd654d3b7fb2743309609a987a6dcb1f9e6e9fe5f868fdbbcdfe6
MD5 6db6bb7c0d55bf3ed9e18e34f812ee8e
SHA1 4ccb9724c0a3a9cfadeccee241c57f646184faa6
SHA512 3f6a817d86fb45876b10a528659883539435b125eef1306c4690b00e44f29d8386347651f319595791bc8adaa2a264e1cf921991e4bfb6a9649d9ba3b75e2309
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHq9arh7P9inm4uLZOkZ:s5dKTi619a97P9inmJZNZ
TLSH
T1DDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 145bd4e4b092d52ce312f89bf646e2550c66f8933a9665be1cf0f16314f209ee
MD5 17b505a4d60be8e4e49b8b60ddda4de2
SHA1 749b6cf7849a48530a9d827c95b61f2195149dd2
SHA512 ad264b019458b8c93b2f2a5b63df01da98b920510e7e607dcee8ebf12f2f1beb85e327f5eff58b11f7064962f5fd271792df8a943a3a4646189b2bde8ad39e0b
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5wiarh7P9inm4uLZOkZ:jX2iyphba97P9inmJZNZ
TLSH
T1D695BE13F2D901E8D05ED178C7468632EA62BC150B35AAEF0A90B6561F7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4d6410562a084a3295db06044563f9debe0b40b63184ff087cd678f39266ae68
MD5 0248a7aebc9d79ba1b70709b528ceb4b
SHA1 9d1753f31d29a09239d326c0fee837387facfe76
SHA512 967135c9db1419f505f0dd9a0511d2ab46daeb244fbd3cc4b23ba63ddcbc16fca256adb19f52af1c4e9de2bb6123f108f53c5c142c089dc4089ebb090f140a06
SSDEEP 12288:zwTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:zwMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T191C42310DA1E90E7E7A553B0BD894120D7695EACBEC4C563F3693C0B9AFDD982B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 25b1463fee6870ec7fb3c22cecea8e91a8699be5f963685dc2ff467491981db9
MD5 735f2c31ddf737eaba09b8f1c57818de
SHA1 57b6bb259d2f97aa926db08290f3c89d65e43d63
SHA512 17f2976552c16a9a98662db3a6bea6654ed37c10e669b6a6d9935e5cb26757a80c187688880b7139da055029b7ecd6bc5150f932db9652f4139a40c97a745a7a
SSDEEP 12288:JzTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:JzMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T195C42310DA1E40E7E7A553B07D894120DB695EACBEC4C567F3A97C0B9AFCD982B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d421462621300eaf94d31ebefd1c7d0ef1b78f8ea3d446cb0bc959394481d696
MD5 641748b565b0958f2da64c562b7c425b
SHA1 83d47ed1910401557616046a8352a243ed524d49
SHA512 5729929c12bd7bcb290f30d21abf00dcd6492a40e12619a32997c272f8c3d625b1548abbe3e69dbc1f98001949a7545aa64ef3ad93702c82638be17589073ddf
SSDEEP 12288:3BTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:3BMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T16BC42310DA1E50E7E7A553B07D894120DB694EACBEC4C567F3A93C0B9AFCD982B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 634d71fccb2253ab12e2507db322115bb4186ec9f21014dee2dee21b71bd2973
MD5 aaeb78f14febb70168c4d7c45fba07f6
SHA1 58d049c32b6e1f064916ed7527d1ff1383c09a42
SHA512 9ca7b10d1c77fc91e425965b2f5c04440a6a966c28db59dab886d56870c18d8b6cd5bd7c0259d424b03cad887a7c229423a6b8c1add549fa5dce9daaa2f3d611
SSDEEP 12288:cVeTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:1Mar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T1DAD423119B2E40D3DAB59370ED868110D775BDACBBA0D69FF3502C0B4EF9F942A36642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 bdeae9f7e21b73c72ad00cc3aa9374aa88877527655c76eda40472f62c09c56f
MD5 59a34ee28c1882876cc2373919ae0470
SHA1 08c5496da39938b30f41e25bc74f52c1661a573a
SHA512 e9f1afd8b3217c7e75b71a7d99a810f84ca8a72e9401d341b419fcbe1afb4963ff4cd83fb2f8b3395f598bd92b277941b8336afe7a2a501cdb6ca11b778567ec
SSDEEP 12288:1GTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:1GMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T142C42310DA1E50E7E7A553B07D8A4120D7694EACBEC4D567F2693C0B9AFCD983B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ee52da947684344a3ce30278df36aff511dee09c6c776c59037f125f136387ea
MD5 89bf6a75de46390f56f50ff5758babd2
SHA1 e9ec3eb7acd556b16cf42987748149bb8574ecd4
SHA512 3bcfff6c0366da42b6c231f5e4b62951e19432a1bcf35bc01e5a2961b9b4a854fbbef9bce10f1be63e9ffefb76eadcdcda4efebe459e1ea97cbcb7ba96942e1b
SSDEEP 12288:pPTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:pPMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T18AC42310DA1E50E7E7A553B07D894120D7295EACBEC4D667F3A93C0B9AFCD982B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 87e16e06e73c3141f9854548304f97bbda2aed0551442ce1647c098a2a4962c5
MD5 71d2c04b2edf06da4daa54770f28786e
SHA1 baaf758f6969abc4a0069d86e79bd95599b55676
SHA512 4e1ac7efd4e0935a582dcbd01ba331e81955891be63bf60b06fb70a4b940a1da5a2370926a52015aa1ac56bc15ca819a69361fd31f07c13d604047013cdb2f8a
SSDEEP 12288:f7TgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:f7Mar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T184C42310DA1E40E7E7A553B07D898120DB695EACBEC4C667F2697C0B96FCD983B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 192f375bf119ffb8ea96313fa36a238d47ae22f020db6b4427b0782cfe4ddb2c
MD5 9d76ec678e0e50b4bcd8c50c406b39d2
SHA1 79488b3d957b50dfd98c10f412034e7193169dfb
SHA512 3accb129803db338ff78fed3e3a7adbbf99fe1e99ea4157c1ceb8918fb8a07d9ed2df29b6235617d1672cd9105d5b94a469603ffd268c779ca89f4a635003fc7
SSDEEP 24576:9ZMSzFVSOTMar1PcYc89inxLs3EL05q2Z/IrCFFZ:9ZMSzfUarh7P9inm4uLZOkZ
TLSH
T1BF050154B35418F8EDA7823ECD458901D6B27C690BA0C61F53B83A2B5F737A01D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 ed5a756f371f16af6cc0a90d04722b639af7a91347acade1a3468b6500288f80
MD5 f9d93b0daa6b211acafa7c79d15f750c
SHA1 95b929b54063b34bd5e2e568abbca6f90174ff91
SHA512 c08c128539d07102741f17523929a6e6f5a2af470aa87947c4e32416b4c45395eed3a751dd95500571c8f1eb8f400cabed0444b1e1098a32f016905151e8f0b7
SSDEEP 12288:1ETgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:1EMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T162C42311DA1E50E7E7A513B07D894120DB694EACBEC4D667F3693C0B9AFCD982B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a2e41c90e7685b936081e7b19334c79c0e38cdef99ee29dd1f23dceebb785e32
MD5 8317a777cab33f25f15334a0babbea33
SHA1 e5323a5e9bf0fb5d126fb95a6865866814b8262b
SHA512 4c942e73efaf6e56aed6a03de2fb458b1fab43bc1fde433ebe05267689a4c17a4aaa925c4555d80aec32be41c830301f2d8faf090fb874bd55da3afc75747884
SSDEEP 12288:UoTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:UoMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T119C42311DA1E50E7E7A513B07D894120DB695FACBEC4D663F2693C0B9AFCD982B37042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4e847dc7e51ad9a832f52caff9b28cacdaf0897cf151f0cf79bf8f372e4d21b4
MD5 b19ef6cad574880edc6ad2e22bfc6f59
SHA1 db481e8fa46645712402bfcfddb2ffa332481414
SHA512 c67baa442140beee997f5c2348a427ffdc1fa78179f5dc2aa4bf8c384a5283b611ead3b41da1d7d333e43939e6041f3215fe404183d52be4de26a30d3491d546
SSDEEP 12288:QyPz5L8HTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:hzyHMar1PcYc89inxLs3EL05q2Z/IrC1
TLSH
T164F40213776930F9D276933498820600F776BC355B608AAFA3A41A371F77AD06E3B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 803386e7e6f70b9ac896e720418f1e4747b82a3eff60c9e3ab9fafcbd141c159
MD5 903433476b3ba36e43067b1a04cfb684
SHA1 e5e7af7017454fc540e6e590feb570e7642c31a0
SHA512 0e1b643dd71456605d048562196ba24873d80ce5f5e3b835626ad91d96a41a30455c0b8718fb25b03010923a176c0653ece1cce22628431f2a90caeb78a6d750
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71nNKbrh/8KBsMar1PcYc89inxLs3EL05q2Z/IrCFFZ:yP4m4IpOO67W8KDarh7P9inm4uLZOkZ
TLSH
T10A65BE2DABDC0096D0BA917485658A49FAB1782E2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 424a48c78d50ab885ce087996ef861bfc7cd3dbe93cdcd006422a3c61d82fb0d
MD5 d23f191946189a0c947aeb8ec88911d3
SHA1 c3d0d030516dc84be9a7e2d1a7b66ad3c5bbde57
SHA512 4b0150410027369afaa5213129829a760e5618dfd37b1034bbcb3d9ee2396c64916fb40d5976eb00a40cd49f6b137a5a58cfbdd25de03aa1b2cb4a7aed08afd6
SSDEEP 12288:jNsf0TgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:g0Mar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T18DE4F119D25801E9C16E6274DB464600F3377C6997E1D3CBA3D0F83E1FBAA945EEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
Size 2KB
SHA256 49fd6ab50d07a977abb2d51f587e11002196c150a38578b1e44d27a4d4ef8e1c
MD5 ad34dc7fb6e13ebdd91b095d24de591d
SHA1 a95cf5b7635a8ff2e3cfdc85ac6ef301d614c330
SHA512 6962d6fb15360864ce95532c249165ca750aa40a8738588467ce489301ca4f691a52044bcbc59111496353af216acf4d107a7386319bdf6cbe735a4ec46edd96
TLSH
T13741E1A2A543C6A3511CCCB73624156F55F614C487C2223073DCE96C7897C667ECE66A
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl
Size 1KB
SHA256 6951ac0aecdf1ab90fb39ad0f4ec09964154159b376362aa048ab6a86193a5d4
MD5 46d79a9e855a89ab4d2bdd982225ddc0
SHA1 230b6bd8be136138acd5f3e52e9adf86a2ad3870
SHA512 31682ab3838e76e404cca38f14e26f0fd04fce6f7c2bf1a8ccdbc70009f5c108d20b0950769239735ef07b7720b0a4ebd8b09ba36151c610bab54c8877cd76a7
TLSH
T161214482B052FD21FC2E51A4B2F529BED1F21008D6E547843784DD4C2ADA88F78ED127
MD5 SHA1 SHA512 TLSH

Submit Download

35030540f77cf242.bin

Path C:\Users\Admin\AppData\Roaming\35030540f77cf242.bin
Size 12KB
SHA256 a206f47d5c8bcb09c795fd6e87920af3cb6c7485235529f8f8c14353dd3bee14
MD5 379b9befded1b52e74359c72eb221e0e
SHA1 f2b51f7a8e45dc5a1fceb9868c3e3b707564aaac
SHA512 b8ef393fc769b14deef185f50cb0d3efd137b0768ed7c81f665df2a25689a7f072fac46b662c8acc03b3e5ff2c4385ea4b9649ef17b6afe9fddf4e37e33c11e8
SSDEEP 192:cBXKpMhTS4RQPYPCtG7HdRcQX/DWaC5dxJC6SZoILTP/2uUGR+RAITdbUH:LiOWQkBGQXK7LInP/dUG0RAITdgH
TLSH
T1C642D0AE748AC4AAF707951B45A31541D8C54B728CAB6FB4A7AC03CDA72C83522F8374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a03f7e2ab5c771aa1e8446e0e00ef2ef7506b59508db793ac60cea24eda7d7af
MD5 fc6430596689aea06a107dc4781472af
SHA1 27ff0a75b3505a1b3724a83f41327dfed6e7ad96
SHA512 ffb1555fcc7901072e1fe9880d02d5719719fe800af236ea7bb2b9b61e93d95e0818a0782f3bd0b19045f1f90c97447ca5cddf48ba244bc9613c2aca6b1859b7
SSDEEP 12288:nUTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:nUMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T10BD42311DB1D94D7E7B967B038898020A72E6EBCAFC4C957F254381A9AFCD946E37103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d33055da29651b7f86c893a1833bdd4f78dc4e6762e06a08ab85f51aaabd85a2
MD5 fdc9480c21b82a06c777bf2bb8937531
SHA1 79bce3f914e0cf9f87a75d50ba8ebba55af39752
SHA512 3d46590af1fcbc479bbe34a857d786a04e10cc4821db94c538b29c523b73a995e51bc1ce286f720eacf5ec42774f446429e9d34790371301542ae1151a7b45b4
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQHarh7P9inm4uLZOkZ:Ya0hNYG4Jw0a97P9inmJZNZ
TLSH
T1C685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 98f751987949c1e4380423b6c196bdfa1281e0a690a44669bc3677437bb2d9ff
MD5 d25da82dc27ce5584276d8b8592c8897
SHA1 e789c58d66325291d2d2d7a5e3914407f8d0dcd4
SHA512 9403012cb2ba9e308cb351b3cfa406d0b16f075462b38b0dfde0a21f4b40d29a931156cce2b46259eeb6ecbfe87f26f65c76b7c129f1af97adcbe625797c51fc
SSDEEP 12288:4hbHjfXnTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:4hbHjPnMar1PcYc89inxLs3EL05q2Z/D
TLSH
T17BE4123D56AD20D5E6B1A27CA9868105D331BC292B10D3EF63D1913E4F7BEE81D36B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8fad45827217a08d710e2663ee4a838728ba867dbd722e203ea9e3e4300e0f6a
MD5 fdc4a51089b560de479bf3581c36a0c5
SHA1 c52d0981e9b8ac59afdddb01ffe4d90f5f6e2e69
SHA512 429702a01914d0f7435399463af4c70bb3cbcfc405100188cfb83e31f091482ca0dfeae11e4d3f73ed8fa31caedd55fdaf87919ae768732fc399d5374f8007bf
SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/LMar1PcYc89inxLs3EL05q2Z/IrCFFZ:DIgnaTk46pBR/4arh7P9inm4uLZOkZ
TLSH
T1B945BF2DF2B910B9D8AAD236450143B5FB71782D1F209ACB4170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 687b166e8f2fa4fd5eebaef29ab912bddf3eea37b631d30fdde8093e397cd84c
MD5 8756862b4d6d1cb1dd6275cd9ffeee6f
SHA1 d01ff24ca0ee75367048d71a366eb4ad5c1812c2
SHA512 a0e958623cc93ad60f84ecd1d5eb4358b54167740801598c3cac19626b55f0f6d2466a1c70454e1961dbb499c94b67ae04680e9a6815b5220653f4c38fefef4a
SSDEEP 12288:S4TgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:S4Mar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T17CC42310DA1E90E7DBB557B0798A812096195FAC7FD08AE3F1697C0B86FCDD82B37142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 686624e4920ea7c319b7353b178657c23acfe691acb72aaa06e2ef4571441872
MD5 666e269d25362b0d37e42f9bbc414e4a
SHA1 f80b1fd470765c6e4e467e190041bf33bb49ee5f
SHA512 05d3b9f936860ed06fe8eb956ff656b8b252645bc76d824be6821a9864f2ffa4259367d8b0e11c0b474d0854769199fa36bfdcb9317d8baa6ca20d0d93e72e79
SSDEEP 24576:CpL3UTVMar1PcYc89inxLs3EL05q2Z/IrCFFZ:CpL3Uearh7P9inm4uLZOkZ
TLSH
T1AC250115E7A800F9E97B923CC9A68512D272B89C0764E7DF43A84E261F737E14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 58fe2371cb9f48525e79210bd63b0fa45fde156c3ecf3923e6596af1828855c0
MD5 fd0b9e42546e582c3805312e31793164
SHA1 19ccb2ec5761eded9b60adb9fd2a4c95f8a84029
SHA512 86f0934c73789b15f6e3580405f9017bd546a72b7a50129f84c8978fbecfb91caf0eba658b6cebf74197545646fda513a9e0dac124b586a36f5e069abf67609f
SSDEEP 12288:ApFtpOpTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:COpMar1PcYc89inxLs3EL05q2Z/IrCFj
TLSH
T18EE4121937AD10E5E175A23C99868208D372BC691B5197EF42D0843E4FB7FF86C3A752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ecd418e44d1c64d20106a994dd8854e2beeb5a26f897f2599dae603abcb13848
MD5 fe1a1f25443b132043615bd321319f63
SHA1 7e78397cb000541475a564c43d090ce9bf2f6f52
SHA512 8124a3933868b761db01aa9ba96fa5f6fa83b5d7285d79f6235248e251967f7cac44a030e0bfb2a8dd93f74cd1137126d0ddb14cbaf248c1a7cf5957c70126b6
SSDEEP 24576:n7NM9YqZqmWMUkPjZM48Mv6bEhsEMar1PcYc89inxLs3EL05q2Z/IrCFFZ:n7cBWMpPjN8DbEhAarh7P9inm4uLZOkZ
TLSH
T1EA65AE2E6BAC81E5D577D13DC9D28205F2B1B8611B318ACF5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 00d700e9dbd06d84805e424dbff6e2393cad027a5f302da7e945d9214dd98f72
MD5 202187298eb7dcf2fe9cb2f76ee5e06e
SHA1 111f54986cbb8f24267c68badcbefe7ae7fb4b9b
SHA512 ee950edb7c6b2770cbfe410b96f3633b37ea4f0657b38fac5f6371df62c341f0895f0f49780615d1e42e03c2ede90e74980a15b7b3d7c663b5ebf975ae1aca6c
SSDEEP 49152:0F2YuHNETovAvNYf8kmNarh7P9inm4uLZOkZ:B6BCf8k+a97P9inmJZNZ
TLSH
T104858E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 62ed3cf9e6fd96040ef46e866e7ea95883b2671704d75deb0edc858234c2c1c2
MD5 67fe9922c22e37bdfd0faa3de30a2221
SHA1 c0909ba71fd2a15126d083bb0379d901ac59bc1a
SHA512 96c86a2d05a6c51113ea538bdc5c377772a7466138e253479e0d4af70f3742fe7427bbc13fefea2f346d632e455cff85a61d0d947bd5fbdd9e71819d24e253c4
SSDEEP 24576:KAFs06+Omlf3NXEbToNMar1PcYc89inxLs3EL05q2Z/IrCFFZ:TFs060lVXunarh7P9inm4uLZOkZ
TLSH
T1BE65BF2F62AC00D5D07ED17D8997C91AF7B1786707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 10e510413a87ec8e01d194e0c05974a4863d8516a96e6212d8a3c68261badca5
MD5 672591038574d70de8b79bb066703897
SHA1 97de71fdab25cb4f74b2a964aeea7e1f24d8dd66
SHA512 7063529e23373177e251ca9c5bc3443e80719c268bd4f8fec77b74ee65c849720f8ad513e2a562ec1ff29545c4b272d9f0fc24668d8c375c8d9237f223fbbd9e
SSDEEP 24576:4JnJ5D3WXmMar1PcYc89inxLs3EL05q2Z/IrCFFZ:4JnJ5DGXnarh7P9inm4uLZOkZ
TLSH
T11315D02DD2A810E8D4B7C374818A1655FF72387D2F226AC764B4D5357F22EE0AA79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 edd25d07206c5b038e147f2b150f1bb4ffe133e656b58f2481bd75a339ba1928
MD5 54423af284da06815bd33c0d968a87ca
SHA1 34d50adf0d2356d12e467b2b1921a3331ebfb774
SHA512 3bab5b188c9a7ad86aec24ea4307864573cc59dd4c44524480944ef59417c0f1bf1244e0abb782a85e3f78afa6c845c1ec1657cc394d0c43de9f5c1338ac41f5
SSDEEP 49152:6g06DIKdwc+eQnSt65aVRarh7P9inm4uLZOkZ:TLa97P9inmJZNZ
TLSH
T1C7956C16BBEA5294E8B3CAB1C96291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 0f5d9165292a9d9c7b0cc693e5227f56cb436524d9df79b145f20e0f69b11dc4
MD5 d98f2abd9ef533f8e73f3f876df810f1
SHA1 74727861936a7376a66afd8b4cbca8d166fc6fbc
SHA512 c9d52d1dd19038ad65746f7de046caa5e380d05075866978e450afd5754bcab4b34a10ba79056e84ec0e492231861dc1b6e8f460f65f78d04310113a877eea8c
SSDEEP 12288:oEP3RnGTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:DnGMar1PcYc89inxLs3EL05q2Z/IrCFj
TLSH
T19CE4122D675D70E6D276927C95818100D372F8742B9167EFA2E0D13E4FBBDE82E39A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 edb089b23aae66a3287d2e124bf5decbcc6573f4c037c01f40ee7da54313cc29
MD5 25104fb3cc51164b9dfb74fc51c69ecf
SHA1 39f00ee3cd9f9c7351521165957707dde6f2779b
SHA512 0c0ca8cf9830fea06a51c842490a7b9ef4c9dc59a9c8d596a60542a20f2d7f57f23a6729728da59c8f56e76847f323a38a868a3bba348950df45416d57c54f15
SSDEEP 12288:BjkyzTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:BIyzMar1PcYc89inxLs3EL05q2Z/IrC1
TLSH
T15CF41200A35C60D5EAB90378A99781609B35BC346F6097DFA190B93F5FBAFD46D32702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 97feccf6dd4da2eb068bcce4a455091408f21f06580e379ae33c54f2166bd9a5
MD5 186ff8e888a1e8f4ad2644faca42d855
SHA1 04e5ed47c88ecced1dcad55818a698534f33bcce
SHA512 976cc1f5c75b218fb1ae22cb18139d2e40c73d6f0e4118b97102af93cdc6a79757767fff7315ffa57867bd19cb0174a4780d867414e494bdea4d2f23fc578b8e
SSDEEP 12288:Ky5TgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:T5Mar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T1B1D42314962E60E6EBA513B079494120D2257E7C7F8099FBF1E4BC3A8BFDDC82637442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5ebc4a6da052091688f33c1c0bf153ea5e74c0c3faf420e777ee0f33c3819811
MD5 4439a31be2d0a3fa6ac6b1786cf4cca2
SHA1 3298777e847cee3b45a070dc96e1751d6f991267
SHA512 f848b9a0e20cd69d5c80359160146c83df587816c65c2d92216dc3b8dbcafa56e3c198d8ad5744779f33542447284b8b1d81958c28b826f0ab301391cb794532
SSDEEP 24576:WQ9MxZKdcz9dw3cMar1PcYc89inxLs3EL05q2Z/IrCFFZ:WVKZVarh7P9inm4uLZOkZ
TLSH
T1D4558C2DABE905DAE177D27595A250C3A673B4301B31D6CF2048D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 3413cef43ddd137e4293d447d20ca0dbc70670d6cce5ff076346aad2d54b3c30
MD5 148f56d5ac8ed6881a0dd9cfec49598e
SHA1 99b47f35595c59047ad6ef05c401a03183bf0b3f
SHA512 6f45bd4b8d8472e5b6d7300e2048c5acba7c5be586437d14fa004dfba97a7d5a8fbb3c6de7c1e707442db1e67e64906c26952a7b6ea98eed812fc7a2381634ed
SSDEEP 24576:syocDAp3Mar1PcYc89inxLs3EL05q2Z/IrCFFZ:RocDAp8arh7P9inm4uLZOkZ
TLSH
T13FF4E01FBB6E40E2E176823C89858244E773B4345B6257CBA191C73E8E779E87D35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 77fee0de8f7014bcc914cafdd0d7b165e02b1441d29d4a5dc779b8d8fed2b5b3
MD5 c4957bc8bc2690a0f909f597e1655a1a
SHA1 01d33d080991f963298cf98fb5d2895417f2d504
SHA512 d861b664e3a5676977da2dbb9717f509e0740962848fb393f14b1c1d3078e9d717a60222498be0949918cfe4a9ec9f6f06bf69832a2efcbe375fce9c09be54b2
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK8arh7P9inm4uLZOkZ:h0zuNIia97P9inmJZNZ
TLSH
T1B4A58B3DA2BC00A9D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2f4d92981921a3688c830b109598be4745b7b5f6affb8001da3103c9d22d13da
MD5 b15e20a570b0a8c670aad66899cd4fe9
SHA1 2cf3ced3206b5bcef6ef3864f108e4e20127709e
SHA512 428a9cff7b6f606444d5ef26335135d126862aa10c502796f0b24194b2217a32db4c23b2c3bfbd809e6f177fc5ba0875105b99ca3e80aa8435647fdfaefc14f5
SSDEEP 24576:L1QT7EcpfxR+N5AWAz3ooiYtjMqbGMar1PcYc89inxLs3EL05q2Z/IrCFFZ:2TDxR+N5YzTfjMKarh7P9inm4uLZOkZ
TLSH
T1DE55B02EA7F915E9D1BE85789A23C511FB727821033193CB42A0C13E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 1f6570fb35a7a76906cd019927abc403eba905a13ee09e221471b4015b189619
MD5 3ed8551068ccdb17c0ac9d1f9013a41e
SHA1 042d880df1258d0dbed9a5383682d262bc0ad2da
SHA512 3de2f5c82273f6d46d66feeee311c36225168eca7fc096b40077ffdf0e83f9716228dc004e0eb2adced7833e8e22627e6b9b6eb15d826ab1ccae65c8bac12794
SSDEEP 24576:xTMdOz0FFS+imSLeMar1PcYc89inxLs3EL05q2Z/IrCFFZ:70K+imSLvarh7P9inm4uLZOkZ
TLSH
T11515E23EA76D14E5E57BC27CDA438905E67238650321A6DB42D0C0792FABFD43A3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 1b307be6706ed12507c299f4d059116924cd912f86c1d2779822ea0f33c93fc7
MD5 d79a672ea311b091167852ce9646f38b
SHA1 86539881a04a8ea246f9e59e67b502800efbbcf2
SHA512 faa2efc82682ff8670f266eb545021d19b4a782c469a460537b62835ee79f984e5901e75f9d60fbc2d4f96544a4f9b7aaa8873eb2af769ae5396de1212ffdf91
SSDEEP 12288:J4KVTgacxgaKPDIYc89inxLs3ELQHgMq7cvZ/ISG2Yah4Mpc20DPLoZZ:tVMar1PcYc89inxLs3EL05q2Z/IrCFFZ
TLSH
T16BD4121857EC30D5E5B25374AA564110C731BC7927609AFF71E0E83E8FBAED89A36702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/100-274-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/948-269-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/948-54-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/948-48-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1364-272-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1364-105-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1364-99-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1400-28-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/1400-362-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/1400-10-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/1400-16-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/1488-92-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1488-271-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1488-86-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1540-136-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1540-282-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1540-142-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1588-279-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1620-294-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1680-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1680-333-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1680-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1804-379-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1804-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2016-149-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2240-109-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/2240-273-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2240-114-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/2420-285-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2688-30-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2860-332-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2860-445-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2860-184-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2860-201-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2860-168-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3064-283-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3248-268-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3904-296-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3904-444-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4124-41-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4124-33-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4124-39-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4304-284-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4340-371-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-364-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-390-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-391-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-392-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-395-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-394-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-393-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-389-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-388-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-396-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-397-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-398-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-399-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-401-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-400-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-386-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-383-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-374-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-376-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-369-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-367-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-368-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-366-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-365-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-387-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-363-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-378-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-377-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-385-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-375-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-372-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-384-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-370-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-373-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-382-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-380-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4340-381-0x000002EC3C240000-0x000002EC3C250000-memory.dmp

Download

memory/4364-81-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4364-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4436-74-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4436-80-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4436-78-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4436-68-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4452-32-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/4452-6-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4452-18-0x0000000140000000-0x000000014091D000-memory.dmp

Download

memory/4452-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/4932-131-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4932-125-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4932-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download