Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
- Size 7.8MB
- Sample260819-e4nf8aythz
- SHA256 dfd17084235c36ed2a6caf20636be39f2f0ee9c1ea9873179f1951389f915bc0
- MD5 c0eecac2cc65818ea4f1b63cc2fe8837
- SHA1 01902449665644b7346fac3a1227322c18f141e2
- SHA512 59a184e607d0bfd6d9ecfaa39db0d4767f196e774c8cbdfcba45945047ce335b8b78674ebcdea64c110a98c3b9e3e52096a53d4e533e8dfb723e960f1d72c3d6
- SSDEEP 98304:F/T2AiHxLxsV0CV3g6DekPS48oh6xJta7nwJpLm:F/C5og6s2+jaLwpL
- TLSH T1EB867B13F19A11E8C05DD279876A9232AA71BC490B31B2EF0B9077162F76FE09B3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 692 alg.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2536 fxssvc.exe 4688 elevation_service.exe 3008 elevation_service.exe 816 maintenanceservice.exe 4844 msdtc.exe 4144 OSE.EXE 3356 PerceptionSimulationService.exe 828 perfhost.exe 2304 locator.exe 1540 SensorDataService.exe 2440 snmptrap.exe 968 spectrum.exe 3104 ssh-agent.exe 2776 TieringEngineService.exe 2448 AgentService.exe 2900 vds.exe 2080 vssvc.exe 664 wbengine.exe 4548 WmiApSrv.exe 2864 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\af0bcf943a3ba122.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a38e070932fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029e8f070932fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4288f70932fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f58a9170932fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0fa0371932fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039493171932fdd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2464 DiagnosticsHub.StandardCollector.Service.exe 2464 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1384 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeTakeOwnershipPrivilege 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeAuditPrivilege 2536 fxssvc.exe Token: SeRestorePrivilege 2776 TieringEngineService.exe Token: SeManageVolumePrivilege 2776 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2448 AgentService.exe Token: SeBackupPrivilege 2080 vssvc.exe Token: SeRestorePrivilege 2080 vssvc.exe Token: SeAuditPrivilege 2080 vssvc.exe Token: SeBackupPrivilege 664 wbengine.exe Token: SeRestorePrivilege 664 wbengine.exe Token: SeSecurityPrivilege 664 wbengine.exe Token: 33 2864 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2864 SearchIndexer.exe Token: SeDebugPrivilege 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 4340 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 2464 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1384 wrote to memory of 4340 1384 2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 86 PID 2864 wrote to memory of 4680 2864 SearchIndexer.exe 112 PID 2864 wrote to memory of 564 2864 SearchIndexer.exe 113 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exeC:\Users\Admin\AppData\Local\Temp\2026-08-19_c0eecac2cc65818ea4f1b63cc2fe8837_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.85 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x140728860,0x14072886c,0x1407288782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:692
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1140
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4688
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3008
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:816
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4844
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4144
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3356
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:828
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2304
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1540
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2440
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:968
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3452
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2900
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:664
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4548
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4680
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:564
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 9d3f82b3ef1bc602dad5e194bef55f28748cb3ffda1ad2dc037a749f060001e6
- MD5 ea91f3814bf9ff7e4d6cee6cf88522f5
- SHA1 3f8f9042c6fc786ffeebd2a177fa51f69702dc9f
- SHA512 b33bc0f57d2575b9ba416d1ec03f7a1c459ec3fdad03bca1979cd733386306c9918da1ddf59534a176bf7a9a8e142afaf462e6f7e7d674767be55f312eb9380d
- SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQQ/lFTjN4:m3q6HjBsLm
- TLSH T1C8D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 36cacfc8fd94e481420202c441aec7fa15eece431bf8f3fa515959d677fba2f4
- MD5 634b019f12891e53060311795927ae72
- SHA1 aebb88d1ad75bf7484abe1dea80f2bf10aba65d9
- SHA512 23fc1bfc994b9a307eabc89b1522f429dcd0fa382e69631d8a313e9ea34408c88fcd3947a5e52bd2842799a9de9a7a81cdebe052cda1fc5b97fcce17bf7e344c
- SSDEEP 12288:r1XLsswWkxy2lRq2czATGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:RXYfDtczADnQ/tbw/2Mkjy6Fr7g0oi
- TLSH T16965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 330281759eab8379503ec2e0f0620b154b97a74a2add9b82f51fe722b544d61f
- MD5 84c1fda32db55719971583cf074eba68
- SHA1 0a51289ce974e3cb60120f2f82ae07cbbbf96200
- SHA512 dcba118647c9b97b5b631f09c0e483c019550f08976510bd8453ceeafc7c495f22901c6094acb4f8623c712d04f2b5f9f553cba79e605a0c87d8a43434051ce1
- SSDEEP 24576:20Le5ji0hmxLrMInQ/tbw/2Mkjy6Fr7g0oG:2Pji0AlFQ/lFTjN4
- TLSH T10E859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 9836a25657ddbad44263b878ff5e5b84c4392fa695f81871a8e6cd67cce89bf3
- MD5 bdaa7669d6efd0229801d46ab7d1a654
- SHA1 b45dbee271ac451e3cfbefe3c7b73a68900e3b5e
- SHA512 ba85c35959ca7d0525ccf43313ba7d462e51e1a1425a6ba7825fe615d76c647dcc2f7f1dc0ff77047053df9b34ce37d9e7dccce8d87ec003a2ea0bfac90ae96c
- SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyuWnQ/tbw/2Mkjy6Fr7g0oS:d/ezSC6vUzPvxHjyBQ/lFTjN4
- TLSH T1F0755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 5b05330052aa109ae97d2100303af328b60905020ef0c9db2e88267e3818da2e
- MD5 f88c920bc6f4fc87e1d839c2854833c7
- SHA1 1facece9cc54ca1a22ea83710862de26056978d3
- SHA512 8edb0adae944e3d8f7a47091d810258128b46cebc31d7bdbfbb075af759bd5db6053a331a62dd5105ca6fef73150abde7444b5575e5a0e069832676000329528
- SSDEEP 24576:sVbqPb88hv/l+63nQ/tbw/2Mkjy6Fr7g0oV:sVO88hXl+kQ/lFTjN4
- TLSH T13D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 2fba94d8412637001439a3edbb0629165295fd9e04942c4b51c693adf3e6cbc4
- MD5 9c17525ebbcc5d60b19939ae18394990
- SHA1 4dca27f23ba147ba2b787c7e3de823f4630e6a6b
- SHA512 2270b8f8158ace049b029c6249fbf47036db41c13eb4a6ab8d69974e4a7e58af3e1fa942b43fa94db6075913f01557543fa7bb5cb36396de3e12fad72343942c
- SSDEEP 12288:YzMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:YzMnQ/tbw/2Mkjy6Fr7g0ow
- TLSH T1825523796A24F897FF2B06B15CC285826B3B0EC1BFD4AB4E6744322D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 053887640a78bf90dee59feec4a70f7c10cbcabe8165183d36f02c730e93fcd2
- MD5 8abd0de7f0eae128d932a621316d1d29
- SHA1 352139153ab4567afce690fd0e4a63211c76252e
- SHA512 cf585a250a861d212dd493a6636ec6f00cec8e5a4cca91baacf7a7d36f35f9c9dfa8a9fe7c1899520f923344a484c22d44810314b78a82ba75984b261f7a19da
- SSDEEP 12288:VeBNUbTVO86UvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:VJIUPnQ/tbw/2Mkjy6Fr7g0o7
- TLSH T1EE75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 325e6d19a0fdfcd43d884cd3cfc7ceab47e4f5333a9a69bd2db520819e5006b4
- MD5 7201cbceb948d3ff6b7b74182f73b8b1
- SHA1 9b3a52ff7c8c0d9db83eeb537fd978e01d8aaaa1
- SHA512 850968c7130fde621a1404d51092ff21edf074f7b6f715ee427eb5a49bd5d09ef59c8cd68862d7e888dd1f030428c9f9e2da073b327b30c9ca532a01f881f41f
- SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:IQvGAdlCEL8c/yRNw5CRLm
- TLSH T1A3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 df74e1324471430eee5614fb73c8d99dde2a4e92eb94583c66c886248e4597d0
- MD5 d5a80f48dc8ec605518a3f6fe01bb98e
- SHA1 3d7e1ce31a828adb02e44a654f99b8b703fb1bc8
- SHA512 ebbb8536fd0460b678b05cdb0c04e3cde269305423ef76423b61f8b547201423d37b0985e3a73b16846c6cd9dcf8c1ab4eee81eb4d750da5726c2759eaa1432d
- SSDEEP 12288:6AwSfxL/2Dc39DLLmt0LDQewsAjVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg9:PQewsAj1nQ/tbw/2Mkjy6Fr7g0oz
- TLSH T1E875E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A88A9D59342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 31d8892779b4c5990e880c47440dd5b233ef800460cf0bee0c74ca7552471144
- MD5 1c3c506b34e0cff773f03420b11f0070
- SHA1 e200f4dac4369b69b72a3e880171ff629f63392a
- SHA512 3da13413d7363d9d3c33f8d5ecea8070c1c966fa0ad94018a93132032939df4f11ced740c1ce7a163e679e6b4554849b5af6d1a56e5311a527305149277f7fa5
- SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyL:lUEtQevvqc2W1cpV2EI32
- TLSH T121474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 7ed3186c843ddce7761558a980b1c2df7f9916cd1c528c775781ecd5588ee08b
- MD5 d155b196a413b8f8703e33455b621e38
- SHA1 2170e3069ff4c09739b64b3f172fbf1ac0af9174
- SHA512 3583e81bb1abb81ca53c963ce976740bee4c4600e6a887bee070301a250ff0bc3eaff8f5634eacfbb0137ca990152f8ee5254c8068b3fdc3927989720881b0d9
- SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/zVQ/lFTjN4:3oqtVjnmtLm
- TLSH T167D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 75f71961fdcfb15c52126c390f37df51c21e9038e56133f63cfd63a971c5b6c0
- MD5 2ac8a50ff01bf0e5c07b190123c58332
- SHA1 6c0bea654477b3dc311adc4a5e906f45d5ad5931
- SHA512 8a0b70512df35a13656654d5afd5bf58687154d3e274ffa5ac9aeb022011127feb852008f06a534f006ecd034c441e54e6f7f23bb69eace3b28971515298c69c
- SSDEEP 24576:jAhGLJIFoiwtA5l7S53CnQ/tbw/2Mkjy6Fr7g0oy:jAMyFoiq5SQ/lFTjN4
- TLSH T1F135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 8a88a202102a351c53381bf89bd12df6cc280cc16e37444024d1d1261ac80a63
- MD5 612f395cd8c9ef1fae727b1a6763dfbb
- SHA1 319c560375a2b9fdc118fdea9340644e26707439
- SHA512 33e7212dbdabee679740c86926908a3798b18bfd974c48dd73bc25022435d02c568b535fa8c3bdb9d6ed36b16ab5b93c08708626006fcb9594e34bfc84ed788c
- SSDEEP 12288:Zmw5HEjsChN2BFgl0WDm+CWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMe:0wuHOWhnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T15865F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 82dae1c32319083e90598de2de23b416c6bc962817bd71a0ad027c8f4f76403e
- MD5 a0a4224cf48675d118844da219bf655b
- SHA1 e1e47ab93d98c7d9ded183719ac31e3d762d1365
- SHA512 c7a66fe40bc69948f63079ee529fa416c34496b196cdc612eed246bacb8beb39779a3f30da4e7df1fb7027ddd61ac2a67fbcca85ac67ca6f753d767eb7cfc217
- SSDEEP 12288:LXZ1IyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWDN:DZuAnQ/tbw/2Mkjy6Fr7g0oDN
- TLSH T19155126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b0c44a43412ed182881ad14eed26a841e261bd4ec728004849da68fa68ff8002
- MD5 2cb1f7022718d25ff6a73277410de912
- SHA1 371ecfbcb49be4555f69404433ba30d84a139a03
- SHA512 b18c5188090bbcd5b894f92223061dd137b34dde0f276c070fe204ba37eceb6d0eaeb3a377ec4a013948ff5cd0bf6d2121b65c6db3a4eeec6be763b3d34e8de2
- SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:AQRQyi36YOcPQLvw2gAf+PN3QLm
- TLSH T1FD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a0e2677c57c12a98ad7d863326e11a873b47149bbc0d2b9593eb580bdb322c28
- MD5 49ac4dd2f90a5bc22c320fad169c9685
- SHA1 00b759a9a143706a5542837bfd4b70caa80bda0d
- SHA512 61f98a3662b86fecaf2172f6f7d0f23fb46b430a0ccb3bc23f89b5f41658d03c6f62c75f187d46dbee8a0502ad808aeedf52108ec9680b66c851c5abfa54c558
- SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:1QRQyi36YOcPQLvw2gAf+PN3QLm
- TLSH T141666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 38cd03844181b391f8f0a5791dfab1035c0476eb9458d9b54b78db98998c840c
- MD5 6373d912f738fb894013cca0df0b823b
- SHA1 792bb2c754365f178089a055f4bada7a042d01f6
- SHA512 4c69211bec5f1e6460d23ee4c68033efe8fc7ad1460972331bf5ea7105928864cebb37ac682db668a8dd299a1bc5a5a227d1f6b8dca42011b3331a8b714b98f1
- SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0QnQ/tbw/2Mkjy6D:R68Qg55nhheWu7PNU3/FQ/lFTjN4
- TLSH T192B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 55c3d2846bdf3e461d83c88fc87e5e44e9cf2e561f35bf7220398abafa5d5e6d
- MD5 b541a90cb3c7b033f91f0214b659d67f
- SHA1 f947a2cab815a710c6aa781cbbce0f5d38f4b917
- SHA512 269adbf448062f8af026422f54332216edbd8b581f442d73534083859b7230278e6264ed7bd6d40029bdba80be23b123fec75cf9517066e881385f16d0c68b51
- SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:7y5112gYy5azzVvL69nLKnhZvLm
- TLSH T108167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b15b76ea0918ee622c0a587272030d180889b71eb3bf833e1d392b70289bd38e
- MD5 69726ef62467718f3f6c8d0f33ca2b81
- SHA1 7d714c7671f10c4cca80ff480913bb0ee6ce124d
- SHA512 13bd61118236a6da3e0461bca0b64d0d6f477c1e39b9a6a86849a4b32654ec9c55640d0d4a89b21d956582a6077679b197f6e107b08d2eb68ef16fc8fb0dfa53
- SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTQ/lFTjN4:nu6JmVxd2d4Lm
- TLSH T1FAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 31a256cbac44834f968986f71dac2a2deedc7201faf41201c55f1a4bee71c9bd
- MD5 1b8f1ce7ca2d3930e9a6758ca075cbc6
- SHA1 12ecfcdf9c00e8c9eb5026eff03e08f580a14306
- SHA512 eeecb66c7477c77814a571f95bbd38bc48a62c21a9fea265c56a8260b5d040c63266d15ee01015f0860669a0311ab2d121d168e3aa0157812d4782664a0b3df5
- SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4xvQ/lFTjN4:UmifPbRtLm
- TLSH T1D5B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 d7494a3ec555578c79d3f73361cace441dd8f2ebd66b7285cfd794068b41c30a
- MD5 1e256041ad5463d2a8250d6459c7700c
- SHA1 59e30933c32673b7254734b0420cd1068ab0e597
- SHA512 7be0ce57b2e97c48d6403f46bd27b00da024ddd3f0820304584a483502c29b29f12678f8a03ce3c043b157184f777c6517cfed18ff54651dadaa79dc6adc9666
- SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqAQ/lFTjN4:d5dKTi61TLm
- TLSH T1A2C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 e14000f7fcb2055344a3429e5961e19442eab9e80a9b84ff83bc3a1b412b5f31
- MD5 a59b2e8699292f0099cfca21dac9c0c8
- SHA1 b465f8380438d5fc7514114d0d3e0d6f1b01ea9b
- SHA512 1209327b714f5ed9863715a7cebb02263ae876a0585dfd236eba56ebb815c82891382921c664750316ef6f730e5bfb140c59eb191cb69f81a12c5d90363db67a
- SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wDQ/lFTjN4:LX2iyphJLm
- TLSH T1AB95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 79844aab91a3e883ef59bbb359059ee5beb6d4b6aa3c080c755830cfea4dff77
- MD5 129c45394e8a6d6bb7954e2294310406
- SHA1 49d494f55c3aa0aa20639c1b3a5f6f9de0f53e99
- SHA512 baca963aa52e9b33b2f8fcbb21832234f7fd5bd97228d543d2e95ad13236548eef86babde3a301078bc557b322f780dbc518b8a2f5319fa724b9548bbc5498eb
- SSDEEP 12288:6EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:6knQ/tbw/2Mkjy6Fr7g0oQ
- TLSH T1A45523697965F98BFB1706F14C828182973F0EC6BFD1938F77482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 2e9566fd54043dfa5fdfd99b8d7003a83b3bccb0f1c789dbdabd7b266856114a
- MD5 a99a96ad7770ad3556ec1606a094a12f
- SHA1 73aea92b092a56df798e6948386ec84f7340c5cc
- SHA512 e0ddf20352a205a714e870084b702bb2cbd238ebf93bc52729b25d62f4ebafb6c21bd5a29680b4cb031b6a9c3b7ba1e24cf986c52be49d7d746769dc42858685
- SSDEEP 12288:m5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:mJnQ/tbw/2Mkjy6Fr7g0op
- TLSH T1EC5523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 e238eed676094c6cd503a7f72bf37b7fe0f0f7c49903b82a50502bd554586048
- MD5 4adc7e75d62c396b397f341db868a7ae
- SHA1 2eed3f6baa61be025ea7224c07855fb2bb3e90cc
- SHA512 893c9743c7e744cc072495b13f85a7339d5d606e830a697510d1fe1494456e74ff9132d45251beb65167976c90839aeab091f424ea417fa6372d0835548fef9e
- SSDEEP 12288:pnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:pHnQ/tbw/2Mkjy6Fr7g0op
- TLSH T1975523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 70ffcad03bf23f4b30d92a2bc88751e981fdb606eb2fc660d4da5151e6ae5ce4
- MD5 be3563e5a497a502a9df17812299c529
- SHA1 db75f44f74711e625637bf5bfdca547740bd5eda
- SHA512 0daab8e0d747abdfe2b26fbbc873d0c819a6f9418b1449df063ff2c5e050fa6a5ed58da88caf55fc82d502a6be8ab71f6a1c02e73fd95447672bb26f0df8e948
- SSDEEP 12288:AViGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:/nQ/tbw/2Mkjy6Fr7g0o/
- TLSH T1725523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 0243b688d2e1941fac372651e64dea4ab2780b816907492a9ac3128322c068a4
- MD5 4ea1160e6d35a83445c8b0b02ec3a5c4
- SHA1 ea8d1f7cbcff1f6f05df7a725546321c8215dbaf
- SHA512 86e42f8869d012d0b9351183e1704970c062cee3236605cf2632aee5c960c540d5df8c5513112a1dcea08479124b19d6125034200eaad439b02da457494121e4
- SSDEEP 12288:IqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:IqnQ/tbw/2Mkjy6Fr7g0o4
- TLSH T10F5523697965F98BFA1706F14C838182973F0EC6BFD1A38F7B482128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 761fd6040c34ab3c35b76be2e723829f421ac030be3072656ba6613d1ec7fba0
- MD5 f75cdf3763467af382633316563df639
- SHA1 36002db5ba85d95b3fac3f7137ee900fcffdb9b7
- SHA512 f7c4ef272b551d8a5dae87d2c32361291d221a049a47bd03c06c82693d1fcc9d7756108ebc43c04a51918acc2c865225c91cb80ec241f1599c9dca69043f17d6
- SSDEEP 12288:WNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:WtnQ/tbw/2Mkjy6Fr7g0o4
- TLSH T1515523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 826b7630936d1875aa73628ba9ef1b1f4ceef6693ceecbbaf657c3ce00cf61f8
- MD5 41ece846f2b6e0bf3298328bccaa0f21
- SHA1 793e59008250d18017c3a85ae4b3a183520ffcc9
- SHA512 a55ab1c60365a90fc457725982012ab6599a6160d966c2f115a007fe5f5cb7f35d5ccc383cfa6eb94f647f06ae69962e09da9621219dcd70f89aedc845edf168
- SSDEEP 12288:UhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:UxnQ/tbw/2Mkjy6Fr7g0oP
- TLSH T1735523797965F98BFA2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 ba8e4bdc783b023acaa686ceb3d95604ec18d231ab7d808fa115d6602f08461f
- MD5 d14e381d51243f371dced4b18676e8e2
- SHA1 1e7758a21d4c65700b3edd7a68ce237bbe935ddb
- SHA512 0721588e321b40daf204e709172b20c0bbbcde9a16d7e8b46a0c5d0b629848886d2f00d26fe1be490a9334440c0f1e8a65eab980bed22b32e3c022fe8cb2ddaa
- SSDEEP 12288:niZwbDzzFEoS2cPvyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:iZM3zFVSOpnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T1517501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 68b1a80718a0f9946a2e99114a9e8ae26e896cc9ffdd34b23cc4e80de94d9fdb
- MD5 efc09b09aae9754ef25131dd072f5f43
- SHA1 4447760229f5c78d5cc6d33be2a397176042ec1e
- SHA512 f0dae8ed0b67a211724e1fbfa445e97a7053c9de30297939a67a349e4c1e1c5c7f22ca0e8416b889837157727ea83f8ca94e1f55c1183487a5dc73f6b60d8be7
- SSDEEP 12288:3QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:3wnQ/tbw/2Mkjy6Fr7g0oU
- TLSH T1C05523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 8488386e8488c6649b338d7cc0b559462e58990b92e5f720978f8a5e76edd29f
- MD5 4e8b2a82126248f6dbb950c57d32a06c
- SHA1 dbfcabacf1bb768399ae29a4e1b3436e6d0106a2
- SHA512 57ab959275bd70513dca96d859951ba1d1e8e78b6858d4d4f7a1f19b4240b464f2fe5c0aa8fc56ba0af5e1e6e3534fc3a64c06de5caa5015cafc3d4f75673e8f
- SSDEEP 12288:o8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:o8nQ/tbw/2Mkjy6Fr7g0oU
- TLSH T1095523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 872a97c7dcd2509232d828ed29235210a08b798a1653b5596f4489e133ade383
- MD5 2d581ac18d5a4114da859989c7269693
- SHA1 a55d55edd5048c214155f6bdebdca6d539c2eaea
- SHA512 1c7e1a68d141db6a418b8ba84c4920eef38f7fc8efe51809bc45384047267c25597dab763bee63476739a7d06965b4919985c8802dde0665d7023567311e1b5f
- SSDEEP 12288:iyPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:/zylnQ/tbw/2Mkjy6Fr7g0oO
- TLSH T1EA65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 bf55c0978c6f7c91fb025f1abef0b35c90f6297f6043b73c87ce2c067a05e95a
- MD5 7a39afce4fefcee3b17dc34413b1bffb
- SHA1 2b478b4825f7918fd31bf871e812a4b4082966a5
- SHA512 7ec0dc16f1464a915333c72d3fee9da517ebc1d51c87b640e82bdb8311a6505ee080305cd98e31a68fb295f4203e25b2ed7c8a3abfbb4bf46d9c70167feb298f
- SSDEEP 12288:2QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:2wnQ/tbw/2Mkjy6Fr7g0ot
- TLSH T1705523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 4031d39766d50c3b15fd1138f0d3d31e1f15680f6b95f24a8b121233717b415a
- MD5 2989f98909f8d8f0fb12fd6a76499170
- SHA1 00b200102e183f4a5ded6d6cd1daf484fffc688b
- SHA512 ccab196350409e8ca4df11a5c1e79233b1b3a41359bb3db912d5f4700d4baaae83bc5a7e4367b1f41836143845f9fe4c56f32486e8a0387a2f378cfcccb04f62
- SSDEEP 12288:eQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:ewnQ/tbw/2Mkjy6Fr7g0ot
- TLSH T1E15523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 06686028b81f253c3e8d823968324200839081326979ac36caece50cd681a987
- MD5 37f00f1ef25a5eda02392a7a62ed40f9
- SHA1 d776159b1b22cd51c42d0e7abcc12578a97288f8
- SHA512 535dca4873353455bff1fb08db74a73715a2c892f2d3c1d7e46f35a1128ff97c8ed2542fa4e38800e9c3a634c54629c53b5f10bdf544b9130b7e0634b2bcde78
- SSDEEP 24576:FcP4mcvIjkGOxhKP2l71nNKbrh/8KBYnQ/tbw/2Mkjy6Fr7g0oV:KP4m4IpOO67W8KGQ/lFTjN4
- TLSH T1BC65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 e9db98f8411b5bd832af9e329e8161269fe978c0a7849ef69a1bd6e9d4914073
- MD5 7e819e4939db7c505bb91ec82e777af7
- SHA1 8b16041d1d32bb79dae40f4e536eed0c36a96de2
- SHA512 f0e7498a2628325ea11d7f7f9394b3291c50445fdcdda09dfad621bceab3ef7603701adefd6e2b754c4ad13b383c19186488121c61f4d39374873e5998fc1834
- SSDEEP 12288:DssfgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:vAnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T18A65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\af0bcf943a3ba122.bin
- Size 12KB
- SHA256 0b3276fa829decaf3c2180df924240a3795cc1ad559ebdf39bbe58e6d60f2a4a
- MD5 ed123dd9de44c1ffe1412ba41c7f221b
- SHA1 35a44003b7e19795799f55df697a4c095b471fa6
- SHA512 2877646021db5eea23a3cbb2eb5382f8ff44f2707fc20f869fd58c35f22cf89b796705d3a1e0f30b1931417e290cd273bf25d252561a7fbfa18f3a4ecd9633cc
- SSDEEP 192:y9CMqNagJdE/OzWRVC4qqWlkhQY30VEPsLpcyfbddT1/GaS8uaXzIMhzT:y9YTJdeOYCBzY3QLpcwbz1U8ZzTN
- TLSH T1E542D032FAD00F3B342D49485A085D8B2F29055E2863DD2AA0419F40DEDDABD84FA1DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 5e8eb744823841c6ef3fd808df45c0d7c3f5f1ff3a51a1d9c730f69929213140
- MD5 636ff4483a8a9ed0b718256451312651
- SHA1 fb640d739fa614ec833358177fd596ed8a9e44b8
- SHA512 cfc542d8fadca5efbfe88300e36f7297d6d26754aa156d11e5f5f91a8f960272af5fa881e7afc274908768ae7fadf20158480567c04df6b621c79415b880d428
- SSDEEP 12288:SAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:SgnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1BE5523396668F94BFA3B06B05882C151673F0EC5BF91D38FBB08222D967C3D40EA6745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 6b06c3c22e74a03f72c61f8f8a7b8cc65e025c277afeb6278926663f059856c7
- MD5 0598faa8ae4d57a2f02af03c7d888d9c
- SHA1 7bc00eba33d11666d2c05ad96c190ab3bbea8b8b
- SHA512 400352da421e764a9cc10e32cbf78225ad7396c7786cf6efc0a9220fc2cf823697d8c60f1e1f549d10beb250e820868ceb8bcfdfa9e71a628f2f6b972763e914
- SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQqQ/lFTjN4:da0hNYG4JwyLm
- TLSH T1DD859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 ab87bf8f12f2fb4855a09573b01655d5ff60eb54c31a366a778ccf5c93542c47
- MD5 88416625fe5f49e78d7ae08d75a8443a
- SHA1 e8bc2bc3c04023053148f99808a34cf2143bb6b3
- SHA512 0e3f449f5cb3fc7d2ba1b67f55b7b41be3924521a63c034d41d50cff00d4022842caf45cb6d4ae7af046c9d43e249a50058137b84c2f4d2d40976e456eb28fea
- SSDEEP 12288:yhbHjfXJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:yhbHjPZnQ/tbw/2Mkjy6Fr7g0oo
- TLSH T19055027D26AC20DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D79F81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 4351887e3b0c5b68731ecddc87b149a4798ef7a3b12e54d0ca73ae7f2d0ceb56
- MD5 c78ffe30efc07e8a33e37ac8f12a0160
- SHA1 421d68c3117b053e4e35b3285fc2f5ceff6c1697
- SHA512 d9882d35a8fe1da76112aa6c3521c19a0b1ac8fbd092db2650f829a0ad14f37b65ee72992295f6d347d0a3e7a613d8e6c5569ca3a28e85ce228af1279229b470
- SSDEEP 24576:s3YgnJcRTk4yti+R5dBR/hnQ/tbw/2Mkjy6Fr7g0ou:sIgnaTk46pBR/hQ/lFTjN4
- TLSH T1F645BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 4483c51661b3c1b06e8b7e96f3b1c2ea394aff290ae7457f32a7019c94943ed8
- MD5 e479d7b1ce4596911322d08e0c02ca17
- SHA1 9823635afdddeaaff7671c4ab369b86ffe86911d
- SHA512 1bc23b37b3e67def30a5bfab8bbe0fcc35895cbb21d9b57eaaab732cb8dded43dbdbd4de273e263c16ed419aa8813653228f2b1b3aa9307082f277c392fbe77c
- SSDEEP 12288:VsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:VsnQ/tbw/2Mkjy6Fr7g0oL
- TLSH T1835523697614F98BFA2706F54C838146673B0EC17F92A3CF7B482229967D3D41AF6780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 0e095df314b6c30af503dc9df159b89cc2cd8202412ba059192d9e704213fe58
- MD5 4b94f8e0aeb0dceb5e23ec5040bb6880
- SHA1 00f09d9cbf556190f75b7a236f8e6e9735360895
- SHA512 ea33e3892b3ea6736a959ec193cf8d20ba283db9e8835b6a3d56499461d1bab6b637a7bc92dffdba6bf830841ac5d901f108dac7de6052bf8784ba11df1bfe6d
- SSDEEP 12288:6Ob4A4LWOsvAYFTTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:rwL3UTDnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T16D75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 a543f310a0a5692ad56247b245aab6a35fc35bb9169f98df6d1cbace7b982ea1
- MD5 2f2aa3c8cc622a2a125dddcc5f6e6603
- SHA1 27b4aae1a703f0c378588bf34f196f28e378ba37
- SHA512 d16a294b318675c2d12d21c5321e153636f53d6b359ee47e697bf55dd8efdd9d7c4f71e1fed5e160e406456bf1efcf13e29bcf1b9fc22df08ca45ad8619ce407
- SSDEEP 12288:YpFtCOPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:BOvnQ/tbw/2Mkjy6Fr7g0oi
- TLSH T15E55022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a0031b7ffef9fe48c658dafae20866e459427bfc26e03a900081570dc4c890a5
- MD5 1db33f993b4a09ec3a4444232a89c89f
- SHA1 3835518cf1571b1ca8fdecaa3454d9f437b46701
- SHA512 3d77bde6c8e5f6659f95c93b3538cbdd5d8692eb2014da8243b5f3dc3d6e8971e53025fb463c8fdff63174fdba656fb3ac17f4cdde386ab98d2da6d039658bbe
- SSDEEP 24576:Y7NM9YqZqmWMUkPjZM48Mv6bEhswnQ/tbw/2Mkjy6Fr7g0ow:Y7cBWMpPjN8DbEh5Q/lFTjN4
- TLSH T1AD659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 b5b47c2f28a13990876907810043c2a6aff79a6fe0d62d491ae4263f448619cf
- MD5 48f2f0c49118576fe114644385ddfe22
- SHA1 59db78210e721bb8c1d3596c00074199ed18c311
- SHA512 6ae71ee3f3cfc197179c9f4bb64dc5d583454088c5ba36f86a670411ccd192632ac6fca8a9e9fcecae7e3eda9c861d5f54475337519219ec901d538afe32820a
- SSDEEP 24576:+W6BApg2YuyuNDYTabvcdvNYf8km1+nQ/tbw/2Mkjy6Fr7g0op:+F2YuHNETovAvNYf8kmQQ/lFTjN4
- TLSH T1B4857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 2646e7c754f6170a99e078444aaa294f2d56a00b0abfc5cf0bc1fc9ca4cba34b
- MD5 afc550894ca43f0618e62797b0e549df
- SHA1 dcc8210b8db3185343f7d4898d4cda669bc3d03b
- SHA512 7ea9adc06440cf0591f736c94b780905c2fc81eaebe03fdb18d1145944284c7ab8f396df417928e53524ea9ae0127f269a2903ca80a1bece330cdc9ab6c2c076
- SSDEEP 24576:eAFs06+Omlf3NXEbTo7nQ/tbw/2Mkjy6Fr7g0o8:XFs060lVXuKQ/lFTjN4
- TLSH T1E465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 ac03016437e6d75f3efb05c4325bfb7ed195a0aa460c0e8ebd9967b02cbab430
- MD5 da69ee513647fc9e460890699a4e70ee
- SHA1 2fe28b516dee6ea2739a5f0e6cb254224f8113c2
- SHA512 791ed6e9d98e62ae27f04fc65d8acf0a9caca86c230d7fd349345ef9f9c0d30cae981b96cdd822cfdc71e88e4d6c72e488d53bf2db7b04b5fb99a2f270ad2c03
- SSDEEP 12288:XCJnJ5D3VkrqzxwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:yJnJ5D3WaKnQ/tbw/2Mkjy6Fr7g0oB
- TLSH T11A75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e3e8bafca4f1514303e26b330ca0d20e1a2b3d4bae05db24c4de2895125de238
- MD5 4a971d4cbc9b61e9b1da5dbc8a637ed9
- SHA1 1eb174fe017c580325ffd0c13c56beb5a346b443
- SHA512 0436b27eca4220c76a6492ebc2e6bb93be06ec557c3c862c57157a3b16f27b89a990fa0d8af99a4499f47ccc4973cf0aac8b8cc33a427c81f236a7ef99884624
- SSDEEP 24576:1EPghm6/7IIXdwcXrif7qQncjlP65i3VuhnQ/tbw/2Mkjy6Fr7g0oe:ig06DIKdwc+eQnSt65aVkQ/lFTjN4
- TLSH T184955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 41a6871f086a42125460a7b5f7fd238ccf1269700f4cf92f60dff0988903e88a
- MD5 b1af748482408d7e0bef019ea10a7692
- SHA1 e6212a37e7b00a680400f5befdd65c2a2874a590
- SHA512 2aaaac22047ef8700496d7d3434dd524db063dd8e4898eb5204d5c0da2710664ceb0f4eed96c15f552f49b4f44405697f8cef3cb8ec759ec8fb2bde217bc3aef
- SSDEEP 12288:9EP3RS5+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:eSUnQ/tbw/2Mkjy6Fr7g0oH
- TLSH T18E55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 b5b22dd208eac385978b2c04aaf395103eb47d8562761bbae8825b08a8f157b9
- MD5 250cd86082cb9139b856c02dc01dffa5
- SHA1 0cb400eb451485b13b86ff4d43b8e66bc877ee15
- SHA512 f877b92437dfb07d6869aaeac1baee48cc8a903675c30e050b1b25288da014e4c3e2d99b1cddbcaef22d92159b9bae752ff55f213ff001a418fb20e2e25b7028
- SSDEEP 12288:Rjky5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:RIyJnQ/tbw/2Mkjy6Fr7g0o7
- TLSH T1CA6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 dea219066b015624a9ba4d000b852a87f48d5c613f4b56cb1e92ddcbabd072f1
- MD5 013c2f64c3fad6abb134ea4c3a9e460f
- SHA1 05019819360a49acc6c699e39a86a44ca296aa2b
- SHA512 c780601f4d123d7163ee6d3da0caf82ae614a35e54e25ce645c78e8ff3dc9efe3e55f21b457ee62d12450dd830391380b6a13d00f289514de6ae4777ddb24c6c
- SSDEEP 12288:h0/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:OfnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T18B55236C2625F89BFE2706F448928542973B09C17F9167EF3684A239CB7D3D416B6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 289656791ab6d8c0b3abc428985c14908a776f1ef8182080477b7e64a5fe704a
- MD5 eb9622e5bbd6387a3fc7e84ff4fb9d7c
- SHA1 d5824af0c7e236e594e40edfec4a69813fecfa3e
- SHA512 f395d0a1e08078e709f59f830805ce1a79bd6072ac13d7b24b06855c906f30a19cb903c2955f2d0f14316044cfdf4fdfc9ede420551bde8a66ef14f8f95dc9d1
- SSDEEP 24576:QQ9MxZKdcz9dw3onQ/tbw/2Mkjy6Fr7g0o9:QVKZoQ/lFTjN4
- TLSH T1B2558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 64efdc3a2abd401af7ebb612826ebb926a0850aad586d46eaf5d0503cdada945
- MD5 0cbb10db602b42169c83e3cd31d6f1ab
- SHA1 d76f67a227ac03bc573a236e11d90eec3f8aaed4
- SHA512 b2a3d3c076c518e8bae32a7f7c46b1ce0358590d1d37a9e2f218f23d27846e45445783b1d961b5c59b8e0430fd25910a0bd6ad68009b39953bdc07e6cb415e13
- SSDEEP 12288:ayoKo20Rple9pVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:ayocSAp1nQ/tbw/2Mkjy6Fr7g0oi
- TLSH T1DD65E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 daf174d0b67d2b19e68b98866649bcf38f691fa572ab79470c929ef1ae403523
- MD5 a9ad68f86edb4c494641321cf3c46f06
- SHA1 9437b58e47e18f50357ade5d1a6f14e024cffcc5
- SHA512 72a31c6cedb74ae80ea0078d136bd0ef960e1fb7baef83bb33bcb13261bca663c581261df4e8998cb2edc3ff52773a01ffdcecfdfe4298627ea62cd3e065bba2
- SSDEEP 49152:uWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK1Q/lFTjN4:I0zuNIoLm
- TLSH T1D0A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 a9931f92c1d3942ab5cc36d5d224cbe159875c001ecc69f5700cf83a4a88a68d
- MD5 aba0117118d5316c1d76ed790588b1ab
- SHA1 5c9946c1b047e67931cd15b929c7967df64aa7f3
- SHA512 1a82477b0e1cc3f1ff0b9fe7662f94682ddd651e9acb8fa9cd952b479679d759cf60909305d7165d3387b64bbeffbf1103a3818004a0da6d07dfaa30ded8ac0c
- SSDEEP 24576:01QT7EcpfxR+N5AWAz3ooiYtjMqb2nQ/tbw/2Mkjy6Fr7g0oC:JTDxR+N5YzTfjMPQ/lFTjN4
- TLSH T1C755BF2EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 9a2e17f30f88aeb459d471c6e3bd49cc325fba9fefedf7dea0d442124812fc8f
- MD5 3efe10a48574cc48e7f4c1d54bf90565
- SHA1 c5e02b21105f0cdd24a91996be597ac52168b43f
- SHA512 ca70cfc4dd0922226945a7290cd9aff2f4d309f99771aa950adf543f2fbbc2c2882b57625e27c3db7e9dc4d6c5ccc37db5326359aadf141bab98ad88a16056f9
- SSDEEP 24576:0TMdOz0FFS+1mSLinQ/tbw/2Mkjy6Fr7g0oXN:80K+1mSLiQ/lFTjN4
- TLSH T1E675E17E636D14E5E53BC27D9A438906E67334620322A7DB0690C1792F6BFE4397EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 9a9d417d93502671d055ac32a8a92abba88a3deb93511ec5fa74c78abff6da13
- MD5 2652960453c0af8ad363b03cf91df8de
- SHA1 dd563c67378a77c50455ababf634b23cc057f063
- SHA512 722fd62f540185a48c179f9fabd773be558eb6a31000a03d2a5289960d18c8a6967f52fb48e2ea67b270a5fa6cc118b0ce394d320e230e8519391f502a7ed6fc
- SSDEEP 12288:24TTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:VDnQ/tbw/2Mkjy6Fr7g0o2
- TLSH T17055122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
- MD5 SHA1 SHA512 SSDEEP TLSH