Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
- Size 8.1MB
- Sample260919-1bdbfaca68
- SHA256 3f5917fb65482b5986aff5b84af64ac5c5b5c800fcfdf6dd4fc2d0494f610eb8
- MD5 b89bfaa44507ef4078fbd6bc0b142129
- SHA1 a0df7e72f042eb91e500b19d0ea5942db24548b9
- SHA512 fe6dad339fccc9337ae53d3b46fb89fcbf4d6c6fba216872170fc3f8bd1f1ffc0364b9c927780e0a23d2c0e2020e42f6c93cd53b0295de4e829b6e5b378b883a
- SSDEEP 98304:1V1OFqS8SHmo5xUbyABb8z/Xr4DpxY55aJwDD527BWG:1V1kZ6yAiHigm8VQBWG
- TLSH T1A1868D53F29611F8C01EC978876E5232A9797C8A4B31A3EF0AE436211E75ED46F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4724 alg.exe 4804 DiagnosticsHub.StandardCollector.Service.exe 3756 fxssvc.exe 2464 elevation_service.exe 1584 elevation_service.exe 4468 maintenanceservice.exe 2852 msdtc.exe 2856 OSE.EXE 3992 PerceptionSimulationService.exe 3744 perfhost.exe 2316 locator.exe 984 SensorDataService.exe 1580 snmptrap.exe 2300 spectrum.exe 3232 ssh-agent.exe 2560 TieringEngineService.exe 1292 AgentService.exe 3932 vds.exe 4384 vssvc.exe 4812 wbengine.exe 4836 WmiApSrv.exe 4712 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\54336e4d60f3a3fa.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4e8a7d57d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000707492d57d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022df80d67d48dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019b014d77d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002152b5d67d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a59334d67d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076a909d67d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005483e3d57d48dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e70dced57d48dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd97f6d57d48dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5068 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeAuditPrivilege 3756 fxssvc.exe Token: SeRestorePrivilege 2560 TieringEngineService.exe Token: SeManageVolumePrivilege 2560 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1292 AgentService.exe Token: SeBackupPrivilege 4384 vssvc.exe Token: SeRestorePrivilege 4384 vssvc.exe Token: SeAuditPrivilege 4384 vssvc.exe Token: SeBackupPrivilege 4812 wbengine.exe Token: SeRestorePrivilege 4812 wbengine.exe Token: SeSecurityPrivilege 4812 wbengine.exe Token: 33 4712 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4712 SearchIndexer.exe Token: SeDebugPrivilege 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 1476 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe Token: SeDebugPrivilege 4724 alg.exe Token: SeDebugPrivilege 4724 alg.exe Token: SeDebugPrivilege 4724 alg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5068 wrote to memory of 1476 5068 2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe 85 PID 4712 wrote to memory of 2024 4712 SearchIndexer.exe 114 PID 4712 wrote to memory of 1176 4712 SearchIndexer.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exeC:\Users\Admin\AppData\Local\Temp\2026-09-19_b89bfaa44507ef4078fbd6bc0b142129_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.92 --initial-client-data=0x26c,0x270,0x274,0x260,0x278,0x14074ab18,0x14074ab28,0x14074ab382⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4804
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5096
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2464
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1584
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4468
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2852
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2856
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3992
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3744
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2316
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:984
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1580
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2300
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5112
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3932
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4836
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2024
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:1176
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 bda82327cbcbb221ec98e5860a6a382a6a9643f4de307d3abdb23db711b552da
- MD5 74850bf86738389a5d2de0da4c68437d
- SHA1 76fdbcfd05768df8541644207ee9ea7f686fd30c
- SHA512 dda2ea7ec668eab3e9a479d1e895d82c83e65a900a532bda4aeeb6cf95d3d3e618ebfbbe78468e9814e838ea5237707916bec688661234469c13e2bca572d5dd
- SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntDmg27RnWGj:03q6sjBaD527BWG
- TLSH T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 2b5314371b46f9d5615705a26bb9a9905562c049468dbe4c7c62811a735995c5
- MD5 c599ddda349f2b1c176daf9cd019d612
- SHA1 da1eab88f32968b84887ccb9f419e289e6e4f571
- SHA512 97588b3bb14fe006f0fb8e7d2e6bcb6e92e4cd936526ad7894d818e7a2f6cf0a4294a62341f5a61ca1dc41ee1df005c841bb50255bdee7fd6b0c2a8b9c71d3b4
- SSDEEP 24576:NXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:Ytc3Dmg27RnWGj
- TLSH T17765F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 522cba3b25536bbd97d89b8e7ddd8ebc3a178d0348da0d7cc49db6ad3c89fd83
- MD5 ffff7c9e059882815bcb6e308471fb4d
- SHA1 9f4e8daeaa1a423f42b16ff6a01f464cd6be4186
- SHA512 d26130eeefc63f589ac41536a7637f5ae83d8a4d021b231cf7124254311073b274001ffd555db99e8458177f89d81cc16fea4b600a649184c3ced3d2c93cb015
- SSDEEP 24576:Q0Le5ji0hmxxrMxsqjnhMgeiCl7G0nehbGZpbD:QPji0AjUDmg27RnWGj
- TLSH T133859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 a1291603645139e3097aa9b714892753e50974cd7aa2182862790d4ff6b35925
- MD5 c58f2a9f236797cbc0e316575bff1d22
- SHA1 a0374bcbab0a54c6d791896337388327aa4ace77
- SHA512 268f600684ebab327a888a286a5bd00b08f0b8e4eb6eddb51422c62c1bf564d8408f0d6031779318050ac36783638e3903292bb4671afee3a1629924328d2470
- SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWn6q8wyujsqjnhMgeiCl7G0nehbGZpbD:Y/ezSC6vUzPveHjy4Dmg27RnWGj
- TLSH T156755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 e04182b1551eff2ef4e626f349d2db21418e95416411f4dd46c5a88d76e124e1
- MD5 a53207153e20a7ee78fffa1f6c04622c
- SHA1 49c2b56088923ac11619a1099c613b846f0cff22
- SHA512 3a935d3abeec8959ef4162ebe2d7784a1ce3a94cff07dc491c97b7d275754845b8bffa75f8fe74717016bb53d6ad31ac0cc073fd93721f236d10c48b817d2b8a
- SSDEEP 24576:pVbqPb88hv/l+YGsqjnhMgeiCl7G0nehbGZpbD:pVO88hXl+vDmg27RnWGj
- TLSH T19C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 7e5645bdde47a74737fee16a4fc36fe339309a92f657dd3d076491da3d37ffa8
- MD5 5a332067e095902235f50f498087779a
- SHA1 206542d999f1089450e3b15ad7681715a454740e
- SHA512 53dc7334bb87ac9c1e2c35ab0608d9ba9c7bd4fbe34a512f7f1322798c4508ec04dc65f5ba38e131a740d655ba8c6932455cf002c458e7cd5f9f5a4e1d724b66
- SSDEEP 12288:mLNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mLNsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11C4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 087778f049060a92c335514b8cf810bd4533d601e87667cc6fa190c15e09dcb8
- MD5 656bb6ecaf70bdfafc09abff8f22b53e
- SHA1 60b035d93d45485266f1788edf7f9ff4ec0db9de
- SHA512 34a7c6de224caacfead9641df38bd2b53419f2cc20d9bf3823227b062efa1c63d64287f5e390a42c2efa0e5936c36dd4ab0ce4b92d5df66e9224cc70617e1e22
- SSDEEP 12288:teBNUbTVO86UuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:tJIUusqjnhMgeiCl7G0nehbGZpbD
- TLSH T1DD65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 ecf73d3a9a8ac581fd7f7f033359f8161df2f487625b2bba0e797f18d53c6368
- MD5 f5998959a33c2b321fd9c56cdb5e50a0
- SHA1 18c2e229cad04d059460e4b8c61bb1d7b7be7533
- SHA512 0256f243a21f2c494bcb6b09b276aea700ead0bb52c8f8cc1c68206eb23e2f16a41dacfc04adc266a83944bf57e9c76d401b730bbc980478dd44234013985a97
- SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH5:7QvGAdlCEL8c/DRNw5CXD527BWG
- TLSH T12F266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 52c79867a9c7094f18b741d90119f5dcc70261b9a96b9ff6446359e68ff3ec3c
- MD5 37e651128d2e5307d2dda87fc18e21e3
- SHA1 244b2df8b60ae5ed4829c48f625d44f47c34ef2e
- SHA512 3c819eb10923f5eabe8a0c7d8e6b80de8204bed5b61686ec344745f5889add4d459c25d29d17a70bcc92581ed91bcc64df3114516720294e9b9654f53bd67e2f
- SSDEEP 12288:GAwSfxL/2Dc3RDLLmt0LDQewsAjYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:b0ewsAjYsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15175E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 0d755cd4510e5c0f0369b268654963100976cc26381a31799983afe2aa519b3b
- MD5 fa715868818f030bf6bd86b626a12a98
- SHA1 fb10af36dcb15464ffaff9970f7150a4037c0792
- SHA512 8273496eb42d4670188ef2ccabcee1302da4a934cb1bbdf8a8749fc36bab7a28857d1fff625e470a4c9d4e694e74f63c96662c40763ee5f7934044e96ee22175
- SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:bUEtQevvqc2W1cpV2tI32zB
- TLSH T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 b373a46b324bee6e6f6361c8e3d98fef3c56a45127d860cb09334924db25632e
- MD5 fb6687ff7cf931ccf33d39d48ab8d4a1
- SHA1 35530d9c164509af620511fadff86e74346265e7
- SHA512 c21b0a4f9318c22d4db7c741e96f68c252a10d867750343d800e99ff9cc0066e796947bc7c512e8beef366f8a85e9bf1213b5666d4abb38fd886c418bcc63cea
- SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zkDmg27RnWGj:BoquVjnmLD527BWG
- TLSH T1D1D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 cee592e7f6ac5aedcc1665aa929d19e10ddf84d8349a8e46703773ab84f99f99
- MD5 97a3481ab2c3d81a860e1b6e5998b8e6
- SHA1 7111e10819b2e0bc903f6ebeb86738069cad2133
- SHA512 43700d5e5155f46920e64d7b8ce6cd0e74e58bbaeaf95cb85a3e1ba8b1b2fc0d1f9bd3e5816a5d58bfe8c943bb5c6dbc2f3cd4f2f6ca03a8cd2b16c431a6ec5c
- SSDEEP 24576:6AhGL3IFoiwtA5l7S53XsqjnhMgeiCl7G0nehbGZpbD:6AMUFoiq57Dmg27RnWGj
- TLSH T174359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 f465ec1afcbda9d3055192da3d48ef155c37a0524bd2b6c725345b8980cfdef4
- MD5 c294807fac8c5799c3ef4ae4f9d8ff42
- SHA1 f5f2d71059a7862d1f4e0bab2cb3025c9f67f19f
- SHA512 fbface79aca2d633e1776a057f71cac77af1395341bcdf4337ccfee1eaffe539d21e2003d9b10143808053a667646834777fb32cf4e9351f3b570a2b7f94bd99
- SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+CDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:rwu4OWssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B065F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 fbe001925b861d464df3a7bbdfb13ec96d0eb31d1e521b40cde121d24d2d5993
- MD5 899d6f3a47baf1851c4a558dda226d83
- SHA1 5c226bea4aad568871527aab44582a395d47af46
- SHA512 75e868f21db1abbb20b573f6a3b2ba1e034b007f193188ceceb05f942a2f3e7eacf37380a255caf0b3f260dcf4ce506edb00276d80810264b52216f7318be0bf
- SSDEEP 12288:IeZ1IyIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZZuZsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1705512AE239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 2780c259b3ff9cecb6b0b1d681f085021755846b07b5097e852be168ae93021e
- MD5 4f99982ba1397ad5f94ba0ccb880abf1
- SHA1 a9c0b14f7889c00a83b3677597be1c3ed374e8b9
- SHA512 2c55a24ffb0754dae44c20a73e3ff78136fd1386ebe9ac45f2b63a26b0d3c623fc3cd4d93aaf85b83226695bc3862c0bd9d88ece7f82f8c8f608dc5c258982e1
- SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN32D527BWG:9QyiKa/X+PNGVQBWG
- TLSH T122667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 081486de0135b1a142d429cddf3cf7b7f68e471419133b4593b3cad8a63b8f6b
- MD5 725a92742ba37c79e77f4653a37036cb
- SHA1 3039f3bf62097b679fc6da53c9d81ab14668fa69
- SHA512 aafef1560b0f65727f6b47971010b0debc7c5dc6554bbfb8438d848df1f4224f31635bfe56ceff7017ea5e2b24c888687768c1fed0493aed7605775439a7d8dc
- SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN32D527BWG:LQyiKa/X+PNGVQBWG
- TLSH T1C2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 ed8429803606a3d2130396658cfc5909453bce86dfb7fbdedbad2e503b4ed65b
- MD5 f8dba4e24ecac71babb7563e9a8412d0
- SHA1 4da5e51656bddd4cc47562952b048a042f1752db
- SHA512 cbe29484527c924a6fc6e6f704c9a9683537145041a6261c67d2dd7b8081cb66b7b03726e83a302e04d3d3307a9ca173c6a474b186a8f44e2b6b8612f3f922e4
- SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0psqjnhMgeiCl7Ge:E68Qg55nhceWu7PNU3/UDmg27RnWGj
- TLSH T1EBB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 83b1b2d02eff16b03bdc549165bacb4e50ae6bc62e163494c6161b815f4afe57
- MD5 b64008e075bd69983773c40126d7c276
- SHA1 b017ef0366580def3cdd76fab2e764f1309689c9
- SHA512 2478234bc28b7b0cc9409737e3cf055581262ffb7ccbad01c301127bb2c6274539c2d099cf712cc809b759bba5bf731836584391e1efab6966ef84b24a9bc83c
- SSDEEP 98304:dy5112gYy5azzVvt69nLKnhZxD527BWG:ALIHEWhzVQBWG
- TLSH T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 57768db59cc03aac8b5715745e92eab10f4b0a3505e01067f1909dc912a5a454
- MD5 914b45a426bdf38caea6a032c91fee1c
- SHA1 9e46bd49e9925a95b0a4abf1fa62e1062bafb2e4
- SHA512 c66d48418b3b4807fff6da68366b97535b84fb0c57446429db18be5caf732b63612f1e7afa3cc53e592fcc4706a414c2f3642197f0e0d605d82da77d03451166
- SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gluDmg27RnWGj:/u6Jmdxd2duD527BWG
- TLSH T1DED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 c5086d08a001cbbf88ed72e531e3f9e2afa86a4d4c1c0734fd530564e18d2219
- MD5 6ff30847efb3318957ab063af8a55f69
- SHA1 4928a65e863c4d2727d9fa084d4592c657527054
- SHA512 daecd62e225c99d8158dec902555cf9bcd70f26d3235687ba2a1f3decd40feb69eff045518821c357d6613429efcd7fb99edf44abb97430185991bfa57167a55
- SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xiDmg27RnWGj:jmifPWRLD527BWG
- TLSH T1DAB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 bc74f4a1d5487c784c5331104b84c47f3caa5922d5c4caf690d58815f690bfa5
- MD5 8917f39203b60d6f1faa4e54c4fee029
- SHA1 57466feabdef3a26a47adbc2b768b9cbce9fb2d2
- SHA512 020af48642097c378feff6dc999df852590c3b7b4264554d6bcf2c90c5fcaba99ea05577dc3ae1a43ab0cecd99e806c13d698ff207815575537b3e41bf306d15
- SSDEEP 49152:FSuZQIY0Be2KcRVtOnks6NMHqdDmg27RnWGj:L5dKii61dD527BWG
- TLSH T15FC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 84d1661065ed62b46e2c6730cee20c24b3a5ecacd34851e0620b53cd030d7559
- MD5 1a1010e8f5ab0d39c6b9f5ac8c21317e
- SHA1 0f28cce2e6ebe62b029b6fc54ad9aa6f4ce91b35
- SHA512 a543353714d3b20ff8ef6dcdf52bd8fd1958c85fdfa8fa30c8e32bb38e038eaebabfadd27ec321982b9d4c26dbf3fde5a6d76d034c0aa347fb0480d9c17be0b5
- SSDEEP 49152:2htSn8EApI0fig3giDn0AP5weDmg27RnWGj:XX2imphfD527BWG
- TLSH T14795BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 7260a01eeb2b5dc570937eb94201e56d90d0a5ce863880519c09176a83473bc9
- MD5 f9fabb00a9b3307d3025001c83a2d042
- SHA1 bcbdfc5cb9ddcf206c8f214d7bcf28255b680d12
- SHA512 dd0938536ab24d46f1e1807a20c8705772a4b75aed9af2f41784969ff8bcdaad6c9f90161dd50f7ae04592ef6258685c1d8abbff065822fc710754b378b9be50
- SSDEEP 12288:UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UVsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1024523BE965C41CAE52648B5C3E5F10EAC073E57E92004937A977CBAFBB14984B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 a3e5dfe84e1f65d6e4d3d3e4b953ea6ecf8d1a85f37691234acc691932bb71ff
- MD5 720484eea2b7176f7345162b21f8bf14
- SHA1 5001865c3fbd53d02a69a3c5f575f1fd4d0b5d5b
- SHA512 be5eb86d44b78d8286e635ce2ca8758f3c3006d0178ae56fb447c1d4ab0d6d7ab07b13304667359791b6e12ac236c76cf0b230ec9ee9c6ddf72db412bdbec3d0
- SSDEEP 12288:HEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HEsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1704523BE965C41CBE52648B5C3E5F14DAC073E57E92004837A977CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 f3e9f3bd31a20b8f47947b9318e8fec9e3d90ba3c23fde32b770b7d411fe408c
- MD5 e8fbc50f18b7483caf630ca153783445
- SHA1 3514ed7872fed2dab8af7bc2f80c433ee240b3b7
- SHA512 947cd474f316d014f173c944e4d6f973fa63223d7cbd3c72e12647f446e6c733f6d3c78009a6e38d13b1ce67644da5b93ef5455613b130d7938cbb18c599ccf1
- SSDEEP 12288:LWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LWsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13A4523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CBDFAB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 5309a1521910841cd5307f82ef5118badfe281a4805aaf7435edeece7035c46f
- MD5 166dcd77f255a01cfda7f238b6d37ed9
- SHA1 5827a67a275c64e03b690371e1cac83e9f26fc8a
- SHA512 e3a9421934ad6a55198e5fec65f575f5dde4f0bb72840195ded291d6e1fee6f6d4f122d0a7762c8e6ffe8308a31f99e14e6c78eb3ae051db762489a1e512b61d
- SSDEEP 12288:BV3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1F045236B675C00C6D83285B4C2F5E11DE8237D56EB3005DB6B532CBE9FB16984F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 a992dbd264ef31f01441e9f54dda2dd01d90e0459ad26d8963df5f95d70e00b1
- MD5 16c3c244bf5d0489e124968e64f5c808
- SHA1 fe2890bb1d8daa6b02b367f5a77a745f86bac52e
- SHA512 2bf6c80d64f34c2025a76ff08a18976c7482fb09beea6f93ab22658401b9e9044d5a22b2e3f8c5bf4c9aa618bfe4e0d4a06f83b20bc32e9d4e3614e21c63e627
- SSDEEP 12288:cvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cvsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1464523BE965C41CBE52608B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 b04892a8b514db9c7ca1d4bbd76f59b3927f292b9da87e9a8e3fc0a7ac56dbd2
- MD5 2b8ea2389caad93ba5ebd3ae304b1117
- SHA1 1227bbef79ffaee51a4914b05ccc54adff10a065
- SHA512 485f547e51aac354d4bd86820176131e6b317992cdc70defcc6f8fa9b7f26906bc7fc15ee93d5d6c5c12bdbba7200f67ef285df178482ffe568534e9639756c4
- SSDEEP 12288:kgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kgsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1744523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 e4d942ef46cad4b7238abd69f0c498c14f03bd3a12eca631523bea71f075694d
- MD5 b90e6de3742eaaa9b27a222650f46aa0
- SHA1 1d920427abbca59e307344c8dc070546c1eb8188
- SHA512 551872a59a16ce6c96464abfd9d977fec922b7113bfef355334a4cf212583f2ac192c75d91fb9129d4356e1d0524bfceea192351b77db79a5f56e013a8546bc6
- SSDEEP 12288:d8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1764523BE965C41CBE62644B5C3E5F11DAC073E5BE92004837A677CBAFBB14684B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 e5dcb52c869aeb92cd27e700f209b5d027c8c4f27681ac25446a838d5cd71ea1
- MD5 4926074852f056b1a16fa565087c12f2
- SHA1 dee1326bf91d9d3d648f535d882033e68e65cb7b
- SHA512 9e49bcd299a4eabce9d1e17f660411936a9df168a04fa36f686f52edbffd7b1419736b9a3f4e65cad4355a16bd73ad5cbad5e464fcdbff68dfc435437aad9d5f
- SSDEEP 24576:6ZMRzFVSOksqjnhMgeiCl7G0nehbGZpbD:6ZMRzfMDmg27RnWGj
- TLSH T1D36501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 f025829fb4f90a57378cbd780ad5117266373003dd439e3d578ec94ebc22a850
- MD5 7c82d4663aa6c900b2d13411893c2c16
- SHA1 9c20d193ff772d4e77aedf99f94b689df4967032
- SHA512 9d291663a94f16b805cd918734a4e500a10f660cb13ca13dfc9e95b011587a58f7c8e23ce19cd37f49c40085a5c3828feb9a1128e62c056057b13378e8a510e0
- SSDEEP 12288:qJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14B4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 2f16ae7b086270fce1396b9fe0b793abedd76431aaa024f9b8a8332e80ff4c9c
- MD5 525f2758cf2c8ad67df3572bba32fb59
- SHA1 80671add20e5df250cb9785a25e97d73a4034e71
- SHA512 e1ff0e5d842a7dab99ebd1bed862737d9d68536d1f739e2f03fa7e8dda06ce631ed5289e909b3fef470d6ea4c36ae62431e8852162912fb337f79c31a87e5c2f
- SSDEEP 12288:v9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v9sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D84523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A6B7CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 f485665fff70842a6bc2d385759c42760da2744091114b56c1938a5410c9cebe
- MD5 c20c86164e8c1440c7036af7baa75031
- SHA1 7421d531ec162d7d05eb7233125c1867a624a3ab
- SHA512 e7a3b36921713f4bcde8ef08bc17ba15f0b6d02fcff468a9052a7e4671ba6d5b53a8b85b77db91c5149ac6a5924e66c2348369b8e6c3711dc476094085cce287
- SSDEEP 12288:lJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 3aea80b5892f1a7d5da0950a489e9fa922699510ad7b7234015e586580fb24d9
- MD5 6f7b63e4e4f90faedc425e19e2283376
- SHA1 0028b0ae4142cc5b7ec8cab37f75921eae96ba11
- SHA512 16721460fe2f41fd542ee035d3a0773eb9b6fc9fa824753854675fb670f2d919d642f8c9e7caa779b117d89da53305b3346ae9e7027feaca44894184a50c22c2
- SSDEEP 12288:sJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EB4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 e9f363dd9b603a8ced6d6e33d28c6ebc1fc1c839853e224c777fdb36e1d0e4dd
- MD5 307f3e572ac6001358960c0934fa97b2
- SHA1 9a1ccf25f31a7345d1c8051c12a994c071885a02
- SHA512 40e4ab57a2cf022c49b59b70213156e3490df2198228fbef13d49ccbfbbd7b6c67d63c57455106f132bc2363aa23f2ac87b909239d58bfda3c258a44de42031d
- SSDEEP 12288:SyPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PzyIsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A655125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 dbf9cc97698fd9f523a69454b7b4a654c38d9595c7711a08cc3d648ff5091a87
- MD5 5ce6dfff0265ef197df47a13a9a355ec
- SHA1 c388a51b869d72b48fe15daec895986c280a4d25
- SHA512 e67496d91c001673181f6fdd8ce39acfa04089af3f51bd06bec162c3e87a15ddf6a830e182453bbe86da9cd848c9636c2a391b79a5a93eeb4e98ad4487d22df2
- SSDEEP 24576:GcP4mcvIjkGOxhKP2l71SNKbrh/8KBBsqjnhMgeiCl7G0nehbGZpbD:BP4m4IpOO67N8KXDmg27RnWGj
- TLSH T13865BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 4d6a4efff92ab61e767cf5117faf2f884ee53759056f8178d0e282eab8fab048
- MD5 517a72a759a43fa0c503457c82e2fbfa
- SHA1 01f0242d37196eee00f8c4662ab73e0d40238670
- SHA512 3539a0033f74d99d1284999685840f12f1c6f50ea4907e0863be89ae8ce3aa79de797101dfdbfbaafab1bf76388e6b81f549c88164b6e15d086ed8b3a45a333c
- SSDEEP 12288:VbsfZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wZsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17955015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\54336e4d60f3a3fa.bin
- Size 12KB
- SHA256 2609616293b7dfddbb9941e4958eb8a05876b5d2c0ca483f75b5bc4b2f277ea7
- MD5 c1db9af71203e8a4f76a984463ab3fbc
- SHA1 b99ec92fc2708664ccb74cd53e8f570ab3ab144e
- SHA512 e0ea04ca8691ac8344157bb8b942715e4f8b55772097b181221edde51b237aa8d45dbd931866163a6e36b8d86c3501da1f7fa6f48d36cea8b38f3077211389d5
- SSDEEP 384:2fFM24DEqVsCf9h4+3WcRVJ2ikU/Extx+D:2fa24xHX4+39VJV/At4D
- TLSH T1B342BF17262690A051F92F10C5749A4C13A2BE6DE5EA932D2BE19BBC15C20F3FF71435
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 463b3d332f2fa80c1a5f0ecbc3c6bb600b62e42205b2f8317da0d25def67c371
- MD5 1eed6f781c905b1bbf3ab9a6a54d0703
- SHA1 82a01bac40c9b45a175b87f314e1a138771272da
- SHA512 9284923636f44b5edcecff6e7b1dd600615b07bb2af5088b0e69874fad1bdefa69456913844b1c2e186d0c9331ff9526826d0e030b96b60099f9177247bf8c67
- SSDEEP 12288:25Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:25sqjnhMgeiCl7G0nehbGZpbD
- TLSH T16145237FD35C518BE57649B082E9E12D681B3E669E204483BA437CFDF6B08948F38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 3316dec54d6d8735021cd4454e4aba5a3bb0480fd0ba4c07e11fe39cb0dfe67a
- MD5 2476044ff633715c6f861f6b347b9c7b
- SHA1 9f32f931a2a0874b20e861326289b41881d846d9
- SHA512 f352818cb18ca22f9b9c1ee1592d4a63b7880e8e62fe256a9bb597a15152c80c8870fb416b1605d8cd00b346c9ee39dc6cf4f3addd26a54c77363db03404857e
- SSDEEP 12288:ZhbHjfXUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZhbHjPUsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EE55127E16AC20C9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE84D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 106f30f1b3dd222a8393007b63ce0b65c02edb9836694615ce538dd60b7857ea
- MD5 28b36d3c19d81f50a72010a54315e47e
- SHA1 b4c37c38662d80bd40c69fd5966b14f43291accd
- SHA512 0689c2c719112598c9c72c05878bb8c3d3796240242a5fdb037bb1b16ca15c9ca0efaf038c94e7a510b415b65e322c404302112b2a001a3e2e3379055fdf22d4
- SSDEEP 24576:m3YgnJcRTk4yti+R5dpR/ssqjnhMgeiCl7G0nehbGZpbD:mIgnaTk46ppR/YDmg27RnWGj
- TLSH T19E45BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 973aba2bcede927dbee83b1232fa73a44caf9afce1b45d157433f302dae6b3d7
- MD5 a54c7016b964250fadaa578d55b4f8e1
- SHA1 65fa53b3244fc93e37eff66fa3a69f93a0e75719
- SHA512 b9c0f51fe052daa2ab6a13edccbb200339ecbfc2e8b9b70c0ce1ba5407447fe0e6f25f18436e8a8b52f3189144992c3bc0ebebd00f54a2f5ac842fe3a46802a3
- SSDEEP 12288:GtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GtsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E44523BE924C51CAD93649B5C3E5E11DA8073E56AB2004D379A77CBDEBB14E84B38413
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 22c2b41df227cdaed1491700dc16f05e66c4edde4bd434a980c1d83e08b8566f
- MD5 a11396e14cf2158dae05160d50fe0998
- SHA1 b0050a9fe015415a9598105da4be71f1c105e8e2
- SHA512 4a1948ba5b80064e5b56b0a73a6c3682cfb7dd562a46df30971b34f73a3663daa6c92ab57d279fa416e13af1dbeecab4759408a9b6dd3630e78a7745ff3628d8
- SSDEEP 12288:EObfA4LWOsvAYFTKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:pbL3UTKsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14B750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 3568d03d2cfdb44659d320715abd3ccb9a4f76fa72c87663bb154c3c7b0d6bc2
- MD5 9261767630b84bf2b5b5a3e210d11551
- SHA1 6df593e382146c9d293a92f392e670d8ab77671f
- SHA512 cc2e026ae9f8508805a5a0436094abc10b9f027c367a7479ddc09d42de1cd7780569079a4bc0f1ccbc4378458075262de6acdee382bdd6fa7ec457333cd79bf0
- SSDEEP 12288:5pFtIOOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4OOsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12755022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 dcdc90cf545ba9ff5f2b6e7cc5e225bb3b111a97abb4aa9d648207d5eafd3216
- MD5 8f4a103a2aaea578dfbc05601dc13038
- SHA1 d05373e58db5759c471458c599582ee7ba30e14c
- SHA512 791d6ebe1e27663a67e67d096ff4f72e365dee85d17343331bbd1b5ea1735a85847e223b04b86d65f0077dd760e12af7f8c7b71954ced29780253e39e5502645
- SSDEEP 24576:87NM9YmZqmWMUkPjZM48Mv6bEhsJsqjnhMgeiCl7G0nehbGZpbD:87cBWMpPjN8DbEhQDmg27RnWGj
- TLSH T1FB659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 ec30e263717093c10de939a207c873c239443f0013cc9ff3966485be28254033
- MD5 7f125a136cfedffb42ca61282f19a928
- SHA1 e1b1a20e01ecfab54147bffa1caf282cb4ab6c6a
- SHA512 48b8eba1c0086b1e050d9ea1ec15962082c09e9b889b715796687b543727602397813c9355a1d6c3541516aa7fa86ed68a1986a89ab3b0baace748c5f16d9917
- SSDEEP 24576:vW6BApg2YuyuNDYTabvcRvNYf8km17sqjnhMgeiCl7G0nehbGZpbD:vF2YuHNETovcvNYf8kmtDmg27RnWGj
- TLSH T1B7857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 17ddcd35245623401a7c9bdba43d3f9864ef9f8db3276ad309ffe6432321ebae
- MD5 b954bca035ec218eb58a975f832f6252
- SHA1 824f666ee2ddc8c6c666a3c5f8d60e315cacf786
- SHA512 56d677bf1d42be41d369bcba89816dba16db683a41a146db5f3d5f2d4af87071e81917a69d96d6ad1625dfa4a89d2c156a1033c5db32cdac0bf776719bd7c726
- SSDEEP 24576:5AFs06+OmlfkNXEbToSsqjnhMgeiCl7G0nehbGZpbD:+Fs060lwXuzDmg27RnWGj
- TLSH T12D65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 d19171d8e07cccc0604dd9123fa220cf69094d2ace583f9c646459affced6c92
- MD5 e23923b323a053292ae35e24ad05d1e2
- SHA1 72bdb857dac5e99e871f442176f0db91606769eb
- SHA512 d2caffaa59a40afb83b21f914894c88be12ba38b9be70bbd3f9d558dd517213c68b6bc7e4f5cba6e81de667f8445bec84f36224afad9f5defbee9d4da8136345
- SSDEEP 24576:/JnJ5D3WtPsqjnhMgeiCl7G0nehbGZpbD:/JnJ5DGtzDmg27RnWGj
- TLSH T11F75E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 a2a07ac1cd8ac253568c8166e13efe567d634b546a8477927611f89c17da9e02
- MD5 597b742d9bc431864a6b9be2726f137d
- SHA1 abe88db3007bec38636b44e0059ffeab4948678c
- SHA512 df689cb6d3fd9ec07a0d833807ac9f4ed41d42d4349b7bb7f6d75c815a5bce71b9c937e952d283cdcad2958e182c5cff760d69b7c64281f8588a620b294a1705
- SSDEEP 24576:7EPohm6/7IIXdwcXrif7qQncjlP65i3VussqjnhMgeiCl7G0nehbGZpbD:8o06DIKdwc+eQnSt65aVJDmg27RnWGj
- TLSH T1EC955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 171b0332c488b35941ace232e7a19f82d31ffcb7d3924ea6bf931544cb89c9b6
- MD5 cd5ddc4157d05fe28e19ab6740f1784f
- SHA1 587809bfb4a44274cf3585f262a74e5522e009d0
- SHA512 13a1c4a0d900e50139b6af49094b3e275ec3beb69b909e09734b389d93a6c8f6f2ec2f7c9b38f16b5d20543c5a6969f72c021851bf0b070573edc9b9221ad1f8
- SSDEEP 12288:pEP3RrDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6rDsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19C55126E679C60DAD536907D8291C209D733F4716B2127EF26A2C57E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 72b0a6d3c231c6ab7f174bf59e028a4829f0b27b65953d27a5759a560a5a236b
- MD5 92007f23c12736e23f1de0824316a705
- SHA1 51983bba3235599464b109a27cb54c48bce96417
- SHA512 6724e39d1d206a45a407945faa0915ae7bb4730e8d4ccf807336d8f70ef160c2e168231a0b2c6e3766377cb687a705eb4620396bbaa137d04f9fd6c6de2bd17c
- SSDEEP 12288:YjkyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YIyEsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D3551219639C60C9E9760578C6B3D1589C36BC31AF2046DF6191FA3EAF72BD48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 47d76d378a0b431c61b512f0d23b7b7cc27270fae91f348d8c13842b5ee42a2a
- MD5 5d31fc146115397e92a59e1e482896e6
- SHA1 bfb6ea8f985510d73c9b4c736f49f5e346b00121
- SHA512 a4f16b64cbbd153ec73fefc9f7514d40a288bda3cd80bbad87d07da29609e271a606971130be6475d724bbf31010f789fd2025cbd815373cfe457726317d433d
- SSDEEP 12288:qF+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T16145237E525C60CAE93645B4C3A5E11D98133D766B2014E739E3FCBDEBB24D84B39812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e6eb614faaeb7b8e04990e321607d39b5e6ed3aa6c41ebd7fa2200dc76a6750a
- MD5 83f938be2d6f609190f2f4e8965eebea
- SHA1 d6fb3684a155c4eae855582bad61011c31ade179
- SHA512 84029c82610be6a519878114bbe90a5f2bddb8c2a3e443d04adf2fd72397e6a4c3593c2ae79ab348de795d6303e094da04623d5941071c1d416171a946da62ac
- SSDEEP 24576:VQ9MxZKdcz97w3RsqjnhMgeiCl7G0nehbGZpbD:VVKXlDmg27RnWGj
- TLSH T18A558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 a67ff7098a07ff90229f1cb6af536265149e0e48a8693af81c2b9930426f6794
- MD5 19565743880a80910a339f3ad8a850a9
- SHA1 85f1cf070bbfa747789dae7f3b04518c4acbb32a
- SHA512 7c21867000d05a9b0045677b4410b4b4642f0895f63ec1a9480ec612f89e4925ae40b587c243872bac9981295b891385958edcd0ffc8ca505b4b28e176a4a0f9
- SSDEEP 12288:fyoKo2HRple9pYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fyocxApYsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11765E05FB76D40E2E176813C8985C249E673B4305B2257CB6692C73D8F639E8BD38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 267d93bc6d0857d46bf28688837f35c7fd57a15566cc01bca10c52321a74c1bb
- MD5 518c145e835ef155f1381e4097f97867
- SHA1 011f997a0259c3d953c9d86053eb84a77815e7df
- SHA512 b75cb4495a9ce93a66fdb735f5e10a9b5685782f5352ad6d3a13390cc934995a06d8254a24ef053617b6bf5a0731f89e598c8173dfe06a50885e5aea43d042c3
- SSDEEP 49152:mWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKEDmg27RnWGj:w0zuNIID527BWG
- TLSH T1DBA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 1.7MB
- SHA256 ad530a94db3b631846777319c8ad4a7b040d0f74582c4269477586c71fbd2e41
- MD5 defb6d73dc364e3639e9a989b0b676f2
- SHA1 7c0dbe120e4d17bc0800c172914730fb02eb5a42
- SHA512 d1d2ccd6ad64d528963a7af5be785d53564cbf23e11d5ceec46eecf204145eef8cf97506b7ce0f7d544f172f592ba64d9cb6e04eca30ededf87fc5ef481810af
- SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQTDmg27RnWGj:Za0hNYG4JwsD527BWG
- TLSH T1D285AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 44f7796e0320984e07336109a3c6de96a6e7bff47b3df60f269db503eae27550
- MD5 d72812db38c0f7e073390c62f6c78473
- SHA1 32e4f32dd75e45d69248701eeb9dbc38d7490091
- SHA512 89027515f7448a2b150ed1c0158b4a13dccbd3db8bbe6e4efc95a18e28f94ecc14ab8ee10f83b64cbe29d41e49268dcc5ca4205788f5e347a3847c89182af4c2
- SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYujMqbDsqjnhMgeiCl7G0nehbGZpbD:PTDxR+N5YzT4jMCDmg27RnWGj
- TLSH T11155B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 a2840b1234226fb182109f92f35bc971b7044a87b8f4e4a4b734c3cd086add49
- MD5 b16dece731104f424b4d35934aea3890
- SHA1 aca80939977b00df955873cef97132814d4f608c
- SHA512 6c452c6ab64abac68ed4870042abe4a26aaf1d28a13b6b56daff04a9e6ad5ecfc54f6262726cfe9331108392521d10b962484c03fd5818310b14f324c718fa8f
- SSDEEP 24576:5TMdOz0FFS+bmSL3sqjnhMgeiCl7G0nehbGZpbD:T0K+bmSLLDmg27RnWGj
- TLSH T1B475E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 1c78db7b4a5ab0eae81ff51ff81f7740bb2097684f9f7daf4f8299460408a8bb
- MD5 e31ed00797d5ffe599c3402970759c5b
- SHA1 c9d9b413f07f87a8631b28b27e9089f19e98c587
- SHA512 0a71927123e397b9e2786df7750e8e1781a91d0a7ef24ab6de8b66dff3c902b05031fce8d6a5756af2e6385eabf097327f31891da0cb62041229e23d922758f3
- SSDEEP 12288:r47KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eKsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14155126E63EC30D9E4325574C2B6D1199432BC36272015FF39E1D9BE9F729D88A38B12
- MD5 SHA1 SHA512 SSDEEP TLSH