7aff5a77fd6222e23226e794c999bd924690409fd64b9b6975b4b370db08bebc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Size 3.7MB
Sample260910-betp6avyct
SHA256 7aff5a77fd6222e23226e794c999bd924690409fd64b9b6975b4b370db08bebc
MD5 02b42cf2596f6b72fa10c70c237482b8
SHA1 69db84707f72667870894deec228777e2ac14d2f
SHA512 769de78526b91a02397790c895d4ebc007b6c4cd47a1691f8cb6e2736d62aa4ba5da3df7afdf600e0be6cdaf06196f526356bdfd064ade528c59fdb2dbf30016
SSDEEP 49152:zm9e4BcaaKT9qKFpFclC5Vh0Klth1u0MHzFHQ5QSgl3iOfJ4klKXnX:zmcGl5al3pfJ4k
TLSH
T1FF069C52B36948DDC6A6D23CFC23BE06DAB33A855366A7E7029E16531F636D10E3C740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2892	alg.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4424	fxssvc.exe
892	elevation_service.exe
3564	elevation_service.exe
4772	maintenanceservice.exe
4368	msdtc.exe
2512	OSE.EXE
4612	PerceptionSimulationService.exe
4244	perfhost.exe
812	locator.exe
4200	SensorDataService.exe
2660	snmptrap.exe
3832	spectrum.exe
4440	ssh-agent.exe
3256	TieringEngineService.exe
3608	AgentService.exe
1808	vds.exe
4924	vssvc.exe
1052	wbengine.exe
4592	WmiApSrv.exe
3288	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a5b2b9832d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d321249c040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7fc5f4ac040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df591949c040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b50f249c040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c48e748c040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c4ac848c040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4704	DiagnosticsHub.StandardCollector.Service.exe
4704	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeAuditPrivilege	4424	fxssvc.exe
Token: SeRestorePrivilege	3256	TieringEngineService.exe
Token: SeManageVolumePrivilege	3256	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3608	AgentService.exe
Token: SeBackupPrivilege	4924	vssvc.exe
Token: SeRestorePrivilege	4924	vssvc.exe
Token: SeAuditPrivilege	4924	vssvc.exe
Token: SeBackupPrivilege	1052	wbengine.exe
Token: SeRestorePrivilege	1052	wbengine.exe
Token: SeSecurityPrivilege	1052	wbengine.exe
Token: 33	3288	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3288	SearchIndexer.exe
Token: SeDebugPrivilege	3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	4704	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3396	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2404	3288	SearchIndexer.exe	111
PID 3288 wrote to memory of 2552	3288	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2892

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1820

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3564

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4244

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:812

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4200

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:612

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2404
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 358074ba8b5fbe928213a243345f2171bc2f97a32ca8bb9c9ff258f9428a05e3
MD5 d36db8b1931617aa4e32902435467a60
SHA1 e3430011219c96899c0088aa2ec3766317e13cc1
SHA512 e486fd4df51d2288c5b48a4bd965405a1cba77028750367a83b0e968b2b50b1c14bc29d64452c87bddb15ec15374d6795a8490bbd37e48f337603719c9eb72a1
SSDEEP 49152:8b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnOfJ4klKXn8:m3q60jBNfJ4k
TLSH
T107D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b4373e152936a0ff0b385097d602a61e9cfc58b99b907b22ab68e70eeaad09d3
MD5 006626702fa7e3fdcbd5b6ad2590aa23
SHA1 d0660e496cbe95df6d1f33137527f314a5fd9e88
SHA512 ac981d603493ddd715ef4d750538bc9c69c672cdce08dfa2bba24a8de6df2b73a763951ccfba57f86aa6b2094ea493d87bbffa3de4ac8466c47ebf899e880083
SSDEEP 12288:i1XLsswWkxy2lRq2czAZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:oXYfDtczAZfJ4yL/tNCJPXUQrPz
TLSH
T15B65F12973E408F9ED67827CC9A1C101E732BC954764E3DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0f65de42ab3c5ac369763f97b19cd9d11d70a6d602f1fbe8f1700b6d2598d108
MD5 5ccda65edb5c7ac9ccfcd876e4fc3267
SHA1 68b705fe13149bdaa4b93bb293811c4df648a8ed
SHA512 6d6f00ab9bc8d16672e8fce6ba793be65adb386660971af5fbb7503d700c8b59e36c6d2a9da8d93db47aec6732b13b1778e51e7e423067e9fc8dfe76c61acf3f
SSDEEP 24576:/0Le5ji0hmxNrM2fJ4yL/tNCJPXUQrPy:/Pji0A7ffJ4klKXna
TLSH
T16A85AE66F5748335D073C0B9C5D2A68AEA71308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e3e618c181756b3055c59a7f001834245c6352d46b4bb3165fd7fe65ac892fd1
MD5 b360740d1be160e0bd6ba57d54758796
SHA1 d086f1bc4627d4d24b02de1caf6fcfc20f1ce480
SHA512 733103b5c9ddd66c523eba3079074cf7babf7039d897b2c0b812964d206dad292db160264822a696fae15f97d5beb01df41a05a70110771a94484788d12ec9c8
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWr6q8wyuYfJ4yL/tNCJPXUQrPb:+/ezSC6vUzPviHjyLfJ4klKXnz
TLSH
T11F756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 263a72485d29c68cf91c16edcc6717a7043bd39ac4afa70794a43f448e928ed7
MD5 49918cbda55d8208d88decb7627d5fd7
SHA1 e06519d8da16a4deff34b5cad6b4936fcbdf7deb
SHA512 55b0840014cda754dcf60b276840ddf1bb698aeb7ad3639fc423e53fd44f6770f9f51f5f79ee3451422412c783b8bac3c2b28d79015ed1c9b0ea2f1938e42a98
SSDEEP 24576:DVbqPb88hv/l+b9fJ4yL/tNCJPXUQrPQ:DVO88hXl+RfJ4klKXnY
TLSH
T117559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bf12da3d7c037a15104979b205e5d670258335116cbf0490b664bd5f039c8260
MD5 4c89fed0a742091a43d2ec13bb286721
SHA1 1f1fc6f8de8926043b50fcd19b2221532c7d52f3
SHA512 79d2700262e834a11ec5ce593443885eb7ff74289d1df4dbc924046fffade5ea17e7a554521a61dc3136e4d1a7688bb55d7504e801e6948dd6288b4b31b4de37
SSDEEP 12288:ojqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:ojqfJ4yL/tNCJPXUQrPn
TLSH
T12B4523EB51D49085DF6A87F82A8CF001C704BEC5562FA2E6CE43B8867FFC91A559C352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 208c5c43a2c72a625843523ea56e8f44faaaa8f882ad2ef6cc27f7f758eb1fd6
MD5 85215442f8709d1894410a3c6636605f
SHA1 bc01cd04d1f4a7691c69715be12c9f018e2bdefb
SHA512 a0661abcb4f5199a5e224b44bc2bf99c9f726e81731195e152bc64b07c64b3078b37f602efac398e07b010b67190301d433de81f17d2a58cc3125e0665166c17
SSDEEP 12288:NeBNUbTVO86UlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:NJIUlfJ4yL/tNCJPXUQrPu
TLSH
T1A365CF7BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a39ed5fbe126d419ac3575ac6f26b88e05e9fc533b4553e90f3eb22279c0d644
MD5 ce8d3b567f90f9a5fa09f92ee82c9c5b
SHA1 4d38b9dce09698a747a69b14adccc8e148ca9926
SHA512 41b37b8abbdb1a648793069b794d91305febe6553c810eba6aa29c7ff68a6618953f3b251b6ac8349632d31caaee4d600d3fbfb63b6c22bf96007040c1a56614
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH:rQvGAdlCEL8c/RRNw5CIfJ4k
TLSH
T12F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 aa4b1ea9c0415192f5d1dd550ed952fceaf3a3a442f8cd21c14631ffc88713e7
MD5 304657928e0f047253e1d00a7c1f6713
SHA1 effdbfaf41c46f8b847d987181a423b65c39ea80
SHA512 12fb2266950ef921917fb69e07534f9a791b70f5d06754c26652d38f935d68ebf5fa6bfe27f7160c29e0834d91b04b5989ddba91e0e4fe22156c76d2ff897a40
SSDEEP 12288:nAwSfxL/2Dc3DDLLmt0LDQewsAjPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW6:ASewsAjPfJ4yL/tNCJPXUQrPw
TLSH
T1B375E031FA74E036C77F0DB51B25D306542CBA604B621AC3E3E89D9E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 820f641bfd1e2e75d9e03fbcd20f597171b54b6f3c27d8158f3be9754a9bfa74
MD5 17c3b9cb9442cacb8bd56a3dd0366e54
SHA1 90f569fc3b3f68fd1f2f9fa4dcd3135893c190c3
SHA512 68096963de1e29f5accbcb6dd546fdbe6e5e8cb62a807369c3707ac274c4469801f7f4c9f811130158e39a94e8f5dedeb0a2a0338b25fd929fe3298a146fe840
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHnfJ4:uUEtQevvqc2W1cpV2RI32n
TLSH
T11D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6e1e7cdc2584e491a2179b654ca9c2d0cd3cd549d1fb839bc6331e8ec8be9366
MD5 565e0226824a48038646915a72c08e38
SHA1 c557ced89b4b39f1b21a88bd9aa1594ec67cd568
SHA512 fdfdd16fe54ac7e5859016de0a6c77e881be58e8780eba0a9225f399ac36af6d1834a627e76bc0606dc9fb7b02fd75737d16d308d528797a23cdd7b80e3e109b
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zvfJ4klKXnc:zoq2VjnmEfJ4k
TLSH
T1E4D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 82fa2e88405d4af6e97634f76b0ba0500f3cb610fd9b910df81099ddb930f816
MD5 4eb415fed474d6a4533486f9163e9fe5
SHA1 b5d750b9159210688c9b39e9b19880d7a57e2821
SHA512 ad22d1b82073174d126b28a98fa93106125537741a62ecb98c4fc29deea9d42bebb15e98bb2daac93302e3c92e1ee46c65dc9afaaa11f3c56a742a560b0fd5f7
SSDEEP 24576:nAhGL2IFoiwtA5l7S53kfJ4yL/tNCJPXUQrPB:nAM1Foiq50fJ4klKXn5
TLSH
T161359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1439845c2a4d2684464fb34e63e04ec165b759f4d7358a73e202e9a551a4ec11
MD5 0ed5488256e2b4d0600f89c0c1697059
SHA1 e85aceebe3c0847b35da5b4c0cc65aadff20acef
SHA512 7fd0fb478a8e35619f46eb4c5770ada883e5c1c0894a19bb870dc9f8d882a2314100ff46a562a6253338d441d77200e85abe02654ca34b77e4ba42bc0a25f78c
SSDEEP 12288:Nmw5HEjsChNSBFgl0WDm+C4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTx:owuXOWrfJ4yL/tNCJPXUQrPF
TLSH
T16D65F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 a307af15bdf39e1cabd7109d9479c1ffec0929b632afeed07e6a727096818be8
MD5 d32ca98f9d3748a989c4737eed99eb64
SHA1 e235dbeace26f9b7ed9fbf51955713bfb5be50a0
SHA512 efb65b4c15fedeb5980ed80d249ddefddfe761480415155c2e6cc1bfec504f0fb46e6a834c16c79e07dc605e87c3e2701c5781c0278565f884941a0f20b1894a
SSDEEP 12288:t/Z1Iy/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:VZu+fJ4yL/tNCJPXUQrPO
TLSH
T1F855129A22D460F9DAA782BC89D4D101D3317CD2233A93CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 03718efe324fe1c2e9bf7ec47dc01aeae86b02eeb96ce602570346f874542713
MD5 48075a3582fa775565ab8390989934a5
SHA1 81563091bf25bba7ecfc34837561b514b3fe2e13
SHA512 37f8c98f1e222288886db30d4827d2a9d95037f095198b4b16f8cc84402aec14f3682ac5da2142ebadbc3d9163db87e0fbf7e1d383dff0e503030bfa0ba42d1f
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UT:7QRQyi36YOcPhLvw2gAf+PN3BfJ4k
TLSH
T1D7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 df419f9f05dd024a744d89d98afe4609b4e58ee601ad6a73020154136ae04f40
MD5 e40057893e121eb15491b4a0e3e231a7
SHA1 b3e1dee92ad6a93f242adcbaf6010b44b9a0dec2
SHA512 3dba9b2aeb7e8545ab9d807fe1f681c927a761acefca75a23c694ed178e4cd8938c845e6ea8bcdeb5f520f377870f73338323a9ca8f567fe181733f33a83172a
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U0:CQRQyi36YOcPhLvw2gAf+PN3BfJ4k
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c28834a08a4d5eb0e0f1bec43d703f651d71ffc7d3b844d698ad70126ed28d27
MD5 14678e66461ad385b9525588b5f93016
SHA1 0c70608b39254a8c4575e8a469b21e9a2d1bea72
SHA512 7b46483812b44b459396bd1be9607219636648e4cf90f870c54581399cee678c89f0ed9854d1992a56f57f82a961d27627d5d9e2e4e1dd7dab558f2d141b2d4f
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0OfJ4yL/tNCJPXUN:Q68Qg55nhceWu7PNU3/ffJ4klKXnk
TLSH
T128B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 543240f43b65a5ce9456eeceec1d18ba9341ff4c915f578eaafbb767d2d2a2da
MD5 ad64f866fff2228902e3f5676b0dc989
SHA1 ab76342dee6ba015878b0dbd09b4a0d5c6579fac
SHA512 916e78751fc62e1d7ac478743c3f83f0e3d419f2ebcf9a6ca77bd64b1428e3a68330a80a598d5edd262339462012d419ca61b32531ae5d7ca762e9c58241bc40
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99V:ly5112gYy5azzVva69nLKnhZqfJ4k
TLSH
T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d96789886af01740a3f4e55ad2dbd646e61b9ee14f1c1e77392b5acb23aab212
MD5 cf10a5a16283734aa1f5b4acb479045f
SHA1 b45d7e4bda1b4379b51ff1c824329c1c448459c5
SHA512 41de0551a287d884637241f4d054e0e57733be1e85e0710cd8fec104a1432d9290efadb7267048f71493ba9541cc763224dceb4fdebeffe59c09412fb94e034b
SSDEEP 49152:hB+taZ3usBWOBr4tEG20bqx0z+n217aau1glpfJ4klKXnN:3u6JmUxd2dpfJ4k
TLSH
T11AD59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7b508fe3c0b8ece90cc3526c7c0c48ddd9445f07bfab6ff540f3e0476a1f859f
MD5 5bffe81c1937a34c925562961c1cc331
SHA1 d7eabb337587b88f3fba58052c6321ec23234beb
SHA512 401f7409cc91242109b24090dc237ced6cd41daaabaefbde64629c7860a9a02c1305b46750e31297925b278d874660a80197cc33b73ff6749aa72f46b66962b4
SSDEEP 49152:61hpsNoJpF1A6BU44CwH7R4xFfJ4klKXnD:6mifPkREfJ4k
TLSH
T15DB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 de35d6c25b5388c85e1d8ee07f61ca9cf8bea6ddc91d3611140ba57b8542add9
MD5 db00ddaef23748a9cefa795677bc9650
SHA1 7c8af08a2cbaef667765507f77f1227b78496e58
SHA512 0d021a89a1529664bf1ff2c3b427f7081334863277155c1db8d4de6e25322dd7b87e24f3f7e30c8211c9af1d0520f93af596945c0b57c44d59d1963a744fc0df
SSDEEP 49152:mSuZQIY0Be2KNRVtOnks6NMHq+fJ4klKXnD:o5dKvi61+fJ4k
TLSH
T1D1C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 acd1bbd817c02103e7b14be23602803ead6c8bfa6c1cb68e4d47f8d328920d4b
MD5 43cca804af8973fbfe6997c2d53340f5
SHA1 c67cb06e47d00bee488a4ab2eb0ee489363abdc4
SHA512 a97ce3d565a3e1e9d60f2afa8880e830a3d55846c8e530527d3e6db783f6e0e605ad0f38ea18487897d06854b0daaac48db2426baec6f8c372e7d6bb6106f7bc
SSDEEP 49152:UhtSn8EApI0figXgiDn0AP5wZfJ4klKXns:1X2iyphAfJ4k
TLSH
T10295BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2c0d50ed4f8711439b274345759b45e14012266c1cc51f156a4cbe79bf732b4a
MD5 3818a43a8b746df2c11a322d3b73070a
SHA1 99491d9b798837b3682e7cc477c7b49a5c3a3513
SHA512 d10e0ac22365e03915532521e50d6d612091eae22e4599315af04aaff7ddfa53c7649d7cb0028569aba4964af42c93571af5ddd7e63dc16009b8716598ad947b
SSDEEP 12288:pSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:pSfJ4yL/tNCJPXUQrPc
TLSH
T1394523AB60D5948ADE1687F81688F001C7047EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f50660cf71b8532ecd8c9fd223dbbb64328642b2cc01d373111f37c541d8a72f
MD5 e7137dc88fd9ad6a6f022dc5059a8ad2
SHA1 f12e184b1e96c566bb3993f7e7c1574fde22ae4c
SHA512 4a0b68f4e0a4bcb97aa4bfdcae5a6e50f98e38fc6d859ec0232f8235fefda1779a048f3712e941bb48bc6ef82b28b22b4fad12ffdf75f3734482fbaa6dab48ac
SSDEEP 12288:4jfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:4jfJ4yL/tNCJPXUQrPc
TLSH
T1054523EB60D5948ADE1687F81648E001C704BEC6672F62F6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 360e4186f7a42cab205b9836e36685d65478f21bac09ad635be3476b2cd44627
MD5 d216b5ba8cd0b087856e867687b15d7b
SHA1 ba973c5ea331361a172d2ce318491f94aa8343f5
SHA512 9e20f37e3bfeff35ad312c17ab3d1f68aa31e1e2a29d100767a8dc1131bc3a01563df04fd8a7d5be22171075bfc91b9b9ba7335e52d3683586452fe06cd89716
SSDEEP 12288:pNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:pNfJ4yL/tNCJPXUQrPe
TLSH
T1854523EB60D5948ADE1687F81A48E001C7047EC6672F62F6EF83B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8917381b60df5ee4940934f808f38020232c028c61cffd551df31dbb5259a2eb
MD5 e09f662a36685c60a8a442abe5872509
SHA1 74e945c2064a6b193b63c98c077b7817f0c38d81
SHA512 0e0832a8a10b958075f177b35d4f6b6e43e1fe1384594fd129fee6cd770f250c9d729acc2612770a1ac83aba8c114428f56029b549f7862bbdc5a2c25fdbc362
SSDEEP 12288:7VEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:efJ4yL/tNCJPXUQrPW
TLSH
T1F345239B21D540C6DD66C3F84A44E001D324BDC6A73BA3EFDF4268863FF9659296C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 134f45caa61991cf7a82711a9543107d141201cc2b2da98659ab414fc3338e91
MD5 8b1c78b99c741e90f7b1a798c45a105f
SHA1 df1b2a7efdf3e6f4ac898de89e5bb62ecc0d674a
SHA512 548d03a68d47374e572f6a2b9c5737da295afd695f86f46d2bb854dd4eb910365eb2f294a857395a027455fca239b05aee2d92d3afe80bbb93f6df05b6789ccf
SSDEEP 12288:H8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:H8fJ4yL/tNCJPXUQrPl
TLSH
T17D4523EB60D5948ADE1687F81A48E001C7047EC6672F62F6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9d23dceb20b7ee5bc26859cbd87baf24d218bd10abe30b82ff3d12152fe96e1f
MD5 c3e20daacc257e88b6e3f214aa54a8e3
SHA1 8cb7fd7ef38f62b7a2609a6650790ac41afa76be
SHA512 f779ad1015e9e7289388e6a98036a09c6bb8c9ddec8de03823cb7a558b865c34396f0ff6bee16e170554b7a278e44b13c00e71f4e75fca74b766746c56e69f78
SSDEEP 12288:yXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:yXfJ4yL/tNCJPXUQrPl
TLSH
T17F4523EB60D5948ADE1687F81A88E001C7047EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 06014924f434a596a906873348188f7c4dc38635097612c0d04daf7bbef5270c
MD5 a8c27de574060f11a94c056d083216ac
SHA1 d70a76a161a5b03fd0c464611b80211ed4383bf0
SHA512 6145f0b0560399650fd9df11ab902a95810fecba125ba8b8c40a3c74b89ad9b85a56bf9f98952b57fd2b3669347136f3f85133e552f8f23c939896852fcb8f1b
SSDEEP 12288:87fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:87fJ4yL/tNCJPXUQrPB
TLSH
T1F64523AB60D5948ADE1687F81748E001C7047EC6672F62F6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5a2d091e2936429bf615e06776468c060ce51e7ee2af6c95ec501a7c404a7f7c
MD5 c9f521e82fb16bf89381fc2f87a0f6d9
SHA1 5caa88c837eb97a7291b155b7575add1ffc25dbe
SHA512 e432cee51025c3a0d3587b3b55666626a7f4910f74c6af835be3ed3b63ae1eb98c33de88bee79e0c3e0cc4ee8ffdfbca492ca2c79c914e064cf0438eb2695f30
SSDEEP 12288:qiZwbczzFEoS2cPvyDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:NZMMzFVSODfJ4yL/tNCJPXUQrPv
TLSH
T1706501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a4cd7e4edcd4b17a8b1dc9af7c6d21999c8e86bed7f6b7c3e741ed8fa74bf77b
MD5 362f24ae351478c00888a628aff45c38
SHA1 fbd3e508ec8e6844dac494906807de9616d89c41
SHA512 7cec29242c287e7ad5e6198bb821f257e5c6c093c51aff6a380c6380a8262a54157852fe5fb9e43491f3f5ea2ae9e7d08e25754ad7262983c09e2bc4f57a86d9
SSDEEP 12288:kufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:kufJ4yL/tNCJPXUQrPk
TLSH
T11F4523EB60D5948ADE1587F81748E001C7087EC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 54bdc6bca9af18d546c44c7e61d64737ae86818f3517fa4c2b35ec2e50f3e70e
MD5 9bfc009326046bd7b55cf02d9ba2ab55
SHA1 b2f0a6094b154f88861bfc70b2a624acb7822f84
SHA512 1e6ecc63738b8960a14740e2b606da9892e2f197da5420c6f4b31774bb6c63ce0fa691a91539a1148ba3cf4334784bffe68d9afdb99addba2f6d32e7e76533bd
SSDEEP 12288:0afJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:0afJ4yL/tNCJPXUQrPk
TLSH
T1884523EB60D5948ADE1587F81748E001C7047EC6672F62E6DF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2806c212a6bfef0b5c66de116e27562ada45907235b60cc47325bcdeb3f51632
MD5 744e5f8c7c1e1e253d0bab53275a8b65
SHA1 95da3a4fc87e4129f2aa660ebc71217d04edc235
SHA512 a43a9a783d40989147d0acb7c6a119b4bc15b01b10336181a7cbc2c896c6c01815bcd393fe3f2c1a1b0e2147b877eb7efa0936b3baad07250db13e277a600f89
SSDEEP 12288:ZyPz5L8/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:Yzy/fJ4yL/tNCJPXUQrPd
TLSH
T1B055125B32A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a36ef43f234d30be9df4e0ee0b030869dffef2c8475bca63a7e0fe642a3e4b3f
MD5 eca55947d9ea9d41ca23fe2879891920
SHA1 8162f1112a45fa8c871d7c731ede6c04bf1f6d69
SHA512 d7526c24be89077ddba60e3ec495e64fff3480d006da61ec86171bf2cc307efac7df201288f6c3c78bf4764fbba43eafed28c86ffadb4640574171abab7abcdd
SSDEEP 12288:oufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:oufJ4yL/tNCJPXUQrPb
TLSH
T19C4523EB60D5948ADE1587F81B48E001C7087EC6672F62E6EF43B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7fb4e0e693f57d1cf294e4dbf24475c26f6436b9355748ab6972b3bb39abba7c
MD5 4c797f320c2f7fb1f311e623fe4839e9
SHA1 c74f9d20fd0d4120dcd637b53f86a11c3b2562bd
SHA512 87f1379bf780b70c5da10a40a5fddc5621d7250a799cf2be97be52d79dad8cef03aec5c045e1568def3d80f09a5823a2fdb0fa690eb14874d7f94bb599796d26
SSDEEP 12288:YufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:YufJ4yL/tNCJPXUQrPb
TLSH
T1D04523EB60D5948ADE1587F81B48E001C708BEC6672F62E6EF43B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ec321fef2049219ddc882eb3e76ad42de7845da9ee9379b262597bbd7c1ea74a
MD5 7501eefe1dfad89721deaf1703c13298
SHA1 89f67abc11bec2effd9501435edd4f1cfe831d1b
SHA512 6ede80770182052344d3af4b18c4d0d944d96579b04ee41a90d082781c69e3dc3b436f500a79512957ba272dfcd373ef60912108e1a5e413fb3fbb97138633f8
SSDEEP 12288:ByPz5L8/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:Qzy/fJ4yL/tNCJPXUQrP8
TLSH
T10055125B32A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 dc3879e9d0a2e9f96949bdd386ca3ac32907e24f4363737e487881047320d500
MD5 cb2f8a839844390f245f1ecbe6c827d2
SHA1 d72a9275cb5f4d2ca59c91b25fe4fa618cadac28
SHA512 ab1941d856ba8e189a24aa69e84075fca5c51213f972d8de6bb567b5e15d501d04604a01b49483cc37aa79a4d263e74038da3893cd4b5ef3216e718c06778738
SSDEEP 24576:IcP4mcvIjkGOxhKP2l71nNKbrh/8KBGfJ4yL/tNCJPXUQrPm:zP4m4IpOO67W8KIfJ4klKXne
TLSH
T10765AE2DA7DC0096D0BB917886658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2023043efa966a12aa06879408a2eef033fa7a810a93c6adbdd32e3c564d0204
MD5 c74c041bacf281c2bc256513883e9b77
SHA1 42c8a3dfdafb06bc601ad0e39f1e61e2a7d760ca
SHA512 6a54b3c1ea194e7b62e37445cfbc35d213f596b3cb7eaa1214269a031bb3506053b98e74b9cc6bd29623b53b55f51926d620323da6d669c049f68f4b571624e5
SSDEEP 12288:6Gsf+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:2+fJ4yL/tNCJPXUQrPf
TLSH
T11A55015AD29801D8C46E92B8CB449201F3237CA593E2D3CB97C1F47E2FBA6945DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 490cb0a5360c129019e4490135fe73297679ee875050bccec54d71604555e047
MD5 868e46dae27547cb1d21386df9f250c3
SHA1 3a7992c7961090461fd90932347abbafde0db6a0
SHA512 b58c047ef5c985c8fd45ee4a61b31805e3b0a97239206ca3a2c9910863c62c497060a57c83fcc5f1530f2c10314fa9320805eda922fe5275e1f6201e4e5b428d
SSDEEP 12288:yefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:yefJ4yL/tNCJPXUQrPe
TLSH
T10B4523AB51D8944ADE7A87F81648E000D3087ED55B2BA2E7EE43B4853FFC9561DAC313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 393060e173228b3f65e640dbe07d08a623505f2876349d5d4eb41aa623387719
MD5 cfbc31666bf29078901aa2a7ad6ff507
SHA1 0b838ed3b78d7fcf78d99dea01f715c4b3b5bed1
SHA512 460d7edcc30e713fd45e818d38b89500d4a187a835d8c9383dc1ad7f3ef8b1b979dade717ebff2cdd7c0d57c523e6ce68a6b14dfae59faca3f125d40fac61cd7
SSDEEP 49152:ka0h2GEkuAe73q3pp46zwwQ8fJ4klKXne:ka0hNYG4JwnfJ4k
TLSH
T181859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 9971dd2a95265056c9796a6c7f16800c5d32c65519f05e1c4f262c9a20a089f7
MD5 0455ba07ffda4b92960c05442ceeb877
SHA1 d3e83bf02b35cb530280c11ef2c71cd2dcddc09f
SHA512 51c92f5aeb5dd30265d609d21077ec3f7d518dc0f7fadef33a49f9a42fa749f01708b5a272c255040565cb3619745b29450dc89da3e4c4f7efedcb7310071f46
SSDEEP 12288:rhbHjfXzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:rhbHjPzfJ4yL/tNCJPXUQrP3
TLSH
T1B25502BE12AC20D9E571D2BC5684D106C330BCA51726A3EF67C2917A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f6a88d868790c39d77826c9af2d22c517e0c706b692ecdcb7f1a90b174772ecb
MD5 d4ca0531dd0b2adb8eed5fa26007a1d1
SHA1 c61c274502a50910d1b3b2ce1e77b5519cb948e8
SHA512 b051bab6e75ce55def5e8fddef69e0392a83791c82ee8341e7f2d5a6d843e5cdddaed132a33848898b8446e7397c343e951f34f11a1f9208b118b4183624bf7d
SSDEEP 24576:U3YgnJcRTk4yti+R5dBR/rfJ4yL/tNCJPXUQrPB:UIgnaTk46pBR/rfJ4klKXnZ
TLSH
T16145B02EF2B910B9D8AAD236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 64d431415e45ccaf6992c0e72e3447233265d9586846646684aea9fb408e2523
MD5 7958c0c242772524faea3c9789861d39
SHA1 83bc8fd306cc3f4654e3f42d936c93b6a9017a0f
SHA512 cfd1e4db75f0bfb10d0329d2b2ca369a1d66361a6a8448cfbd70f46fd54edfa99c09198f3d6fba7a465f069b5b58a2571843d13b0103356639248dcfb4b57199
SSDEEP 12288:CKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:CKfJ4yL/tNCJPXUQrPa
TLSH
T1C84523EB6084948ACE6687F81A48E001D3047FC5572B62E7ED83B4867FFD99B15BC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 b504a3e34b3dd5e83e0eb3fab5b919ab84b863802701d0d9bc5ad467679522ce
MD5 a7b7e5901b279f9a86aed3ebbcdc53d5
SHA1 0b21ddc6c6e6e366ae30a94043c7c9a290fe5eda
SHA512 42dd327db1c713b07b29e7b808a2b459a63f31affe85eb33e0f404128528a3d328749ada23c79e81fd9a3af8a38d3397a99b46acee056a91686df50500fc666b
SSDEEP 12288:PObvA4LWOsvAYFTZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:QrL3UTZfJ4yL/tNCJPXUQrPu
TLSH
T10E75F155E29400F9ED7BC27C89A5D512D372B89D0324E3EF07A88A652F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 242e8a7985268089c6418e5d465a064cd2334e6b3b35661266465da98bae64da
MD5 55bc2bbf8c246ad16b9d94843356c8fa
SHA1 e562a7cb8d5dac72e395c01d56adfbecf299a2c4
SHA512 a61df364afa342ff11dd28b9b90b0dba6e727f755ea6835dacfee3192223b781ebf9f091e93717ebf9419ca80d92e33ada7cf5e7544148d4a8039edb51a39735
SSDEEP 12288:LpFtYOFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:OOFfJ4yL/tNCJPXUQrPL
TLSH
T1DC55026A32EC10E5D576927C4A85D209D331BCA6172653EF46D080BE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c6a0ee38a1631e57686ea13db27b8fc9d8c5a1dcf222bb4d979cf848acc6fb23
MD5 3121fbb977eb39a6e0329a93b9955c9d
SHA1 533313589627e980804254656af71bcf46085299
SHA512 b03d55a6648c3ef966914c5d5c883339738f455b4159c72dc38d66f8dd207485f99df6392da3afe33d19bb9cac013de1683a20490223fc38be066b7d239c3cae
SSDEEP 24576:d7NM9YqZqmWMUkPjZM48Mv6bEhsufJ4yL/tNCJPXUQrPC:d7cBWMpPjN8DbEhTfJ4klKXn6
TLSH
T14465AE2E6BEC81D5D577D13DC9A28206F2B1B4611B328ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 00068cb15fd44f192120d814651652a16b06f3b4aa3ab0265e4fb5d84a341c9c
MD5 7efe67b79deaa085ce9fdbda85cae1be
SHA1 21df09d05b863382e2ccd624a695d8bcfe7dd851
SHA512 887aff3e67fd6ae447d86d7dbd67701e6248c157061cba8cfdad00858b2daee814499fcd60b748d4795cbd6902711704383be5508506106b07c837bbd8be6dcc
SSDEEP 24576:sW6BApg2YuyuNDYTabvcdvNYf8km1QfJ4yL/tNCJPXUQrP7:sF2YuHNETovAvNYf8kmOfJ4klKXnz
TLSH
T19B858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f613e425452cd5c43b372f868d03e982180345c81ac18bd0aa20ce4f18e058ae
MD5 1ab05e9f529b9d9b08d08c1f8cab4e7c
SHA1 4af1d21b2b6055b07617cb059ea389f293fdf92a
SHA512 20acaa9b7bfb40ff801616a00981f9e3e0c5d970bb3ec76ccfd65fda561d4c3801b132c38b5cddc06ad829be6c31043895e4324a836fc5d31be2a6fd7ca0ed9e
SSDEEP 24576:tAFs06+OmlfQNXEbTohfJ4yL/tNCJPXUQrPW:iFs060lcXucfJ4klKXne
TLSH
T1C565AF2F62EC00D5D07ED17D8A96C916F7B1746307256ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 585cf879f92ddeb7f99c4c0d3855a06bea4e88fcb0673df1f88273222e24c8d6
MD5 bcff06dde147ca5c82400cf26f6c73c9
SHA1 fa554762136328f491c081b354a97d9390cf6985
SHA512 fef1336e6673909f25d62bf62844896551a08ecc1bf185c2121c0d9f3096a0f837a09bff84440b6dd68ffafc81889cbad075491e171090f8d5175d10de3d5feb
SSDEEP 12288:pCJnJ5D3VkrDzxOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:AJnJ5D3WXcfJ4yL/tNCJPXUQrPp
TLSH
T1E165D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1746ba14344fbb9893c7914cac70eaef0635257e2f27915f36f6a0115925afa6
MD5 c4be7a6673e1e48e02fcd60d395b9f9f
SHA1 f6e36d0b10ffd7b7382a0b7ecc99f223403f82ae
SHA512 5b680779459e868a7d2140a1b2249cac967956cacfbc19b24a7f4d056e22c2dc0bbee095eee319a57c08eb1c8aeb9316233157a85869b79f141836e798f72a81
SSDEEP 24576:ZEPghm6/7IIXdwcXrif7qQncjlP65i3VurfJ4yL/tNCJPXUQrPd:eg06DIKdwc+eQnSt65aVSfJ4klKXnF
TLSH
T191955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 7254c4bcb2f0bb0486e63e921627cab12caa524b3a424d5263bcdd5bf4187051
MD5 65d7058ab264b7542823afdd8c83b7cf
SHA1 fe735dc39660c9662f6e34256719dc58ef573a8e
SHA512 449b289aa57eb4e1d52002244231f9b807fa8cb426256ffa17a0fce72ca8b708ccc65863dc4330844abf9422829ec21ca40744d8ba994a979743a2d3c3355738
SSDEEP 12288:/EP3Rn4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:En4fJ4yL/tNCJPXUQrPL
TLSH
T1405512AE229C60D9D526927C4680C101D331F4A12B2763FF5AD2D17E5FBBAEA1D3CB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b516158cf0c4bedaabfefb61df3f70e58b32328ac8e74549f1c79919fafad189
MD5 abd96bfea72466187f4393b13fa8bfef
SHA1 0f216ece87e25c8b58aad09a3fb1edd86cfa3d67
SHA512 79881a06fabbeb3a271d9beaa872feda1c79d6f68e7ff035fd811e2bdbc74252e01827137aadf38de43139fe0a238db357bf9f256276677bafc0dc1244e53949
SSDEEP 12288:tjkyjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Siu:tIyjfJ4yL/tNCJPXUQrPC
TLSH
T13555224A23D4A084DA7A477C8A55D140CB34BCA05F26A3EF9581F53E7FBABD42C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0dfec30c216f59eeaf5a5335e8208bc2983a2d4fa2cf2238b92e1c79e26035e9
MD5 a905cca919273e2d761df0f08df790ec
SHA1 3aaa7179a42a640d7a1593a384b2abf15590cb2e
SHA512 a88e05e43340cf970a93dc5f688afcfd892c820a5a94ffcdd7d6a2db52aa7d6b9f8db477b1c9646070dd470e3f776b1f7f3c00c7ec2118ba849de7a085de1b03
SSDEEP 12288:Zy1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:I1fJ4yL/tNCJPXUQrPt
TLSH
T1AC4523AE2195A08ADE2687F81648E000C3147ED5272B72FB9DC2F4B27FFD98615BC751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 377fb9406159dcfae9afe532d6a62c209ac0c6f990179f7853c5826b3395638f
MD5 a20c64497d456b3fe878d9033c367252
SHA1 c7bc47cce4483befc7b682a517483c198dfbd6ca
SHA512 7dda770e9ec5daed3e410c02357e0773aa23840811ac10770a23411d9545e5110d4186489ecc8af9011758be3fcd4574af784c6a683035d378423c9535dd9624
SSDEEP 24576:pQ9MxZKdcz9dw3WfJ4yL/tNCJPXUQrP7:pVKZWfJ4klKXnz
TLSH
T1CE558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b3f98872021a7df08b5ddd58131abab125e1099f135e2ee1897b055687a67a44
MD5 8f01deb35fc8e8fcaea7fc94f8a0cfc8
SHA1 7cc0c493c0354f24b38fe334ebd34da724289c4e
SHA512 cd7a48e364269d4a407bc9cf305d17aa62e2354a1aafff4ba3a7b938c1e0d5f4821f0263cd86c599fedd95f76260b1a2782c9959d133030f44a38748671394bf
SSDEEP 12288:TyoKo2JRple9pPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:TyocDApPfJ4yL/tNCJPXUQrPl
TLSH
T10A65E05FB7A940A2E176823C8984C241E773B4701B2263DB6682C33D5F77AE97D38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 abab621b1d46ec732a94e73b4c503d6f8c17510e15277bcbdfd735a4180f2dc7
MD5 fe033913c31a34e7ef0c56d2eef9083a
SHA1 e3db8ef81e667902cc338b0cf3994d28ecb066f4
SHA512 b2cf2d8904270a6292b9c3ac6e0c529178e868037d6287981d9e74b7d2691a0420f6bc8715c5c6f0aff1a429a15ea77f315493c8b4d105c249b9a99b5fdf741c
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKPfJ4klKXnh:W0zuNIZfJ4k
TLSH
T111A57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 699e18d90bf4b5a849755d7e5e8c493bd77243cb7ebde39dd4bd79e4f2e07d63
MD5 66c862df325441c2750108d3aadcfcb1
SHA1 0e36a3446ef2b03c3b5be7be632f79f38fd6d12c
SHA512 e02d38c2eb2aaf62da368f16c04e269c4e04c5fafc71b80f2a21db5597442a27b5f2adcf3f1c4ab3b594b4c9917134bbee606ca2ec7c58b7f2edf30a0a916b06
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYsjMqb4fJ4yL/tNCJPXUQrPX:pTDxR+N5YzTujMlfJ4klKXnf
TLSH
T13355B02EA7F855E9D17E86789A23C502FB727851033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 1910e1b9c1e7f4c0eaee121972265af1c30b9d2748cc3a2c780c94e7a8b0196b
MD5 601eac80976d24a2087dfd901930fe40
SHA1 87ab3fbcf293309725a10a867546045078b93afb
SHA512 0db7d99da23541f0d2bc67fd0a33f8c62ebc04d22e35485fe1d9571b8fbf626781498bac515542f57e1f1297a3b4b85a15ca9199db73161dfe1aee3ec512a955
SSDEEP 24576:kTMdOz0FFS+hmSLEfJ4yL/tNCJPXUQrPd:M0K+hmSLEfJ4klKXn1
TLSH
T15065E17E63AD14E5E57BC27C9643D906E67238A2032266DB06D0C0793F9BEE4397DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 4f7b64799e7a58cf812b379533a61fc32761df372f8c7e713a4ce1d81b86ffd2
MD5 36f7ac2481e41d63e992a91228cf27d2
SHA1 f4e127b532194436ab0dcdfb3508da11dc50389a
SHA512 28b87d73284843ad69a6a90583dd94cffb0788e31437f8523057c97f83cbcc5aa1ac838462fb35c665a7316e3c6990667d15075fda485986cd98a4bcf893b335
SSDEEP 12288:c4KZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:aZfJ4yL/tNCJPXUQrP1
TLSH
T1CB45125E23D830D5E87293B84B58D101C330BCA6132A62FF39D1D4BA6FBAAD5597C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/812-167-0x0000000140000000-0x00000001401C6000-memory.dmp

Download

memory/812-113-0x0000000140000000-0x00000001401C6000-memory.dmp

Download

memory/892-39-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/892-33-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/892-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/892-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1052-470-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1052-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1808-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1808-365-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2512-155-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2512-76-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2512-85-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2512-82-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2552-399-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-368-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-404-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-405-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-406-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-401-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-402-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-403-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-400-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-398-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-383-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-384-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-385-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-386-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-387-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-366-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-367-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-396-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-370-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-371-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-369-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-372-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-377-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-380-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-381-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-379-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-378-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-376-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-375-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-374-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-373-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-382-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-388-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-395-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-397-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-394-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-393-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-392-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-391-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-389-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2552-390-0x000002C5CF6E0000-0x000002C5CF6F0000-memory.dmp

Download

memory/2660-119-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/2660-255-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/2892-15-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/2892-109-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/3256-148-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/3256-364-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/3288-474-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3288-253-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3288-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3288-197-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3288-181-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3288-351-0x000000000C8E0000-0x000000000C8E8000-memory.dmp

Download

memory/3396-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3396-8-0x0000000140000000-0x00000001403E9000-memory.dmp

Download

memory/3396-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3396-72-0x0000000140000000-0x00000001403E9000-memory.dmp

Download

memory/3564-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3564-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3564-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3564-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3608-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3608-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3832-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3832-122-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3832-330-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3832-128-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4200-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4200-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4200-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4244-163-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4244-110-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4244-106-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4244-101-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4368-73-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4424-69-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4424-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4440-349-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/4440-145-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/4440-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4440-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4592-473-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/4592-168-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/4612-87-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4612-96-0x0000000140000000-0x00000001401DC000-memory.dmp

Download

memory/4612-93-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4612-158-0x0000000140000000-0x00000001401DC000-memory.dmp

Download

memory/4704-26-0x0000000140000000-0x00000001401DA000-memory.dmp

Download

memory/4704-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4704-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4772-66-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4772-60-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4772-54-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4772-65-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/4772-68-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/4924-416-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4924-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download