28198b122b37a5f038975473a26fd4f84066eddca4778f5123792064f19ad112

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 9.7MB
Sample260809-vb9rravwhv
SHA256 28198b122b37a5f038975473a26fd4f84066eddca4778f5123792064f19ad112
MD5 5335621a1c3fac5bac5c5ed065224d5e
SHA1 78561ac8e5890393e2eba09b808202113d332144
SHA512 c3fb44d406788c5ffd7bd62c0a0d3f0d9992b7000fd6d2e8f8dbaae0814607f04be97f3f0cace209e792a4c126f39d08867d8479cdacfdeeb995081e8afbc089
SSDEEP 98304:PaytBxqFVdaUoNVaGa+1z4XNqq5tP7bnAyhVXtfZOfDT:PBeV4kNl5lnhLfMf
TLSH
T1E9A66B13F29901D8E06ED5788B6A5232A972BC8A4B30B2DF3A5C76151F75FE05B3C724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2424	alg.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
3564	fxssvc.exe
2712	elevation_service.exe
4540	elevation_service.exe
3272	maintenanceservice.exe
4600	msdtc.exe
4496	OSE.EXE
1028	PerceptionSimulationService.exe
1860	perfhost.exe
4716	locator.exe
2264	SensorDataService.exe
824	snmptrap.exe
2116	spectrum.exe
1300	ssh-agent.exe
312	TieringEngineService.exe
4516	AgentService.exe
1048	vds.exe
1984	vssvc.exe
640	wbengine.exe
3740	WmiApSrv.exe
1144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\19fad29068b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c90a0d301f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000391dc6311f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000194327301f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005debf1301f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e05378301f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2204	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2204	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2204	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2204	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
2624	DiagnosticsHub.StandardCollector.Service.exe
2624	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2204	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeTakeOwnershipPrivilege	552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	3564	fxssvc.exe
Token: SeRestorePrivilege	312	TieringEngineService.exe
Token: SeManageVolumePrivilege	312	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4516	AgentService.exe
Token: SeBackupPrivilege	1984	vssvc.exe
Token: SeRestorePrivilege	1984	vssvc.exe
Token: SeAuditPrivilege	1984	vssvc.exe
Token: SeBackupPrivilege	640	wbengine.exe
Token: SeRestorePrivilege	640	wbengine.exe
Token: SeSecurityPrivilege	640	wbengine.exe
Token: 33	1144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeDebugPrivilege	552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	552	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	2624	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 552	2204	2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 1144 wrote to memory of 1964	1144	SearchIndexer.exe	112
PID 1144 wrote to memory of 2432	1144	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\151.0.7910.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=151.0.7910.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x1407b1270,0x1407b1280,0x1407b1290
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3612

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3272

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4600

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2264

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:824

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4224

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a025d0f4587e3471b977d34e895d7f5694acbc639ae9cd66e01e4bca30109aec
MD5 774d7b48fc65981749d1d53513c81d30
SHA1 d383ded0058b8d7de36f525c0ebd3510a1ad0e3e
SHA512 31fe98bf59919115e1b2152953bc945d592b942b15a5bd4b5a941879d0c2baa74171a76975ffe334fc70a4625f09bae05a03913e2ce5be1ead2d458837545463
SSDEEP 49152:4b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrqCKSTzZOf0mT:S3q6mjBmtfZOfDT
TLSH
T1BCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 78b6c379cccbf819bf48776440fff969de3a6f6f5568a5042e97a8873fcc5e6d
MD5 e20d5d51dc6ce18c40a348f7c7680a73
SHA1 83bd18c990d92745205809290abc7de46d04d17d
SHA512 2e89b5c7145ed3fad166d395f61adf81dfb12e26c049199e40f7ad8abfb4f3562fb5992c1159e9d55b327fee0bc5518d3c84df90601c5f9767817712d191d82f
SSDEEP 12288:91XLsswWkxy2lRq2czAVTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:zXYfDtczA5BSUhmg+KSTzZOf0mTZ
TLSH
T10185012873E449F9DD67827CCCA28512EA33B8554364E7DB03A0D92A5F336C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 57f905da7c6a5322a88f58aba2d0af612caf10bda3fb4401f28e225769fbab3b
MD5 21b6facfda709773726a6faaa980f060
SHA1 ac1d80ae67794d8cb70b93803846a102f24681c6
SHA512 349c0ce324ed149521eaede740f9663dbf41107a83faec1af1a91411381843fd1228b46f44e228804b2f5e9d834c2544ce204384f1f679c44cc9bd44e6326dce
SSDEEP 24576:Z0Le5ji0hmxhrMqBSUhmg+KSTzZOf0mTZ:ZPji0Az8qCKSTzZOf0mT
TLSH
T1A195AE66F6748331D073C0B9C5D2A68EED71308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 312e7e5ee1a62bcdc3aeb95b0312ad01dd64a44a8599495cbc332b3343a02f09
MD5 d01ddcc3c0f71bc414cb42d45c29be0b
SHA1 95bd6c9534f6797de15d2c04e5460d60cb4ee5d5
SHA512 8f3f87a22ac29a667a075b9ff40ba022e313d679b91eed0d7c5647401fdc165ba7884fa2b04a97a708a5ad33772b9070eefa36cedf73b778a5f0c61ac0a16c90
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyugBSUhmg+KSTzZOf0mTZ:I/ezSC6vUzPv+HjyQqCKSTzZOf0mT
TLSH
T1D3755C25F5788323D0B2D0BAC5D6AA9AFE323046573089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d915171c614553ce0ebfd2baf52269fa727815552832119683f8d21cb4e71abd
MD5 b4902ee9fa01173e1870097b51e62de7
SHA1 9c4749e59b90001bb906e13bca0555fff649a6c9
SHA512 56e919519e3568841dcc05220982539388c497f386a5a5d22298a47a5d83459d15a7dc21b5c233c41257aed60be4320527b69dc5967d8326b55b5015e66482c1
SSDEEP 24576:NVbqPb88hv/l+BVBSUhmg+KSTzZOf0mTZ:NVO88hXl+cqCKSTzZOf0mT
TLSH
T126559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 844bc526502915e5870417b4ea08ff3710b17ca945563c5067b9d1774c26792b
MD5 4741363b8a65fcf65ccc4d2bfd1caf7e
SHA1 64fd5477b54ac1e91b2c421d89bdfa7303fb0078
SHA512 230ed995c64c766ea270b4649064241ac4a8083b17c9d9211f4ddfa19a2fc4fe762e058a965d50881195519f93b36f3a6a553d370c85194307fcef15b3090b12
SSDEEP 12288:7GkTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:7GWBSUhmg+KSTzZOf0mTZ
TLSH
T1986523ED17BCC3F7CF7205F9E8724C9629359F49806CAEB96002F95E9875C41E8BA016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ab602be53530d4c2862e7b85bbcbe2d089f1639386de0b9dd7318cc47dbe2ada
MD5 5ee554b7d80932c8be9c3c3349c88735
SHA1 cc61fbbec163ed48535cfe5c11bacbb23dac3b53
SHA512 f844c910a95975436b683a986128cb6d88eead0c5350029a925f713710f5c9ed55a743f24f9dcbb720cb13e2bbb3ad0d5e3f6d3bf5bf1b1053ae227a5e990770
SSDEEP 12288:KeBNUbTVO86UpTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:KJIUtBSUhmg+KSTzZOf0mTZ
TLSH
T18A85D07BEE38FCE2C67A4DB85A918600D77278304B61A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07e51dce711413fdf96fb83781e0ff970ef31cbf6843b96a72e690b1e5c6bf02
MD5 f1efd51a07b8a41f0c86bc8eb30244c7
SHA1 ba008752f3c71a3f52632291a344245042adc38c
SHA512 317f5e42234b9895b8b6a69f16a901930bbd119f1fc4a0dd68409677451211a628d0e66bcb519b1a132578f219bc705dfdda2fd06d13516e9d569ca99ea02727
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:CQvGAdlCEL8c/WRNw5CJtfZOfDT
TLSH
T13C266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 947177a7b9732c067f381389ba9ab5853f77041d6c878b17ef2f32206be46b2b
MD5 5d30ab6726658a231bb6952231da686f
SHA1 a5cfa511d02d7e3745e5efb8d305b703255d9a41
SHA512 b513a14533d46dacc7e0a513b2710aab47c2d86134b9d5413206f1485a4ecd358603be06f28df00c4fae92d359e7c46f83acfea318576e2ab1151aec353c1db4
SSDEEP 12288:rAwSfxL/2Dc3mDLLmt0LDQewsAjHTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0C:UfewsAjzBSUhmg+KSTzZOf0mTZ
TLSH
T1FF85E031FB74D036C77B0DB61B32C716183D7A204B652AC3E3A88E9E59306D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ce4f094aa0f6511c68be7781834c7946750f5470ac1f62cd011f94c57b3295af
MD5 0e9efc1573f37a52f153f9531b2a68ed
SHA1 0134bc75a163b595af52c0bb7bfb75a759f5be45
SHA512 c3c7ba7b250690d31d9c696ca4cd74b8d9b7a584bfb2fa78d521860ce1a9d281b3f069bd33a142d294e688b8993f8107bb890ae641d4f88a594302f860d21a61
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4fMf:jUEtQevvqc2W1cpV20I3240
TLSH
T1EE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 39ab9966d7008b74cbed90875545dbf5fb606903d134101fc3a54f00c5cd17e4
MD5 5e03bbf4612f594134e88315a7d17fbc
SHA1 3f5cbb28444f8d8995a5fd879878f33faf158252
SHA512 116d829ce93aaab0ebcc3ea276fe96f4fc4a900dfba0a859f8ba3ee6e1f661ea37e3ce28c510540aaa9801547e0a5599fa2cf1b3af0ac082e617d568d52794e3
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zMqCKSTzZOf0mT:zoq2VjnmdtfZOfDT
TLSH
T1B0D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6d16b5a2777abfa076cab43b86ebfc4fe8ee859cac8e92915684b74fa8bbbc73
MD5 f73b985c5104f3b6ab763949d5d88440
SHA1 71958b615c98338a85a85783a92f452745ebd269
SHA512 a060d9f93f902d75bdee6cffdbf25ab345eff107199462566fc17d92023e77b1d21900f2865bf1361b1b06dabea76fda4f9acae79701ff709dfdc681aeaa2800
SSDEEP 24576:OAhGL6IFoiwtA5l7S53kBSUhmg+KSTzZOf0mTZ:OAM5Foiq5NqCKSTzZOf0mT
TLSH
T19735AD81E7F945D4F5B3AAB899B68571EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5b7bc7b9e9e7a06cfe3ec8bc4b2f487907860d9f258cf84945cdacea925febd9
MD5 387330a1e90f5ad2f1683dd0bb9ad0ff
SHA1 87335e152529e068a07ec4f84cb9fb074ff2ac0e
SHA512 b506a21c0924a0cf208f4a75fdd1730a654a5da5ba90811fca953a6610c09c89a6ea9f232fc19db9eff657751667c66e1e5a8c1b4116d8b82e081833fbbc5df6
SSDEEP 12288:Tmw5HEjsChNEBFgl0WDm+COTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:ywuROWXBSUhmg+KSTzZOf0mTZ
TLSH
T1B785F18A37A80CF9EA674179C553C536F7B2BC052A25DB1F1360C65B6F33261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 348170c6d6bc9ebb9a0fd603a6706f108e6bf6fd9c9c37df16244c0008ccf2b4
MD5 c58e170dcfb55d3d8d8977422a3c9c16
SHA1 02b6b97d85a786f0a55c93c8a48468ba5d086c31
SHA512 40ef00be35a3c8559b0ee13a61286d49f146754858732aef27e93f3cf18216c621b76ff9c2aae356f937fc664fadbd1bf72ab7f1d35173bc78e8f82bc4ed091b
SSDEEP 12288:3yZ1Iy3TbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:iZuCBSUhmg+KSTzZOf0mTZ
TLSH
T1E175129E23F891FAC6B342BDD8B24A45D7327856533953CF1111866A5F33EC25D3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 577686fa80edc0fdd65d1512d6441c63d7af01771431cee0c19d6750ee16a9f0
MD5 14cf31ba93ba72c1cf7a43eb423a2e1f
SHA1 b3fb224d524a61ab3c1144508c732bc1826ba1a1
SHA512 71ec2312d67ddef20ed464901ba8b7df5a4a7eed7bac5f49cd50a07cc522425d5844f78bebd032ed826921bb5c38e4006214699fc77c51da201cad97e16bca70
SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN3CtfZOfDT:7QyiKanX+PN6fMf
TLSH
T1F3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 28229300ba9cf73bd1a6ab562727a84c0b93e4b0da294f846ab2b0ba78c053de
MD5 79ed4f9e09654da40836f61bbb69b132
SHA1 3812cf80d773066395fd91bbf2448d1d8e2f6c9a
SHA512 3f3af0815b9ac659db320857af4bb87ad4927646f4339ea2662867b6da70f07a082beb401012a43ddded2a7c3ba6383e10ac8b8fb3aae797761e05f1f80e74ad
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3CtfZOfDT:pQyiKanX+PN6fMf
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 972314acc43274e6a31f4f13714c8a08f06f57019d99622faa8bd5ababa38aa8
MD5 ac85c2146f652dcf33c760a0ac957053
SHA1 91eced4f99ec139aaa68da8064963cea692500e6
SHA512 d0ba51b467617e9da1c6cbae4342a9705b8cad85ea082b08417a48dd9f204d6d984d0008ce62881bf4488174a3ddfc9a06a17f3b0b336869fac14a427af0e955
SSDEEP 49152:U68Qg55nhkeWu7PNU3/8qCKSTzZOf0mT:+thTRc/8tfZOfDT
TLSH
T153B54933B2F600A9C45DE1769F46872196D27C758FE0E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 09973fc24017bc66717dcca3fd51ee220ee24cd45d34471daf3a4188c2c6ac9f
MD5 7f4db5fad67e550ddd318cfd89f9a0ab
SHA1 17bd4cbc77f873cc3194e0a9d7f1fee7bf274ba2
SHA512 5c02236c0c5d3958d65c391402f66c98931da439f60bb72aa1d96763b86960c6853020f709896218f6aea53edd4bb8f47e680365e24412abf2391048b8bbcb7a
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZ/tfZOfDT:BLIHRWhXfMf
TLSH
T19F167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 235d81ecfedfccafb63b62e85175feafc3f91e6323d96945574340d4c1fb812b
MD5 86a2d9a51c69c6fd5d8587f742bb8089
SHA1 f64be43e117df854e9c73bdfa03204556b2cf178
SHA512 49804c8a6264ca3d83c362dead5828bbe8eb704e164b3dcf2e968038b13339591062ecf084301a7d1ca9d9007e0c5794019294ebba70d60b33143ec043c1f986
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glqqCKSTzZOf0mT:Pu6JmIxd2dqtfZOfDT
TLSH
T1F5D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad33fb7e31c0778823fa36ec9f77fb72564c854443e00414fd37ffd93c6480d7
MD5 a3dfaf4f111045197f36efd5e0341bcf
SHA1 78c6915532816e175f35ad5cdd7e6aa063b6d2c9
SHA512 491abe0dd8cefd4bad3da472ab554107e6c911570efed08088cd4d9d00d5d10723b14ca046187dadb0a09288f28ceec571e680508807fac98364961e1d6ccff5
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4xeqCKSTzZOf0mT:zmifPqRdtfZOfDT
TLSH
T140B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b086e4077788d3104c6954007c24a6ab963b9b9e6a682aad61b9433fdb15170d
MD5 e921ead2a5f36050d72fa48ff1547a1e
SHA1 9fc4a52aa62d2d976d8039734515ba5936f5beef
SHA512 eee8ff3d1404330374dd6228bf0c37355314fb734a1de84167026585f5a8de889f3189f03b7d0082f310204c97dc3137a3b61f982d4f35691d01f7511ede3333
SSDEEP 49152:VSuZQIY0Be2KkRVtOnks6NMHqbqCKSTzZOf0mT:75dKqi61btfZOfDT
TLSH
T17DC5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 48c436b59c75a38df1cebf0a16a7e1c7e105f837c5b6761d0e3049cce2a5863e
MD5 6ebbaab0c6cbb66686dafcbd54e4b891
SHA1 f6690beb1edce8c7407b079c4265f0f7f8dc72eb
SHA512 d908d04a338f7a8b59db89fea94244e92bcb88bc4fb7d372a2c04f138c1cfb9e35dced0da71ac1cae385d23140ea89cd90429ba178c60bafb0993e383c371d7e
SSDEEP 49152:+htSn8EApI0figjgiDn0AP5waqCKSTzZOf0mT:fX2iWphBtfZOfDT
TLSH
T1D495BE13F2D901E8D06ED178C7568632E962BC150B38BAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1b2760bb256ff8f86e096bdbcc9d01af36023ec02ddce2f30eb527518784ceab
MD5 cb682ccf90adc705e24faec861095dc3
SHA1 f2c5793767ae734095cb9b2e7c8be280423daecb
SHA512 637ed285ebb3ed67fdee0857fc2d776f655c28dd9f2a46b8d7a94dd9f3f12496ac452bee75d6a36ddf2cca1f22cb01b8c037e6bfee8042793129c9637bcfed01
SSDEEP 12288:pcTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:pOBSUhmg+KSTzZOf0mTZ
TLSH
T17C6523ED27BDC3FBCF3105F9D822098659395F4E902D66F97103D41AAD72D81A8BE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 dc1a1ab02f327e41f0f51747701f7f91395c4c9fb16e4743a1e2e47a4388caf2
MD5 18705cc38deca912ca5e2698954b0095
SHA1 5d7152b96e05742e2786cee1ebe4a187d2c05122
SHA512 2c4f27fc2967212cae1ff4368fd5e8df95ac3ac0bf95f15741a22fcdc7e6f41ec79a889ff7f7971da3331d35d837ba7c1691845793fb6b08e6296e51d9df0369
SSDEEP 12288:BzTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:BfBSUhmg+KSTzZOf0mTZ
TLSH
T11B6523ED27BEC3F7CF3105F9D822098559395F4E902D66FA7103D41AE972D81ACAE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cfe4761d08bf40ff0a329e72700294aef05d1fead86e045dca8834b91950c50c
MD5 f66ccd1a70a3de430679b76adeedbcf6
SHA1 cd474863a6e128f559089f01f06491ccb6d49c1e
SHA512 4ba75b91463fd3f39758c230c8bd81b7692ef6fd381c8c77636f7d1a4d46ad85a8447a9357175aa6e245d4825c37b38f2b7100800bcdd15dd4906b76435c9450
SSDEEP 12288:EhTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:EFBSUhmg+KSTzZOf0mTZ
TLSH
T1FE6523ED27BEC3FBCF3105F9D822098559395F4E902D66FA7103D41EA972D81A8BE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 201ee9a5b34de7cab63e6aecfae73f74231d5c88a0deef78d9998a1ec383568c
MD5 945d7c430d06bc3b31d73bb613102fff
SHA1 cc2dd4ca901d8c61403704dba7c260b967aa112a
SHA512 221a1bc6db72b3856dbfb65da4a545b21ef78c7bfa45668ca6a10773b7ac947b3cabc72e8f25f61c1ddd8833accab88fd7b5c8b4e82d03f48317bd327c15ab05
SSDEEP 12288:LVSTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:yBSUhmg+KSTzZOf0mTZ
TLSH
T1026523ED27BD83F7CE3182F9C8334951A635BE89913DA7FF6502840E5D72A80AC79214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 408a242584e154191659f70386a7a7f3c729bcadc81ab364795a6dfc7ff561d2
MD5 238e083f86a982f0d71d5265983516a1
SHA1 93e46aaef5dae7e2bebf03850051b5b1f3ada948
SHA512 68fe01d97bb0d6d19737e0f73e880c36d59e502872594d565403f877942ce41dcd9af9bca69fb3f9a031bf4ea23fc55a1f5ba5cfd96d8ecdf161cf9169a6d410
SSDEEP 12288:d6TbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:dMBSUhmg+KSTzZOf0mTZ
TLSH
T1AD6523ED27BEC3FBCF3005F9D822099559395F4E902D66FA7003D41AA9B2D41A8BE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 39639cd7767a055779c6a74d4c99bae6d4dad32275ddfa0912f97f9d8d2da4d8
MD5 ca4ff95aaf205c9fc6b3bb6383b21602
SHA1 93808c7f47ab73f4a445c61073164c54840e9348
SHA512 50de22d5c4ee981b7bbfaf522404d4a1e1d0c0e334d0fc8b904fe34b762d914edeb0a5c6ca088a9edacc04348ade4062ac0c9d1d5f84013fdb8002b1669e131f
SSDEEP 12288:D/TbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:DLBSUhmg+KSTzZOf0mTZ
TLSH
T1406523ED27BDC3FBCF3105F9D822098659395F4E902D66FA7103D41AE972D81ACAE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fb89810004f207d99d0e315e9141ffe8b74bde2c535f50c90b323b7dfe321c15
MD5 479f7aa39b36738c7fa86a9f4108e09a
SHA1 2c2519dc603004469f0d2f28c277aa699dfdd414
SHA512 f2f55c35692f4a4e12ad08b589730107b50fdf2e6a86aa66665141c1dbcea80d19cb2fb06d807dce3ffee48ee5b9b14b84c10960f64bf33342fbbcd0f739db98
SSDEEP 12288:KbTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:KHBSUhmg+KSTzZOf0mTZ
TLSH
T1A56523ED27BEC3F7CF3105F9D822099559395F4E902DA6FA7103D41AE9B2C41ACAE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 5b034cee4e424e280fd27d953aa51914f6e88f2426cfd8a00c3d8d408ad63397
MD5 c82ed6a37afa244b25b6f969c4ea1417
SHA1 5946dd0805421493663840ba9a4caeb15f3c68de
SHA512 1f5158ac7858dd52b6b443cdb176d0fdc388572205a9c5399e78c23983cdd551aedde3a37460c9488818fcc3fca1014b885d6650ef80c5ba6f4259b272b6c4ef
SSDEEP 12288:QiZwbDzzFEoS2cPvyTTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:TZM3zFVSO/BSUhmg+KSTzZOf0mTZ
TLSH
T1968502A973A048F9DD73817ECC218906D6B27C5A0674C65F13A4362B5F337A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 64c4b71468b8746d224ce2d3542983f0a0511211086d4ea65b7aeabedcfbccc2
MD5 aa10834a51e68399f84d7eae658504f8
SHA1 7868e4adccdfaaec72cfd14b7f02fb9f60d9f6bf
SHA512 e6cf9a42107c55d010719c26af4e8b9c9055c9844d1f87637d425c9ba26362bf70e0aa927ffa967cc4567f5e5ad7aed35c7edee3b74729d8636f725c1c3c222b
SSDEEP 12288:tgTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:tSBSUhmg+KSTzZOf0mTZ
TLSH
T1566523ED27BEC3FBCF3005F9D822098559395F4E902D6AFA7003D41EA972C41A8AE058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ede12090838348a5660db751f3014100744e5650cc70d18d5bcd3e24eb34055f
MD5 f8c375cac24fb92e2d914c02133a207c
SHA1 a6772688a8c2f9c91147d32f60f51786925690cb
SHA512 0b5ea269a6e895fec28e3752e9e72e185c7bd7765460038fdf548256257c25bc1790c9d80f1ee50bd03d8125705c7f535155538e7a8fc83df8a174291854d91e
SSDEEP 12288:zUTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:zmBSUhmg+KSTzZOf0mTZ
TLSH
T1646523ED27BEC3FBCF3105F9D822099559385F4E902DA6FA7503D41EA972D41ACAE018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a791684e1d9565d2b79acfd2772de8c40fa6eef5748b91261e606f5fed18c1a5
MD5 549881b9c4586503bf9ab006be54a62c
SHA1 3afbe59d27d719155d059c6725bdf0b8dc51f8b0
SHA512 66fb974f65ee61894832cb11daa47f9c6402ae414b4be87afa3b2475d639494958db7378c2041425ab0169a57d5f52e3f88ba37346978f6173891d15a6451971
SSDEEP 12288:ZyPz5L83TbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:YzyDBSUhmg+KSTzZOf0mTZ
TLSH
T13375125B73B561F9C6368279C8620A02F735B83647349AEF1360467A6F336D1AD3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 62fadc3ee5b13798cb692b69f576a79ccc17fe301d828dc886140e075098222e
MD5 0982fe1a027d8a80852fd2118157e4ec
SHA1 798dd5d7af13ee768ba1fa1f1110786e089c1cdc
SHA512 bc622865a8b71929da80ce4ccdd3219f4520b6e9057d26abdd4a66826ba0bf2f74771cfc145763a4f058e95bb90e4b4396647e110b5731d36f30ee426e768f80
SSDEEP 24576:jcP4mcvIjkGOxhKP2l71nNKbrh/8KBaBSUhmg+KSTzZOf0mTZ:YP4m4IpOO67W8KJqCKSTzZOf0mT
TLSH
T1D265AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CF1160933D7F77EE14E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9961bf712967c9d07d1a51a35652f293f2570b3efa01e9fb58a879c69588ffb7
MD5 e664441f9a92831719bc83d3d96f52f0
SHA1 9630e0da0d5ec67773100865416e52169c58c723
SHA512 f3b7df2f980d5509befcfe218e073815ab58b42842ae9c5ebd60864424566460d21d1bca8de2e2308e59eb092d44ecc74f0683df2b0773c7b199e0029078ec4e
SSDEEP 12288:1psfwTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:WCBSUhmg+KSTzZOf0mTZ
TLSH
T145750159D3A842E9C56E61B9CB524A41B3337C2583E5D3CB62C0F53E1F76A809DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log
Size 3KB
SHA256 472259943090420a4716d1e2a1e55ee8946137cc17d29ce2d8478fbb53c00229
MD5 4686cd8a584770d8b55d01d4282af242
SHA1 66f6c40308ac8b6fa83c93549784c9b80d1ecb6c
SHA512 920e90c087b66398add1cdfffc209de68e982540753ae7d19be65cd70e273aa0555abb4943eac1cf33c6e3878b1aaceb587a628c516449f75136bfdc459f47ff
TLSH
T1428122656B87D96B6664CC7F1F3054CB6AD914C493CA223033CE2A0CB897E365DCC96B
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl
Size 1KB
SHA256 89af0456d3b37de7603a456d9f332bc75ffc151a4317a5b4fb8811f10d5b50c4
MD5 a385406f68f551a020dc5ff764f750e5
SHA1 ce1f483af45cc823e68c8349ec2a0f2db1daa071
SHA512 8a46c210b96014bdd7eb9ef99b4e086cbb6bb90be825f89848872ad3066249da2ea8c53815e5de95d20cb0f26a53a805993a67d2c75d2c144385e4676297920d
TLSH
T1F2319541B117EE70DC3B419832B6795FC1F22148DAE017541BC8EC4D09CB84F65ED12E
MD5 SHA1 SHA512 TLSH

Submit Download

19fad29068b29bb.bin

Path C:\Users\Admin\AppData\Roaming\19fad29068b29bb.bin
Size 12KB
SHA256 bc3250b9f059aa11413f0e127d9ee266f7ecb7b5a9c3dc40a418c29ca4094ef9
MD5 bc41c353181422ec2cf6adce47f2ced3
SHA1 6142d1332e1d073cdd4ca02b22cd17e9b619d79a
SHA512 813e330ab873787ee3febc96b54a96401e691c12265d47d8e408df66dc741220ce7eaf6bd9753207c45b8541db29b3a00c0fc40b2d7995137b66eca960412348
SSDEEP 384:DaaY6b02sSdsSYf3mFRc1HCYR9ifsLlQK:DaaESYmcZR9iURr
TLSH
T1B142C01C06F27592E960B7EC5B1EBA4EDB9B109E814F8B7DB426CDC0A10818E4AC759D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cb62e621488f6d42b7ea468fff27745e5d51398d477024b3087ac0675c1efe82
MD5 3d537ea5fcde6349506b5b10f4a70c88
SHA1 34c324d295857646dc9fe2287c977a48de5170a7
SHA512 86d4d8a5754c20598f692a80be2793ca8018115d5a0e1a84d77015f86470f6b6725fc708950bf9c709ae3358bc11d35d18744ac527fb1314a1403ecf75295e0a
SSDEEP 12288:RQTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:RiBSUhmg+KSTzZOf0mTZ
TLSH
T1CF6523ED53BCC3F7CF7116F498228965253E7B5D892CA5EBB002D11D9871C81ECBA11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5949d2ed58371b1bfd0e052ffe5e6400f4d05eb3499b7bf34ab8edb883567d18
MD5 260d9020ed979aed0b77dcb31dcc95cb
SHA1 3eefe7f230f7638c233c56d3352b663d77b7f292
SHA512 b73c570b819872b9449b5cac9a57a74da11ec786cb388c195ebcb6dc3c1f03dc63c10cc83eb982a1ba692b3b6142dd0258276d2e4e2f48cefffd2a90b7aec2e6
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQ1qCKSTzZOf0mT:da0hNYG4JwEtfZOfDT
TLSH
T15C85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE48D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 14ead48b0996f30a4562a346ff080e8f090693d54679541a45c747057e813b0e
MD5 8cb40d5451430b286d4e2623d24f075b
SHA1 5aea1a80a4ef6b72434f5e5bc9b7d68561809897
SHA512 fe7692f7d2d282146cd362dee87603bcebfb57323dc31538e71edcfe5e35e0b57d8c542959fe436b1453c73194b4ad152a74514b38b6179a5ce124e1dea2655d
SSDEEP 12288:HhbHjfXDTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:HhbHjPPBSUhmg+KSTzZOf0mTZ
TLSH
T1D67512BE27BC11EAE671A1BD94628546D731BC290725A3EF2282C17E4F37ED05C39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 539c3f21a3ffbf0a33648f6a75d09a9d2a0e1981657ee85c6ca49fa4563ea000
MD5 b4fc33d1aee971109809c3a6a9cb1447
SHA1 7209dca2959815e401054f6ab6ee82d7ec3cd6fe
SHA512 c454b5e91f7ad9527a581f8dcb93ceaad91cf24a5b068a6bdfb89293f6914e9f71d7e9684c5b64d8796669197150cb6234c91455ac6b2fa13bc9e272018a48a6
SSDEEP 24576:v3YgnJcRTk4yti+R5dBR/XBSUhmg+KSTzZOf0mTZ:vIgnaTk46pBR/wqCKSTzZOf0mT
TLSH
T18B45AF2DF3B910B9D8A6D136850147B5FB71782D1F209ACB0170C538AF1AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 b12e8746c21e574ded48df212ce1fac9d44a8207df2fa13ce6cc418863f2c377
MD5 a7dfeef3c0e81d2edf193136563f7fc4
SHA1 f9902c33f3f6d8e8d2995881f5216f58518ed667
SHA512 4c995e26cad72cc30a86e76be6743f796d74cb46fc602c6f5497937dd4f0d6599336c0cb62bd92adb842311ec8b134bcd3401db70b7deec287e5d02f63edf040
SSDEEP 12288:QETbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:Q2BSUhmg+KSTzZOf0mTZ
TLSH
T1416523ED23BDC3FBCF3116F99823495525386B49423D6AFB7002E41E9972CD2ACBA115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9f1c63dc0e48950b9d72edbb5cd65e3e33e4927aee4df5d51c9c218db81943f3
MD5 1214eb8ddfca47976fb6d8186979a9ba
SHA1 e894a53172153ae663291c599c4cb634cab3900a
SHA512 c8cbf23da9067819782f9096b73fac2ca97dc2686fa02babd34cc4cd6f3322b843b9ca7112c20d848f82f30c9672d4f5f196f55ed825f92fbac004529fe94767
SSDEEP 12288:3ObIA4LWOsvAYFTVTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:YAL3UT5BSUhmg+KSTzZOf0mTZ
TLSH
T17D95F159F7A440F9DD77817CC8628916E672B85D0368E7EF03688A691F237E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a7950b0a678a27bedf7c4c3573143dfff6e83bdb6ac276a3891032369d03d3b4
MD5 b07bf7948c08a5987fd1f00a8425cae9
SHA1 9eab661eb2c461353df005fbfb1888057b17880b
SHA512 acd8bf75320102b579aa98d2584f32c4bccf0061bd1d13d5f83918a675b95d7c5ae80f8f6de089543b7e0e9d0955c9de541534e981c8486b0c249c854afced94
SSDEEP 12288:ppFtvOJTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:vONBSUhmg+KSTzZOf0mTZ
TLSH
T10575126E33EC01F6D635A17D89938249D331B866072667EF0290C17E5FB3EE4AC3A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d2082ed0f12723e3b36dc712fc170137b102707b77bda34d2f02dec8e6f2188
MD5 aa98d339654bdede7b481a47531bc5ec
SHA1 dd06058c6e7a1111bb1c2bc8c4a32c4cd575dbc1
SHA512 62a0145392473bd2e1e7a0670f452549b216891d9d0775d861d5f35bec362ed367498c3bc9e0197e85ff77d7712e034921a116b672fa84312281f3e66bdf3961
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhsSBSUhmg+KSTzZOf0mTZ:H7cBWMpPjN8DbEhYqCKSTzZOf0mT
TLSH
T17A65AE6E6BEC81E5C577D13DC9A28205F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 05555d7e6d67f4f7bbdb87704754e945f341172dde91d225fd9abc75319bea2e
MD5 a4bf26ada56b21a7c83bd51813a1fc12
SHA1 6bbf098f466c4fec3c2cfecf3ba4fca9d71f1502
SHA512 821f14235f0cee1b869785b0794a94788e54362ffd4c8c03824f739a0c03ec2fa674c091711bfa10d56a97a7902ad77b34c9b92fdc0e6259331537d2e60b2c04
SSDEEP 49152:gF2YuHNETovAvNYf8kmrqCKSTzZOf0mT:16BCf8ketfZOfDT
TLSH
T11B858E6927ED80A4E0BBD2BD45B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 83f0a95b29a0046d00c7986b3175da1ceec6364f8c73a4cf718205acd0710ff8
MD5 2cc7c6264c3b5e30f38d84fb5028c0ae
SHA1 959264479ad6e9d47ba51f2d63df526eab83562e
SHA512 e093adf6c4587399864060752d7eccfd13f617adc182a098e930be3970e41e057cd381d2f2a8f8e86b680027ab9a353309f441c8511670d52b84969cd6b35041
SSDEEP 24576:aAFs06+Omlf8NXEbToRBSUhmg+KSTzZOf0mTZ:jFs060loXuVqCKSTzZOf0mT
TLSH
T18265AE2F62AC00D5D07ED17E8997C91AF6B1746707256ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 d3f5534a793dddee1f17a965a934090ec56a0a60c9206c0199a8e8982b838c40
MD5 3bbd9866dcccff7e7d9d9f501e5a233e
SHA1 2153f1cf93ab74f4cef81d664abebf70cb5a4e42
SHA512 82fdb80fc15a6aefb0269e1297c10bb1074e97c7a6e3af4b76f2c519ea609f968082b2afa11e04c6075a5393cc61d9d6af8b9a963e950591e2e81f126e29cb39
SSDEEP 12288:JCJnJ5D3VkrDzxATbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:gJnJ5D3WXsBSUhmg+KSTzZOf0mTZ
TLSH
T1ED85E03DD2A810F8D4B7C2B4815A1B96FE72383D2B266AC72474D5357F12EE0A979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 321ac33454bf6f612aaf581ef763c5232353e7e048103c0417c174dd0d4102e4
MD5 185e03c4f0915a374aad1a3abae9ee9d
SHA1 4950f1f74ff25703f6b205ced5bcb3fa03f5cbb4
SHA512 720bf3843ccff8bb1d5b7710ea0a1b82d19015d23cf57e5f1070df860cf40f2cf12aa8db5d92bd3d24606d6fe05ea109769368e69fcb027ae585b618707792ed
SSDEEP 49152:mg06DIKdwc+eQnSt65aVHqCKSTzZOf0mT:/xtfZOfDT
TLSH
T19C956C16B7EA5294E8B3CAF1C96291169B327C509B34F7DF0AC0C92E1E33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 49b7a9513f309ab288debaf7b9e9af301be51b798cbb35f6c943a77ef0d6912b
MD5 659e5193b469ee104f2e0045f73bfe48
SHA1 d34b3150af9fbd3f0e44d40bf6489e9699f4ac80
SHA512 1132f4cb2bbe025ddca448e96281754da7c20002e47cba5d5a99fdd5bf8b1258fc80d4737678ef582185cf2c78207a05113f51a3100785d4cecd6048d2f8bd01
SSDEEP 12288:HEP3RnqTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:MncBSUhmg+KSTzZOf0mTZ
TLSH
T1D97512AD27ACA0FAC63691BDC4628545D332F065172667FF1192C23E8E73DE56D3DA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 4c61a343d51db7311dbe979566999bb792cd229a09893aba42ee093fa7467653
MD5 964f12f777805e2c9eb8a055b51e329b
SHA1 12451a93ecce4c1929ca559c45247cab78c9af32
SHA512 b85afaeb0944d3978032ab2a21037f1cac746f28d19d866cc740a5cf36d5e54a325015026ec62d3dd67578d81358e585220bcb40c464b36dbd82bdc40644f1e4
SSDEEP 12288:IjkyzTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:IIyfBSUhmg+KSTzZOf0mTZ
TLSH
T1E175129823AC91E5CB7506BCD87341919A35BC205B29A7EF6081E63EAF33FD0AC35715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 3da9b9861577aed360c2a312e05889f6cb07d15a590a7bf199c15bd92c49814e
MD5 e9e8eed05580117eb607246dfd7400a4
SHA1 fe92416d6a69e512421c2dc6651909870baf797c
SHA512 5ee866d7389543936869cfa323f8c9aa7a9d2c84f9487163bef566a221bbbaa6112b4e9d1d7a9ecac7aa997245c80175f1c186bc03ac24d3e25fedc93e9e85dc
SSDEEP 12288:wy5TbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:NdBSUhmg+KSTzZOf0mTZ
TLSH
T13F6523EC23BDC2FBCF3105F99832499555357A29422D79FF2052E53ADE72DC2A8BA404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c86b143fdf3065db44765f7e2dee44c3d01891115c6a930e1fbe162667950a50
MD5 53f5102a51870017b7f360b97a0400bb
SHA1 33855cf2e6af636123784cd44d7097ef7539fbee
SHA512 eee516f6a318f9f61f907f1c77da51fd5e7425176304a65bb9149bc6d9c60f2ecbb8c7812c32def32bf0ddd0ac36e433f8fa83ca37de1d02064befdca0524f8d
SSDEEP 24576:uQ9MxZKdcz9dw3KBSUhmg+KSTzZOf0mTZ:uVKZTqCKSTzZOf0mT
TLSH
T1FB557C2DABE9059AE173D27994A250C3A633B4311B35D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 9daaf2d92b68d324598c48da3bee805554a02e45c3f678fd390ccb41db6f39f8
MD5 d720343648a44d2d0b23f917b497af6f
SHA1 7e44d14e698a024062cf0c77e60cfbf3ff01b24b
SHA512 37ba2b5122f1a6252b7ef2cc580fb37eb4c19c4621d2aef2baaa1b867844ac9373ca9a5a651b648052820dc5560370c502a1e811d9842e603367e3c24fe1363c
SSDEEP 12288:IyoKo2JRple9pHTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:IyocDApzBSUhmg+KSTzZOf0mTZ
TLSH
T19885E05FBBAD40E2D172813C88818645E773B0345B6267DB6591C33E8E639E9BD39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 22d2b89d54d30bdc26fa730487d802da42492608c4d3e93781892aecfd3a2beb
MD5 5ba8cea2b997f8114634914b5ef96abf
SHA1 8d09b341346f369114fbbe58892cc52ff0b31bde
SHA512 6572dac85ab8e0d4457ac0f7ab5f25ed0411c31e9ecd1186fa0ccc13a6d8877dd0bc4696ad5ba2442ad7b045f1efaf1df4162331072210d4aad31805c7bf959f
SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsqCKSTzZOf0mT:d0zuNIatfZOfDT
TLSH
T1FDA57B3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2a4e4e5b161719c7c79232815cd78c5af1bf33343cc5243286315c16e21cea56
MD5 76b929ae1f8a3ea460e26c0db42c1e6a
SHA1 07a639bf9816084813bf29c82d2ae56f08734fd8
SHA512 1b3c74b797370f2a8bae6080365f6cfdd511c5f6cf2ac31be971347487dad4a71723ce4c5b85fa67973dbd1eb7c81bd9caffc5a27363af84713bc772e0a4d320
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYzjMqbABSUhmg+KSTzZOf0mTZ:pTDxR+N5YzTBjM+qCKSTzZOf0mT
TLSH
T10F55B02EA7F845E9D17E85799A23C512FA727821033193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 8bd083e912a8fd303124c96e53c7dfad2a7075b8ddbfc7dd5a2d702f12ab79a6
MD5 e807a15d9e0e43bed88fe545b8d604eb
SHA1 79cf39800e33f02fbb6fad6647d3a79a054132b5
SHA512 e32c16bef6a2388eff1feb884625f668d301563530614911e28ffe5b66c575a505f2700856fdcd9ba4411bab8825f87df96d67d62e5b064a883351f1de7fd355
SSDEEP 24576:uTMdOz0FFS+UmSLEBSUhmg+KSTzZOf0mTZ:a0K+UmSLdqCKSTzZOf0mT
TLSH
T1CF85F17E63AD04F5E57BC2BCDA538906E67234660321A6DB0690C07D2F67EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 441a0d4ac7096376ea9972a8fbbc71651f6a583e8c34e46074644f164895d5e0
MD5 07fe3230f09e51c2a637ff1921f3cf47
SHA1 81fe4a9d16c478a885527841caf9f77099e75b55
SHA512 31aec3ce7dce36c9746fb6a7a2b41b46f471cbfc4259543a14088b3461074e27f64c8af0c8a3d2cc475191f8bfadbf6190aa67e9d98e277ae2860b81098ab959
SSDEEP 12288:j4KVTbmyWlUhmKEY805cnU+rhViSuJ6wmzZOxd0mqUXZ:P5BSUhmg+KSTzZOf0mTZ
TLSH
T17575129D23FC61E5DA3252B8D93205469630B82A13296AFF34D1C57E8F33ED0E879712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-216-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/552-26-0x0000000140000000-0x00000001409EB000-memory.dmp

Download

memory/552-15-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/552-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/552-85-0x0000000140000000-0x00000001409EB000-memory.dmp

Download

memory/640-221-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/824-212-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/1028-103-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1028-435-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/1028-109-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1028-113-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/1048-217-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1144-187-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1144-436-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1144-171-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1144-223-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1144-365-0x000000000C950000-0x000000000C958000-memory.dmp

Download

memory/1144-207-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1300-149-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1300-143-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1300-215-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/1860-121-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/1860-116-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/1860-209-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1984-220-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2116-138-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2116-132-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2116-214-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2204-27-0x0000000140000000-0x00000001409EB000-memory.dmp

Download

memory/2204-24-0x0000000140000000-0x00000001409EB000-memory.dmp

Download

memory/2204-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2204-6-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2264-210-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2264-424-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2424-29-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/2424-111-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/2432-381-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-373-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-405-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-404-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-403-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-402-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-400-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-399-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-398-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-397-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-396-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-395-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-393-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-401-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-392-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-391-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-390-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-389-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-388-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-386-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-384-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-382-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-394-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-380-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-379-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-378-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-377-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-376-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-387-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-385-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-383-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-406-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-374-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-375-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-372-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-371-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2432-370-0x0000023FE1CD0000-0x0000023FE1CE0000-memory.dmp

Download

memory/2624-39-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/2624-37-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2624-31-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2712-364-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2712-54-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2712-48-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2712-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3272-71-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3272-84-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3272-81-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3272-77-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3272-70-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3564-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3564-44-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3740-222-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/4496-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4496-98-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4496-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4496-369-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4516-156-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4540-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4540-67-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4540-367-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4540-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4600-368-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4600-86-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4716-225-0x0000000140000000-0x0000000140254000-memory.dmp

Download