xmrig | 5298f87e9f47259bbf2e3b8d8d875a72bfeea85f3a0c46ce3bba970eb74f6421

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 5.2MB
Sample260708-jbfccsdv7j
SHA256 5298f87e9f47259bbf2e3b8d8d875a72bfeea85f3a0c46ce3bba970eb74f6421
MD5 75df2e820c38b6cc49801282d1cab620
SHA1 a807645fbdf9006349ead081e6f1bd68679ee972
SHA512 dab720ab85edb1c356d498495117f7a855e8478cfb48624987c1e9d9c1b58e56e9b5da1063d50f4bca3f16864db28f3b51f62240f2bf137d0cfa3cc83e68e2f4
SSDEEP 98304:7v5vFtZb+i/AAOWPsZCL2dAslrR7OkFaJBvHvY9gT9N2b8GToyodubix8EVy:7B7Z0aJBvvVN+80ru
TLSH
T1D346AE66E2B501E4C9BBC13CC94AC903E7F178194374EBDB12A446691F236D5AE3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xmrig miner ransomware spyware stealer

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/4812-0-0x0000000140000000-0x00000001407D4000-memory.dmp	xmrig
behavioral1/memory/4812-97-0x0000000140000000-0x00000001407D4000-memory.dmp	xmrig

Executes dropped EXE 22 IoCs

pid	Process
4908	alg.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
2260	fxssvc.exe
876	elevation_service.exe
4076	elevation_service.exe
4552	maintenanceservice.exe
4876	msdtc.exe
1444	OSE.EXE
964	PerceptionSimulationService.exe
4612	perfhost.exe
4760	locator.exe
328	SensorDataService.exe
3368	snmptrap.exe
4140	spectrum.exe
3712	ssh-agent.exe
4576	TieringEngineService.exe
4032	AgentService.exe
984	vds.exe
4768	vssvc.exe
4388	wbengine.exe
4932	WmiApSrv.exe
2648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7111e51aa19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c3a189fab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000670d8d9fab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087a95d9cab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3caff9cab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e84379cab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000879fdc9eab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc97d19dab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5fbb49dab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
4120	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeLockMemoryPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeLockMemoryPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeAuditPrivilege	2260	fxssvc.exe
Token: SeRestorePrivilege	4576	TieringEngineService.exe
Token: SeManageVolumePrivilege	4576	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4032	AgentService.exe
Token: SeBackupPrivilege	4768	vssvc.exe
Token: SeRestorePrivilege	4768	vssvc.exe
Token: SeAuditPrivilege	4768	vssvc.exe
Token: SeBackupPrivilege	4388	wbengine.exe
Token: SeRestorePrivilege	4388	wbengine.exe
Token: SeSecurityPrivilege	4388	wbengine.exe
Token: 33	2648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2648	SearchIndexer.exe
Token: SeDebugPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4120	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4812	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1568	2648	SearchIndexer.exe	123
PID 2648 wrote to memory of 4348	2648	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4812

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4116

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1444

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:328

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3452

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1568
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5911eb8775565531d299a64fafbd8ca62609a247331d87803711e15ba20b744b
MD5 87a111a61c977b3a7bb11161eef8641e
SHA1 07fdddafe524974bc85fa70a02a84b40f8829c6d
SHA512 fc1baeb70a107d6add0422e45d10b29580dca9e8ac1173e9dcd1f49ef6fcb31df9166b67e69b640eb842b6f1547f040be72f2012db1062fdbe1471e86a1d5240
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRx4x8EVep:93q6HjBCix8EVy
TLSH
T1B5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 aecceefd02b1f3119f4b1df0a027505417dc5f45ac43bc60ec981cd94e295c3f
MD5 6426d0b64042f43d9b0064584d57406e
SHA1 64fa4a116dd4e4125f4285c98fe8c287cb35eb54
SHA512 3ec6eaa2a156fd322b54c35eea6a8343eaac595936232c8e891b6b770c9ffc61f20b1f4e9783cba35265e4600175fc378ca6a0a54702b9a4c4537594e0f4f2e2
SSDEEP 12288:X1XLsswWkxy2lRq2czAr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:FXYfDtczAryxknw4FYnshx8OfVe247
TLSH
T14175F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 0c1ae4a8c0d384e746df03d4e141407686e94233e38a20449933c992014ec00e
MD5 87af764ac8b74ce642b6fa489a4e38b0
SHA1 6d75480354b82d0eee5ce874f2afb0f2c82790fb
SHA512 2ae760bfd769eac135c0757d43dee264f4edc4dd387c6f8414bd97319ed4b513fde00160b6714d6b82375834a18d5c0e461403348a28176eb90598275cdd8c02
SSDEEP 24576:E0Le5ji0hmx1rMmyxknw4FYnshx8OfVe247:EPji0A7Qx4x8EVep
TLSH
T1FF95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4c4f1459725af31b622d050521cb6d150105d06d75c754ca48ff85b45b5ada3f
MD5 c6233a94045a75548d4015148d42e061
SHA1 fbdae7532b29b3c835e5b044985dab17d134993d
SHA512 e8de5f5be1ffde19a19903e58b1f35395a56ffc525a1e3304325e6ccae7c4bd04c64f9ef50823354bb172717e8ec75cdede4ada7708fd6cf8bd45c6b85e3651e
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyukyxknw4FYnshx8OfVe247:C/ezSC6vUzPvxHjysx4x8EVep
TLSH
T164756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 03489073909aae83aff2b54d8ac038a12854c838d0010de6ddf314e76c5b3e05
MD5 0ef2b4cabf3c58037924cc4569a2cb21
SHA1 6ee316cff7024e1f2574de3eaffff87a93e4e262
SHA512 e5246f1e1a25a9e6be721b3a28597aca2c6a76882ee5aa0dd75b0ea2a94077b3242e0c2bec6306aca164566d5c31f300a02eca3ba9c43b11702fc95b4e7c4426
SSDEEP 24576:fVbqPb88hv/l+6nyxknw4FYnshx8OfVe247:fVO88hXl+lx4x8EVep
TLSH
T1E9559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 264797c2dfd783dfab409b194334afb75dae59a3c9d0067029ac465f76312fd6
MD5 d45080153c8bc075e4c61789acbf1589
SHA1 d7e3743f212806ec3fc880c44ef0dd067d84d58e
SHA512 9277031be41f5d4ac35441f83a814aa04400a9258955b05286a54704bb7fcf5e784cc0decb1f920c79cde75f4b9099b320a6d9fe4faf453fdebe494f910e95e3
SSDEEP 12288:ENi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ENiyxknw4FYnshx8OfVe247
TLSH
T16465237CA7DDA4E1FA5E14331A7172623616BDA0DA74C11BCB78B15EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2724e38a817b60716645df7ff6b14b89f17a5b13c160671907348a65a0de7347
MD5 a9c53797c4ad07a8209768083d488ca1
SHA1 d83eca9e89c3aa5044408efa519005448fc1ebf9
SHA512 1c9825385243fa15d9370f5bd51993d2eb501101bd64eb630888b6e50df125ef6852300b774d1d15e19eb803bd3f86b52fbe1a7cbe0fad10c786e928970390e0
SSDEEP 12288:deBNUbTVO86Uv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dJIUvyxknw4FYnshx8OfVe247
TLSH
T18375CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 066cb7b7078eb7441197893abb6edd29fa14c01978b7688720ad4fbb0e581a4c
MD5 f12f456090177789da71b748a47e09f8
SHA1 9ecf47818d3d387f3a6767756689d39a79c28d94
SHA512 43f24d7288b4404786a90ebec5b27ea3192c8e9e1212ea9bd2ef69f10685b71b144bc86fd4248d9a24489a54e83e0b370034c5b4df721f02c123dcd45d9fe37c
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:uQvGAdlCEL8c/yRNw5Cvix8EVy
TLSH
T11B267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c8e435d98356b5ced01591db12726601f00a2bc5afe2dbd87a30dcc8d5f9e9e8
MD5 7af9e750f69a31ddb161559fd7dc12a5
SHA1 cbc023aeb9ab9260c2d85fd3454c4522a57cb21c
SHA512 157adfbece97cb0a6e237825e6e9848b9f4a1f43e900506a3c2cd45d9f248cb170de1ec42b94b3db8cdf0f3070adc3c582249f622317caa07f06fb3aef1bce51
SSDEEP 12288:EAwSfxL/2Dc3LDLLmt0LDQewsAj1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:Z6ewsAj1yxknw4FYnshx8OfVe247
TLSH
T14185E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 042663c6bef1c4485716fd087f49dc624dca0ef83f24ed3793a9694e93d7aacc
MD5 16ca03cd732c7cb53be3829e30e5df3f
SHA1 9c7dd73b76751d017c29a9c735f39bcfcfaa2c72
SHA512 f5928f3082394c1d5aebcbdf2630b54feb169bde42a8c24cc296ee24d3fdfdd8d797ebd347ac2a32a8c20cfef90fd25016bd2fcdc5821cb2696d76a0e65e8a94
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl:SUEtQevvqc2W1cpV2EI32
TLSH
T1BF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 571a674b29bef3d4ef647a5a006553da3d7acc86fa77141937773ce3c11fc6f0
MD5 5c8158672fc0eeea9f11d411600e312d
SHA1 5ade684ce955865267387884e7dc422ce8204005
SHA512 bcbb89a1b54be79bf79dede99ed6e533a7817dd28517fa4262ae1d0a8f4664fd9094ba8c6007522749a598e542db44ebf74020e272bfda761d78f8be206a2fbd
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/zgx4x8EVep:GoqtVjnmLix8EVy
TLSH
T19FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c6f2cdaa7d7ccbe00eaea920bd1f7223effbd5d762bab040cda540177751ed54
MD5 353a479e9711eb2b2f072b04e43b7e18
SHA1 ad88bd1c58b79c341140fde4d5e47ed516dc2c32
SHA512 e702e920f8c433408cc2bd8fd00ea9c523fe01dd05f71f652b46ba2c80c4a9f00a0e0769a3f411c5dd67b6857e47c6d8da2de17e546f5179681487263165e5d8
SSDEEP 24576:+AhGLJIFoiwtA5l7S53Iyxknw4FYnshx8OfVe247:+AMyFoiq57x4x8EVep
TLSH
T16435AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 52d553f52b28681f6ea9bdb0e155b955a9361c12fd9707e4930f7d7a2316b4c1
MD5 801040cacb935a97b055391bdf7248ea
SHA1 391ea2fc4e56941ca9af7620ed8ab188ac9a45ae
SHA512 392332460830044f327c80413d06ad356e7ba1b1fe2f280735db8e66ec2e09c3d78a9e875c409ec3b6d23f67f7ea2c97eb173f22a588cdf56925d959593de156
SSDEEP 12288:1mw5HEjsChN4BFgl0WDm+CE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:wwuVOWJyxknw4FYnshx8OfVe247
TLSH
T12D75F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 0e568ea07be793ace9edbfb675c9045d739ac7ddeca767bbc6a3effe566bfb58
MD5 97fbaeba91192dadd082615e4212e725
SHA1 cc41ec9a58b96a2d9712ee8c363c81a7f4ee8771
SHA512 7caa3460e26e282435db5bcc3e69e2857f3c8784e38d172dcd09e3063b2fb5052f83a95c11caf8fcd92fb25bea7ace224ec98b45d8f31baf820de95b8267fd24
SSDEEP 12288:aFZ1Iyl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wZuOyxknw4FYnshx8OfVe247
TLSH
T1116512AC33E860F1E1A7113A89F15205A77274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1f8014dc4f8a1bc39547ae79ca328cec714340f2d2c602bd244facc3c41d3ad2
MD5 bc6432282ba85824da7a005f06461d45
SHA1 aca205afb6bee0b53eca81b95d08608a57cec2cb
SHA512 732ac3aa8c4a347743292fdf68c3e2b6d0067ff5f2eda9ee25cbda95a7dfbbcfc418c96da30514b198b5c8473cfd1e7911afa026342cf9b1550784a71e18d148
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:IQRQyi36YOcPQLvw2gAf+PN32ix8EVy
TLSH
T146667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8b8c04554a64abd88ca7377dcd9b1d16ab69eb22a7a4c4c9bdddb2ae35a801a0
MD5 81e8631e7555fdf5456624912d8c6396
SHA1 d8e748c85c4e6ff3e9c972e0865351c95f9a424f
SHA512 6902ed51a32fa5643eaa39724b0a698cc4ca081a6abb4962a2f3f98a314f487539de021503a8c6be6c3b4659015dce9e21cc2d01ba4e7a107acdc17377fd195c
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:eQRQyi36YOcPQLvw2gAf+PN32ix8EVy
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 83da36b763624ed70fc9b29065eb4548b5bc251f38b12aa86dced822321f0a13
MD5 ac1215600718474dbd91a7f1e4ebe722
SHA1 b762c98884482ea457724753e04a3f01030845b2
SHA512 39a8545cbe55e2c123ad0541ebe46d772cb5e6aa003f30e977de4266576f95908d1a9a597cf9b61b30e41d7034aecfce53f196840ace61ef2aa9bcd5cadc7946
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0eyxknw4FYnshx8Z:+68Qg55nhheWu7PNU3/Qx4x8EVep
TLSH
T145B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a81408cb8a6979bf36def1d0c5d36cebf9a08f8b99ec00fd9de0ce4e4a558f03
MD5 fc8d503b9173985f786300a78b1a064a
SHA1 83748e5029ef91573bc601f2e8b1f14861be6798
SHA512 084cd081ad2da2545d593be5dd1fd365174e1b840fd15f608fab46541495d166f787a3bee0f28bc2daf8f6d4b870a5587335684ba9ce3920b3328dafa0bdbe98
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:By5112gYy5azzVvL69nLKnhZdix8EVy
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 48c84a9d2619ef2e809c8c9f37fed34ba72bdc0fd944788ea686be6033e747d5
MD5 7c80508e38b1e1f5964887e0bd95877d
SHA1 4322e42cec96cac19e27daf0800d7dfdbd928f49
SHA512 a5d7dfc9997b5b03be6d10c7d4d7aa60f9b7a0316ff44b208bf7c0d6e977cc47d0e1bfb144362da202a4e7a319e53c3905a3a741fd0cfeb2ec4104598882d90d
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glex4x8EVep:Iu6JmVxd2deix8EVy
TLSH
T161D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf68833af03476640efa804ce6989258dfbbf884679bcb41a30c127ec5536df3
MD5 2042efb7fad42ae20a0516fa243dcd2e
SHA1 77deaac789f7ec9935b7a0218c24e978cc8a121d
SHA512 572640ac0879f2369e4f8230dd4e1661452420efc4ff2e2405e8421efa6ebc8540992fc9ef1162af9b8824f23a2a95906fe342d5ed3725b7186e07c8cabc0097
SSDEEP 49152:51hpsNoJpF1A6UU44CwH7R4x6x4x8EVep:5mifPbRLix8EVy
TLSH
T13CB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ebe46b2a68c6839effebd1e0d3525c27ccbd471f5552c808714d89940ecf01c3
MD5 5ccc41bceba23b9fbd13c53d9f35f0cd
SHA1 e5f818c5379a00d37a55014324df69c8a2b82ad1
SHA512 976602931ef5140e9fc8c59e8d61ca8e420ae405df32723c1dd33a1ef23a819c33a31f076089ccbd65f42470c6f25cdb0b06a8e27c5f4fa7b287de1111aa0ed0
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqBx4x8EVep:w5dKTi61Bix8EVy
TLSH
T1B3C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5c4224e0f4560861a483ec0fe80348e9ecae131ea7fc1bbfe071eec919115731
MD5 bf295b0f2ecf292004d46b6b3dfd4c76
SHA1 86d7f3621bf529fd0188d0ece37cb8b415cd8417
SHA512 cf153b0368b00c262a6390930e60764fa23ecad65c4b6b593829f71238ac2623502f36144068a46d040148b4228f660ddda9fa97f120bc463b73a014cf331521
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wOx4x8EVep:BX2iyphnix8EVy
TLSH
T11395BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d6936cff5b533a0ccf8f07f1e0d57a5cb7f7bef05523b334818a7e25cea74302
MD5 d2f67a38dba0ad5928cb2b31dfba668c
SHA1 54514d92f6f3a91c10df79f84fbe35142a1aa6fd
SHA512 7d182d4e6ddc74fd50275e37df4f86f266ba9e9de379a772edb9dbcf64d663fc134a68b3156979ebe4c658898eff692b259bd1f41b2c34d8a34f289a25e6a0f2
SSDEEP 12288:XK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XKyxknw4FYnshx8OfVe247
TLSH
T1F965237CBBDE95E2F50D11734A7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 10c88fcb61c9f06f0958e8d85313fffe61f58c5c87c8d8005d66e4fb7095e2e1
MD5 7b4d6f6303b40f9614272b68b8d7a9d8
SHA1 9179f707be68456798a360e0881ffc50a6ca1c59
SHA512 2e4bcf1779201d65e1e5a1481823d39af6c21623f3df69d909b896acc448d13b89282bb844cc76406a8b78dd1c6efbd2cabefeeb463d1c473f5353ad4d6249ee
SSDEEP 12288:+B+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Byxknw4FYnshx8OfVe247
TLSH
T1D465237CBBDE95E2E50D10734B7172626619B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 503511ce4a81446bee66a8adc3ada33c3aad13836ffaae26718cd36a55f90dbb
MD5 7c425a064bf6ca04b444504c8fed2d6f
SHA1 298dfd24050670fb149c4cd9959e2aa1f137b2b6
SHA512 a4e2b11932abbe0f05c00a12eab978c2b40b16678f1182c51db19387bbd13844d86e002dde3c0db1429eede0cce11ba367e0c0cf94f50cfc70478c28a4369cad
SSDEEP 12288:u3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:u3yxknw4FYnshx8OfVe247
TLSH
T16565237CBBDE94D2E54D10734B7173626619B5A6EA71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 33c335c6f9d016af2f2a4934ed5cefbae8fa21160d0ff873493734caa2dba05d
MD5 59f93de70e3aaf28ca640f469b8326f8
SHA1 8d30dbbd9e67f4c3a8d39224114e7a6cc35ca6a2
SHA512 dd75189759a6c046af81ad5d99f42fb92bea0441da700bdda031379ca418aecbc1598269f50b46af7593d4a7addd89ce3976f3a74fea9e827fa6c1a4c202c772
SSDEEP 12288:eVo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fyxknw4FYnshx8OfVe247
TLSH
T11765236C77EE50D1E85A51738A726222B365B8E5E731835FCB64700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b9ad9d1ac308c81b8bae8d82d6786e0beecd1a39f4b87143f60271f07aa07993
MD5 19ca5c5adf14edd2de6f2e01c9d54056
SHA1 e29379910fa14d5a83cc8662022b6c68ecbcd980
SHA512 e84d86b85392e2a5504f7b1698bdc154a3081a01663dd867fc049b2a336a5225ec022d9e6bbda682840c36d8a31dfff97936b761268782dce171fec8f7a757c3
SSDEEP 12288:Jg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jgyxknw4FYnshx8OfVe247
TLSH
T1BE65237CBBDE95D2F50D10734B7163627619B5A6EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5a9f520c1cf57452ddf2d5794ae93a4ed5c1aa0319985c3a765df033b3ceace3
MD5 ce735bf0b52494327977f7074e459586
SHA1 493dda17fb2b516e1c3f179e4827c15dda511170
SHA512 4c323759c4ce51f62ce7d574ff089414d55dca3c5574c5e30f399a9f5c644a757f327d058ddc815dbd1c75ed09405b0f9af43122ee5e3480e41d1395c027c636
SSDEEP 12288:Dd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ddyxknw4FYnshx8OfVe247
TLSH
T19365237CBBDE95E2E50D11734B7172626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fd46485c37cb1cd456ee36d3a79ab605afacd3257cf3f9aa1aa664c617adfef8
MD5 91cfcdbf1c491a51fbac192832e0b01a
SHA1 5913311c1611ff715decc935cef1699565b9a0dc
SHA512 d6141b21282daf6800ca546a70655da3acd2dc87b3d3cd2fa12cbdc1e93adecd06691d136d764f14a00913fd9a4ae6782db669dc63b024121afdf4f86ff480a7
SSDEEP 12288:VZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VZyxknw4FYnshx8OfVe247
TLSH
T15A65237CBBDE95D2E50D00734B7172666609B5A5EA71821BCB7DB00EF1F0C60A02EA63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f28c59aefd311ac68c125812c83ed3f45837c52e49e63d2567a8539630804bcc
MD5 7f6de63fbe86a26c54e4164d5e485054
SHA1 568ef6cf331258a812886c632cffa7d99cf54b06
SHA512 66de4c141b8df094e8c45839bb7b1ca67c1bd77e59d5abb1b84ed42683045ffde7dd464983205945d0276aa47e8da630f21dae458107fd58ee16bab1cfbe45d8
SSDEEP 12288:4iZwbZzzFEoS2cPvyh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7ZMdzFVSOhyxknw4FYnshx8OfVe247
TLSH
T1B97501A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 70cba1f9684cafb45723ef7b4cde6e68dad9f2e0993adc01063ee5430717a992
MD5 db43857a05ed5609cb6a7d61b7229faa
SHA1 fc5933a6e000ff3cd9008abf3ee1e73adb4c3e9f
SHA512 eb0e5721110f22b693efde0b6e29341c52b0bde3ba1591a0d45c74c190dbfa60ecc89a0d80e1ab9297e8d89e857b7662a6f1b1be3c17d602c2819cd6240f5662
SSDEEP 12288:a++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:a+yxknw4FYnshx8OfVe247
TLSH
T12765237CBBDEA4D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 46f6080db52fd10d7b72be564d94b631e4a086ac0597853e8e4804d8e54ff20d
MD5 e098715dba26d1d5abedacad0e6c4abc
SHA1 a276a42247b6b342fc05d89fc14e25fe9e988f04
SHA512 cb76cd384ec111bf47bbc3ac184e6bceea71fc72550d48f086957f2ffa4ed739ecea611be3dc9922b9961bc27685d2a33102e54a13bbc2fe741ea8e5c27c2ca0
SSDEEP 12288:hS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hSyxknw4FYnshx8OfVe247
TLSH
T10765237CBBDE95D2F50D10734B7172666609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e214b37343ad447b856079d2a9edc110469b54a016644af5cf1d4f652d2a3d54
MD5 940367823ee781a34d7f097405866c42
SHA1 8e8c706c94b5efbae47e4e03a4c7c84a18fb1f05
SHA512 4a7304932e75ba3c6da06c594282d04612ff38f49254fb34317e0b087239390ed64c90840f7591db661991a13d70980353f5530de59607e552d8e5efe303a8b8
SSDEEP 12288:WyPz5L8l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rzylyxknw4FYnshx8OfVe247
TLSH
T1C675125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2f31bebdd158091f01d01b950401dcd6109ca385f23f93ad679f936b9262b651
MD5 b3d6cd76ad7d2d7160f6d60961898db4
SHA1 ff127a9b05a82119cad359d79b9fbfeba18a374d
SHA512 0a4ba7f9a34c89d2ce93c31fabddc832af3a9aafc31fba107ba5ec2f72417053c6707e1af2fd123ab105643ea0a174bb0f6d23fec77c6d2d4676c02e50a4967a
SSDEEP 12288:P++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:P+yxknw4FYnshx8OfVe247
TLSH
T18465237CBBDEA5D2F50D10734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 454156d36b413a374c74f60d2cbaf3199be84a84cc9edbefdc2254ebd8e72fb0
MD5 4c12a4c025c5ac81ee011fbae0efa295
SHA1 9630cf44b580d034543fc6bdabafb70449dde1fc
SHA512 c7bf4728073c24c9a53a9a2b1fa4fe1e42f7dec80c1ffded66ed63e01a5d70083a9524afe105a4b2f5b4fe8f2e2a56b5ff782678dd6d8d67fbb116c45b38b01f
SSDEEP 12288:8++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8+yxknw4FYnshx8OfVe247
TLSH
T1E865237CBBDE94D2F50D10734B7163666609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ef4d623b156f1844bfcbb0069abd7c233f74d846bfa59a8a7f2d9a87fc6e6f97
MD5 43e83b62c10208e956e88a6d54e84ba6
SHA1 90d980dd10495647dd432f1bd340935df88729de
SHA512 da12c748bcadcf4dd09dc4989c13c8985f83e5d4030f9f70b5ba0bf9378cf969f0edc8f5d2463ea86d1b28429bffc6fddc646f8fc8c1ea23d2b5af6e1d281c8d
SSDEEP 12288:HyPz5L8l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qzylyxknw4FYnshx8OfVe247
TLSH
T12775125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0a1033a5e14461374977bb756d30aad998215dadfa9c671f1721efca459cad05
MD5 0d8d8aeaf1975d63277d408d570282e5
SHA1 66a67fbcb38b6df539b488c06f11fbb78e24a1a2
SHA512 7056aa6d44366b661683b9c8bfa492aff9e79723a2d5c0b6c869f91c36c4d477216bfb68baf77c8a74efcf9f57ef9ee22802a6b1818bab72b1217c2ddacca44d
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71nNKbrh/8KB2yxknw4FYnshx8OfVe247:9P4m4IpOO67W8Kvx4x8EVep
TLSH
T1F065BE2CABDC0096D0BA917486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 941bad091f2f2f5647e867e003f697a405ae24a8a2e59d41cfb4431997bf0059
MD5 2fa1d6371962987293fda0425b2c34d8
SHA1 830c9d80e147c212c11b4f30dfdce18264aa0938
SHA512 12c6d2e4b1b4bf666dca0b78cd02a93164222263ed464976749ef7328187f52a45619dff7ad795c3edfbc0bf381684e310ee14ca629b67bf3f86fbd05a4d0c1f
SSDEEP 12288:r+sfO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JOyxknw4FYnshx8OfVe247
TLSH
T1C775F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0583e7acc7d56dcfad7295bedf521d63e82ea5b7f8c4cab75d26e696fb8c4ba8
MD5 9da9641eea772e8db2e0d2bfd741ec2d
SHA1 36eae2fb00f7c1db9e2c63b0526f04ec727a3683
SHA512 aca39553f3bcdb6529342c2855ac1d42a42c16c54db3a5dde04bc3b439fc823218f6e2591036f9a97a1f92e439689d8983f93da59ee3706371556d78eba84485
SSDEEP 12288:ru+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ruyxknw4FYnshx8OfVe247
TLSH
T1B465237CA7DDA992F56D15730A31A231361AB1B4DF70C14BDB68B11EE0B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 200a0eb8cbbb1ecddedecdcb8398e03ad94e895ba99c6e695c239c21bf26b333
MD5 aba95d36d519f41d3a3b395c312a8304
SHA1 b4959ba3c6c1507ea09f23d5ceaa809f8e87e2ca
SHA512 1e94df834d0ed4bdf36034a452c3a74a301866108d48e587654f4bd90df0bace1148ddbd64b311178f631ba50801324aedad28c41313a9111793dfffd1baae94
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQjx4x8EVep:ra0hNYG4JwYix8EVy
TLSH
T17785AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 90e90aa9f74d0358cac42ffd459c9ed36730db13b691cb59a019b87f6e9dbeb2
MD5 f8cef373facaa46362e8d48151b7a85d
SHA1 5c948b77f52f9a8a9d374f77ed46e4fc7d61f4e5
SHA512 03c70d35e8c40867df12b55e74dbb8a6ea59c0f18b022b43d60e9ed4536d5084667a20e79e7b96fca1c0c847ff9e8fb8ab5503b1ac64b85f08a5d0cc4ad77092
SSDEEP 12288:fhbHjfXR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fhbHjPRyxknw4FYnshx8OfVe247
TLSH
T14865017C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 485eaecbcdfa5c71663d1b0db21f02ab7f9a59b80f7fb2f762f1a2dc4f8f7945
MD5 a3cc120ce7c1190bbf237c340e178e1c
SHA1 74c6320c572990aa07afaeca5d1536fc9f2201fe
SHA512 0289b04e10c6e31004cf97fd1c0ac46f2bb10acdbd07ba0245ee98dbce58b73188bb9a97e34deb20517789611a9265ba61b9220ce9b848d52b008d441a963caa
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/Jyxknw4FYnshx8OfVe247:JIgnaTk46pBR/Mx4x8EVep
TLSH
T1E545BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 92e872219b2c9fcf5a75e17bcad24ba67b6b8ce8a431faafc970f1bfeaad3281
MD5 c68ecef06cb3f32b7eb99efda60cf6eb
SHA1 eec44f70f53456639eede1d146aebe5a21252a70
SHA512 2cf4008a4cf0ac07b4c51234fe164fcad12cb8386a92739e9fe57a48f696ecc5d7249d52ba3bf2c75097c82233bd71378a55bdf65a0993cc89abf8dd01260ecf
SSDEEP 12288:TC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TCyxknw4FYnshx8OfVe247
TLSH
T13565237CA7DEA4D2E55D15730A7162263605B2A0EB7182DBCB7DB11EF1B0CE4A03E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 47d10cdfc9fbfe59888bfa964616d7cfa2354dc14cc79641cd181c2a25783793
MD5 da192a380c13c7be3f1888bfc4f406fd
SHA1 b1f45f4da2a02b2922b3edf8cb422b45758261cc
SHA512 52cb95aa7b094919209b649ad44ea53278f1a597d02a241ec951de2470958bf24e6a9f58a44bb4410f6654450b442d7253c19508a1f00a3b80c3b6afedf9320b
SSDEEP 12288:VOb6A4LWOsvAYFTr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SCL3UTryxknw4FYnshx8OfVe247
TLSH
T1E5850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 863f1baa7db88144f5e7d379b3112f97ef1d0ece480f57d929cc510e49c98689
MD5 b07433ed59d37979984d74ece6aaeba8
SHA1 f04c8841bbe71e1592cbd673c75e4ea50de443d6
SHA512 b8edaff07b4923d0a9922a820d574a1895e72a14e9b83c0d9d6e81fba5bc2100a6f766fadab56d47ab11553b0a3c42d0dc57cc049feef081f9d90084a84ba93d
SSDEEP 12288:tpFtkOP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YOPyxknw4FYnshx8OfVe247
TLSH
T10E65022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a3754053cfeac64a6c30641f24beb2e6059a496f337009365d521c5914d4ddc8
MD5 3cce75570ae9d38208621408b3216f4d
SHA1 e7db00ded45571b7c75fba4f11ca7774b8428fae
SHA512 1f4853cadd7672d8802408b8394e1419b560e6f19f003b3402cd75d6d038018b2029c444728cb649d2abfa4b332d78e1e46f02b33711f0d5f2d8a196b0e72136
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhs+yxknw4FYnshx8OfVe247:L7cBWMpPjN8DbEh0x4x8EVep
TLSH
T171659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ad2221acca0715155898db86ae099f146c514ea00f16d00ea980b6ed6d4737ff
MD5 7aba10d03bc05be89a4376d381da1506
SHA1 00953015d15c602bae145e4a42fd735734992e29
SHA512 de093160e4a83619d7da8f843bfc6654ec1e511a1d21533e6c539a85228b8945fdb37dd0f68143bf1c4e8a136e451f551481eed78af02affec0732a38f1e098f
SSDEEP 24576:ZW6BApg2YuyuNDYTabvcdvNYf8km1cyxknw4FYnshx8OfVe247:ZF2YuHNETovAvNYf8kmRx4x8EVep
TLSH
T1C8858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 dc7c1cd311ecdf7c2f962fb9a290a55e83918cb24fe02058b5de9556e67bdcd1
MD5 8b2248431fd3562d3f179127010e8175
SHA1 ea71e3703bc48e9166e95c72739f00d74ace9aa8
SHA512 e7715660884ff66e85f6960a9a65cc6cf4ba40aeade54b6ead76a1ed2e6c596e6a0522f3a8a249f5000de732034c47b52837939d8e77c868688ccb1c07d17469
SSDEEP 24576:SAFs06+Omlf3NXEbToTyxknw4FYnshx8OfVe247:LFs060lVXuDx4x8EVep
TLSH
T14165AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 040dbd6cc21bee34a48e279d1b249f9dd5895e86e2edd86531660056684eb891
MD5 7c0d9a140ba1b406103754cce44b2b90
SHA1 0ca238eaa67a6e38b3165857e716897d660337f3
SHA512 9c920061d408402ed55ac7c409704cbea6e640229df4acab615c5d3b6ca1ca512976bf0b8c4eafdda5192c4e3098e834dd37c85229e963029e37abd436a29c6a
SSDEEP 12288:vCJnJ5D3Vkr8zxe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qJnJ5D3WoAyxknw4FYnshx8OfVe247
TLSH
T17D85E03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 954eb2c6189b74b71cc28dfad4bded74ff6a282d48b46b4b66500310e1095e1c
MD5 4271516e0dc24c8d308191bd0c3d49d2
SHA1 6d7e0a09c0a12e016c7b52a5e3e84866e22d62f0
SHA512 2d348864d36c90add81b22ce1a6b834f720795f3e6089a38e6eeb6b2b3cc1b31815355121107052375dd3f50d5e759623e9d24da5583a254bbd25214e665c02a
SSDEEP 24576:rEPghm6/7IIXdwcXrif7qQncjlP65i3VuJyxknw4FYnshx8OfVe247:Mg06DIKdwc+eQnSt65aVlx4x8EVep
TLSH
T140955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 426519144328efa29fc3327d66986aee03ba3f6283807c1d1a4424978e14721b
MD5 6575ec5cb352e16452eee309c7415576
SHA1 bf6e24a8f4387010273871baa12365d50070beb7
SHA512 4245c43f8b39c71d18f3e62b2392683a4544c324a89282401ba620e922362abcf082dd7f5c1926f4be9f2527e19a1573afa8fc670d9a943afefc15093789dc97
SSDEEP 12288:FEP3RME+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GMEyxknw4FYnshx8OfVe247
TLSH
T10865126C27DD70E1E52A503A86A18205E372F0706B6263EF87E5D13E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 fbe841268d3663bebea04872ae4f41766fe8a5de20b225c4d367bf8659109dc4
MD5 225ef6d5603dd4427a8d6579e5585fc4
SHA1 23048d0ed89534c8b05bb9e70640144576f438e1
SHA512 d0a63bae711806bdabb6bb09d465817922834818ae123c19f803996087767fdbb11b8780b6387e3cdce5573bb48557f85e531b043906909358b5b971334e22bf
SSDEEP 12288:kjkyB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kIyByxknw4FYnshx8OfVe247
TLSH
T19175121C63D8A0D1E5B905369A7352A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 c5f237082771616e265c256165f813b2f9ced66c5c31d1193d935264cd80da5f
MD5 f0cc43a6b51b32f4017769bea620fbdc
SHA1 3b2cfa22d5fbda0233bb00f46eed8b4492a6ae00
SHA512 3b20e0427d3b898a90c393086c7314b88546ce8a009f96819e35979def1ac5dab3bccdb6e2ef1a6bf8d46d54b15195d43736c1665978ae5983e4f4b63959d20f
SSDEEP 12288:5G/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:E/yxknw4FYnshx8OfVe247
TLSH
T11365237C67EAB4D1E9190173463163622225B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3a552b3c11b7c3469e29278cb61bbaca8d37daa7a2915bab4e3164def6199bd7
MD5 b1ac226e0c2856ece60161f0e7a0c081
SHA1 311cec6f80e9ce0c30a3b494aa694764386174ef
SHA512 383a7172154e8175e2f63108922ec359660f076b40b58099b1cc2b6116d13a19289fa0fd50a9ed955e925c9aa53898e05c142a32e29de8784bb358a7fc0bfdba
SSDEEP 24576:FQ9MxZKdcz9dw3Gyxknw4FYnshx8OfVe247:FVKZ5x4x8EVep
TLSH
T197558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 988a0edc05407db8194eaa5e2872f86ab1fe994eabdfc495422c49d9c18bbe38
MD5 e2c5183ab11cd4dc074d1eda3b02ad35
SHA1 8ca83ad79f63dfd2431025e3ab0602e65a9ad131
SHA512 099946fdfc38e1e059200e611ae4de1d72543f4660aa559118ad6e8d399c113961756140b6fc2f040d9a042800da978e6b4e933c55ba7b7eaf3ea9da9ecf8f96
SSDEEP 12288:WyoKo2SRple9p1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WyocgAp1yxknw4FYnshx8OfVe247
TLSH
T1B575E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2da1929264f72ed8217add18c2d903918bf3611f330210ab91019f4bb3c527c9
MD5 71316694eedf8b8646dd6aa14ab3fcf2
SHA1 767dc07465253692cd033398b10eb4a64a71f1a4
SHA512 e7065ba08b3c8733244a692ddc2e5b37a7ee9595672d5e85fda1aa29ad40b1bd240aa831f68b086e5dd390aa468e322e0b61e78387d35a4d9c37373ead15bfce
SSDEEP 49152:MWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAx4x8EVep:G0zuNIOix8EVy
TLSH
T15DA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 14831db0b1e34c605e5d90cd34735bc1f99adb86681a7837bc8fd2407b330093
MD5 442fff125ff8561f3159ba89346eae8e
SHA1 358371ce7e94f5920b8349cc8da457ee68d89749
SHA512 c421b1466e20102c29b7de9f50dcdd631bfd48f15e283849994c68791c70749ea80421703e6d5607a0b6c7094e31b0ee22ab75dd3e1587b50b93d192b3ab413d
SSDEEP 24576:61QT7EcpfxR+N5AWAz3ooiYtjMqbEyxknw4FYnshx8OfVe247:HTDxR+N5YzTfjMax4x8EVep
TLSH
T17255B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 877339e568419dc47e153bf41296ec2a40dac0308fad9ffc08c8412c2d441e22
MD5 6094b63bcad3cc6a40a3b1e028070cb9
SHA1 13c0e48710fc0b4b8e2ca5449c38c4981c373227
SHA512 bffc129c2785111c2809da1965cd755613eca1951f09206968d8133fef316969d6fe0d1c6e0abd9b1969cab0914cb03f0234db92338c17e1d16a9fb3e2ac79e1
SSDEEP 24576:ATMdOz0FFS+7mSLoyxknw4FYnshx8OfVe247:o0K+7mSLLx4x8EVep
TLSH
T16485F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 224f4d93e4aadd79653f06f1deaedc9737a3a4e925dde1930aa363adfe22b3b6
MD5 c5a7320765b9f83882aba49a2cb1fc25
SHA1 fc3243bbc27da42750a9817e968876ed23703464
SHA512 2eb51f8407863fbb50c424e90af2e5c3b7c175fee5290da912758a7278149fefc822495eaf664eb32656c59e6eb42f013c2b823cafa9bdd484d73e9d8386057c
SSDEEP 12288:z4pr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kryxknw4FYnshx8OfVe247
TLSH
T15865122C23EC30D1F46A52328A325216A631B875673192FF6AE4E17E9F718E4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/328-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/328-163-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/328-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/876-131-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/876-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/876-40-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/876-34-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/964-99-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/964-85-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/964-91-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/984-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/984-362-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1444-98-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1444-81-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1444-75-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2260-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2260-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2648-366-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2648-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2648-196-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2648-180-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2648-212-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3368-167-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3368-120-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3712-283-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/3712-145-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/3712-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3712-143-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4032-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4032-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4076-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4076-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4076-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4076-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4120-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4120-25-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4120-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4140-129-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4140-123-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-172-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4348-404-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-407-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-379-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-378-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-377-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-376-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-375-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-385-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-386-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-387-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-390-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-389-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-388-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-400-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-399-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-398-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-397-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-396-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-395-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-394-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-393-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-392-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-391-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-401-0x0000026676ED0000-0x0000026678DA7000-memory.dmp

Download

memory/4348-402-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-403-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-369-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-405-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-370-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-406-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-408-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-374-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-380-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-373-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-372-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-381-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-384-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-371-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-383-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4348-382-0x00000266795B0000-0x00000266795C0000-memory.dmp

Download

memory/4388-364-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4388-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4552-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4552-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4552-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4552-69-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4552-62-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4576-331-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4576-148-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4612-155-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4612-102-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/4612-110-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4612-107-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/4760-159-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4760-113-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4768-363-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4768-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4812-0-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/4812-97-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/4812-100-0x0000000002A70000-0x0000000002A90000-memory.dmp

Download

memory/4812-9-0x0000000002130000-0x0000000002150000-memory.dmp

Download

memory/4812-1-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4812-7-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4876-72-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4908-109-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4908-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4932-365-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4932-168-0x0000000140000000-0x0000000140192000-memory.dmp

Download