Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 02:09
Static task
static1
1 signatures
General
- Target 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe
- Size 4.2MB
- Sample260930-ck4yracd47
- SHA256 40080b79d10c25c082e71c817a0ef0fd6e21070ba68d58f380cd763578eb6ed6
- MD5 459b78a8dcdbedbd0e460c65dff40c33
- SHA1 2086caaade7d4cb3b7bfd8cf90ca671c622937a7
- SHA512 4cd8031400e7167213ee2e2f6133add07cc8e307a1af2ceea01f1cbeff9328b5d6e8ab88ff4326a3a606eacb1d09cb211f9013bec5113235860831b8d7fc4514
- SSDEEP 49152:JaXZuzzO4cg/qNB+6+6h/Lka8IseawMrOKa259H+hxSMmT8oWgBCaXRyMRYmJzxD:jpjXEseanLe+M4FHXYYbJzl8l+M4FHX
- TLSH T1D526D06EAE9902ECD477C178C9524507EBB27C0543616ADF0EA07676EF37AE05A3E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource behavioral1/files/0x00080000000245ce-615.dat behavioral1/files/0x000800000002422a-618.dat behavioral1/files/0x00080000000242bd-620.dat - Executes dropped EXE 22 IoCs
pid Process 3824 alg.exe 3336 DiagnosticsHub.StandardCollector.Service.exe 2760 fxssvc.exe 4724 elevation_service.exe 3392 elevation_service.exe 204 maintenanceservice.exe 952 msdtc.exe 388 OSE.EXE 432 PerceptionSimulationService.exe 60 perfhost.exe 3104 locator.exe 4288 SensorDataService.exe 4360 snmptrap.exe 4104 spectrum.exe 3328 ssh-agent.exe 1772 TieringEngineService.exe 3872 AgentService.exe 4232 vds.exe 2292 vssvc.exe 4264 wbengine.exe 3760 WmiApSrv.exe 4308 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe \??\F:\ alg.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7c277e1b862f6ed0.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe -
resource yara_rule behavioral1/files/0x0001000000017046-630.dat upx behavioral1/files/0x000100000001742a-631.dat upx behavioral1/files/0x000100000000c53b-633.dat upx behavioral1/files/0x000100000001780f-635.dat upx behavioral1/files/0x00010000000233fd-632.dat upx behavioral1/files/0x000100000001678e-637.dat upx behavioral1/files/0x0001000000017032-636.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e388cca8050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a216bc78050dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005307f3c78050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000076425c58050dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbdbeec98050dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeAuditPrivilege 2760 fxssvc.exe Token: SeRestorePrivilege 1772 TieringEngineService.exe Token: SeManageVolumePrivilege 1772 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3872 AgentService.exe Token: SeBackupPrivilege 2292 vssvc.exe Token: SeRestorePrivilege 2292 vssvc.exe Token: SeAuditPrivilege 2292 vssvc.exe Token: SeBackupPrivilege 4264 wbengine.exe Token: SeRestorePrivilege 4264 wbengine.exe Token: SeSecurityPrivilege 4264 wbengine.exe Token: 33 4308 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4308 SearchIndexer.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3820 2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe Token: SeDebugPrivilege 3824 alg.exe Token: SeDebugPrivilege 3824 alg.exe Token: SeDebugPrivilege 3824 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4308 wrote to memory of 3884 4308 SearchIndexer.exe 115 PID 4308 wrote to memory of 4620 4308 SearchIndexer.exe 116 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3336
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1192
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4724
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3392
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:204
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:952
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:388
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:432
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:60
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3104
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4288
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4360
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4104
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4912
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4232
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3760
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3884
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4620
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4fa622c50f122412f84bdf6e9ddda0dda93c91338cb1040e74556559a5a15cb8
- MD5 35f6200c996024e4d8f4ea1d26664a69
- SHA1 873372c03162a36f4d3454ec17369bae52a7478f
- SHA512 aa350e0bc715d1064d3e4cd6521caec50b88617cbb8b93a5d0ba7ddb55eb3e494d53730d96d34d30a5af68978eee7e87f370e91f30076a3739cb5f7eb7a9e340
- SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnghxSMmT8oWgBCaX:/3q6HjB1+M4FHX
- TLSH T14DD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.4MB
- SHA256 d186d0107d2812c034107cd6e388a2c9eefc04ab24308e04793318dae3c922f5
- MD5 5b7633c9061e66f7eda8e1331df16a2b
- SHA1 ae92a3b8a8397e18a399dc0e91d3946a99607a97
- SHA512 5641f0392c953f9a3d78139e31ed6f07715f63ecbb3117d53e40faf08f1fcee2f82e296743f74d943e16585d2295d1e32e88b510c46531c525cb43bbdf00910d
- SSDEEP 24576:pXY1O/czA+rKhxr+EHNmT8oW4ll1JCrLKXIgvM3yReRdqmCAzxj884:j/cChxSMmT8oWgBCaXQyMRYmJzxj8Z
- TLSH T12BC51239B7D504F9ED67823DC9A28612EA737C5943A0FB8B03A495291F333985D3E742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 de02412d2f3bc731daae2a1cfa42224a22cfbe9a36a1e007770c12865a11e2b8
- MD5 e081ffe18287572ba49aacef8e5eb788
- SHA1 61e58a1efe534dfea3bcfe90d255132ae95efc30
- SHA512 390ddd756bcb4b22539ab3f4b67bc73d3750b0628d22f2260ca0b558ba1eb6d7df06503870ad6df32cbfefbaabb3c1e944b800a34593db892d56bcb68a019fa9
- SSDEEP 24576:OXYfDtczA+rKhxr+EHNmT8oW4ll1JCrLKXI:NtcChxSMmT8oWgBCaX
- TLSH T17D85012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 9be6bef7edf59fdc55c04bd41c44058d5e1d164e271ed6045b2131e27aa56414
- MD5 98887f822940edc5ab1ae2827a0b87ec
- SHA1 fcdaf2a8f30d9ace405376972ba16cb556f979cf
- SHA512 38ab22f01cb25fc5493773c24691ba8bc7df4a09eaa27c03da5fa0abc50a84a7d132b5de54f9193cf5a0755d60024f92c529a73e15cb1a17149d6184797dce6f
- SSDEEP 24576:ewuSOWArKhxr+EHNmT8oW4ll1JCrLKXI:ew9OqhxSMmT8oWgBCaX
- TLSH T12A85F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 37972d957dcd6e7c77ba88508cfd11ec08c93bcb147140d4a56273f3dac6bb8f
- MD5 f3d09378ad4c388caa891aceb3d55ebc
- SHA1 ff4320d83589ab9ff2e463d4bf423d7052ba33eb
- SHA512 f13020d58b96383e3d81cc922b650aae4aee18a06192a8f52d8cafb0392b7cd28fea7125a09d8582409d08951af67342bb8225cfc255acd7c5a21c46d6367e5b
- SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRhxSMmT8oWgBCaX:ju6JmVxd2dR+M4FHX
- TLSH T1D0D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 2.2MB
- SHA256 6290f7dc3c4caa93d427624141ceb93c879a4dd8ee9651a6eb8a8687829da34e
- MD5 4ba014ab56e0a4b91a5b1e4f0e568e3e
- SHA1 a7d152bb54a42ea33473e01d45752c612256eb71
- SHA512 1d1c5bd257c63a5908f4f3e8e47a18751e4eff6e1875aefe138a63e5a218788744f5311e37ba5f5c5a101d468dc51489b34afe0f5081db6534857a3cd46968b0
- SSDEEP 49152:1P4m4IpOO67/8KihxSMmT8oWgBCaXJyMRYmJzxj8Z:bppOOiM+M4FHXgYbJzl8
- TLSH T1A0B5D02DABDC0096D0BA913485658A4AFAB1742E2F3296CF1160933C7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SearchSkip.docm
- Size 778KB
- SHA256 bcc91f87dd27770ba8d6f9ec7e3e3559fbd91492ac8ddc45702006489df598a4
- MD5 ed1704146878906fe1679437cd284ce7
- SHA1 c6ca43eb12fe405fe8b3271ac7edbf82e2838159
- SHA512 23c9d2f0f70a76dc5e87bb70cb46ef0f9adf314a274df4b7427fea4e6373677b05a20643514ad96daa7e0eb2f58954839c6efc744e09b1e9b5085724f273206f
- SSDEEP 12288:+FhV1UDR+YiNU0fumqVjf+TpFAS6ago0xokFbDZ3nw8N1L5N1JxCL:+FfaNubzTpSBago0akJDZgQdJxe
- TLSH T1AC05236FA186267CEFB34C3D75B6A6E9CDDB010A721894D34C1273849DFE0A52473B49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\SubmitComplete.docm
- Size 773KB
- SHA256 4ccbef886f1e07761c53582cc27b7e64e34ad29a3ad8ac959d9d849d23ff0eb1
- MD5 fc5647dac2eaa8f2a6d59758172fee44
- SHA1 8d9098436128855a87abc281dad994ba2b1e8900
- SHA512 8ab3a505812912bfb2b30f0c593355e4146a4bfa79c422525fb9768fc992a1d5f95da4bd7416698bc13f383b6d223aa88d5b1a80aa6064340b2844a18da2cd13
- SSDEEP 12288:/KcG3a0+AvRpiEERqQr95cC/KQ5kVFqm7LGV2tsUSkjQa2S2Pw7+lQykDLzUu:/K9oqQr9iWKckVlU8sUSuQnSCZuPXzUu
- TLSH T1B3F4235409CB02E2F1EE4B30DC61A1D7AAE526DA4351C73B663223457F8A77EC34E99C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\TraceUnpublish.docm
- Size 778KB
- SHA256 60f028c7d5e89ea323fd1f71ca718e436e4acfee8ec9613c7bef4074c4d1098a
- MD5 7be9c07847aaab82a0cdae59a028c094
- SHA1 4ebe663bea48e04770b24feeb5a5e4af4b533551
- SHA512 30528523d1b3791d6e33faa69befa0a8e80b1cedeae432054d6b9d713a2a0e6126ad4cfc7ee1a582fb4740a489e9a94268b4344f61ea2215c1b16aadc6a66a69
- SSDEEP 24576:qea9Qr9liackD5MDal5g1C7d1Lrs3yZMRdpL:qeJPiacUGMq1EHA3yiRdJ
- TLSH T18C0523980F9960D6F21B17340B7491491A6B136F5323D6F27B3373821FEA0AAAF15B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 2c5a62dd2481ed16d9ffa798ed9c9c9efc4e050c92ab01225cf263a56a1cb088
- MD5 b244680b313a3a5d88d96e22d78ccfe8
- SHA1 6c0893ebe8deebc77433c130c1b59247566d0688
- SHA512 a1baa2dcc7a027637f5835bad72e252dec207993e7075b0e1cd477a62b093be28fecdaf2df77c3149e199e28e93477c025936638567b22ff7a3916aa39666c26
- SSDEEP 12288:knJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXI:kJrKhxr+EHNmT8oW4ll1JCrLKXII
- TLSH T1196523369B0E985BED3B8334E8228335695D2DACE300556FFF2E2B6C3930C565D62712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 72b55c20648fb0f77b744b07a1a570e2ab35fc856794fdbfc37a29aadebc029d
- MD5 48984eff3374b8d26d9670f9636df6bf
- SHA1 03342c56ffb891ce01f08ddda9387436d10c5e36
- SHA512 a4b63dfb7349d983b9635913f0f731a9562844d7f0d13c1817ce95ab054d5c8334cb8947ef86892efd5c7db80e283d722109bb393e06f03ff7ab17bc66fadac6
- SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQ2hxSMmT8oWgBCaX:Oa0hNYG4Jwf+M4FHX
- TLSH T1AB85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 8f477141b54561ef23462f10a4bb8cdb6f1c3fcf7716879ee3caea5c8333bace
- MD5 a5e30a8860332c956d27cc20ff771a5b
- SHA1 5d44802be82a9f8270bfa850e731b0135d6ada6c
- SHA512 c3f1e7b3b1f2f64024cb1caa42061615ca14d102dbd993c93cd76c1d9e9d1133ad56643b7ccfd51e463d2fdd3c967cf286ea6f881e952178320b903588e0cf03
- SSDEEP 24576:LhbHjP4rKhxr+EHNmT8oW4ll1JCrLKXI:LhbHjDhxSMmT8oWgBCaX
- TLSH T14E75017E279D20DAE932D23CD9528606C771BC691311A3EF27A682781F37DE91C35B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 2f701e8d7241fb50670da4f0ff7846ad53de2e810e19f8cdf458a4dc98a1aaa1
- MD5 4cbab1136b5b47381575cf5e3f16acfb
- SHA1 1194056e801ec426a42616e2428eb349ae822157
- SHA512 c7beef410d019d07776c3a2bdb0ad512158a939566651175d42ab50eb78b1abe8a7cf6cf99afb7c47ac24fb8bd27102c2c263994d8140f4826eac04e938d0dbd
- SSDEEP 24576:63YgnJcRTk4yti+R5dpR/ArKhxr+EHNmT8oW4ll1JCrLKXI:6IgnaTk46ppR/zhxSMmT8oWgBCaX
- TLSH T15D45BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 0cbd79b112d2b1c54e171a59eb3e0af25072b8b1dd04d064fc18f62138a2d590
- MD5 43f404436284ae4a35afb0bf80a4d013
- SHA1 c01b1acc750c297d205f3163256b11233e92f4f3
- SHA512 4982a7f5813bfb68e1b30718085d174d283b3cd4fde27a0d2f3b5fc49efa38dc1e0c56655ffaadf49fefafea882e0f83c1168e30c27a3dfaeda7207908be3ce5
- SSDEEP 12288:0jJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:0lrKhxr+EHNmT8oW4ll1JCrLKXI
- TLSH T1DB6523755B0E649BDD3AC339E822472599880D9CE30117FBAE3E2E683B31CDB1572211
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 5564138580490459647ebab4ab0ade4731ad4498004e4700cb22ef6956915e23
- MD5 cc4b1a454f45c69624252fb4b01b46d9
- SHA1 38bb229124f4a05e9e5cda8ff939ecda189f5c1f
- SHA512 79552c4798e24905e56a2e915c6ea1ac932ce9b9f63752720ea2d04870171012a79c083d41fba0b0360f5d4e769f8feff8486d5fe0ed43c9c30669eb3310ec0e
- SSDEEP 24576:YfL3UT+rKhxr+EHNmT8oW4ll1JCrLKXI:YfL3UdhxSMmT8oWgBCaX
- TLSH T1CD95F155E79500F9ED7BC23CC9628A16E6B2789D0360E7EF07684B651F236E24E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 70e3462485c855db1278052db577da7dc96de3dc1257936fae62fd82ed226ae9
- MD5 7291d82a07b8f0225ba22e30d174dd9b
- SHA1 0c283a4f921f925ae75e287b5e2c4c1703848486
- SHA512 be4858bd11215642905b8946c626e98508c128f25ee3b1a00367d049ff608e093b86756849005b7fdc6a09b25b112b9ae8fe15c4ae06f4a2c2ff96e805a7f035
- SSDEEP 12288:xpFtfOaJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:nOqrKhxr+EHNmT8oW4ll1JCrLKXI
- TLSH T110751229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 d67cb1e1f8e8ce551807b125d49d619d22fac7164815af134437f85d04476404
- MD5 a7cf999dc8c6f3007e2323414f186fdc
- SHA1 3d8e0ac5d980b78132bad2cb5dd2cd95b5f1725d
- SHA512 6d29f0504d3dbfcf5f7c342a8c85922df3c04fac2e789852a0b89f456e00d380e9376df31cb171f0166608519f1eda6e216529f95a5c837c19b1b20d96edd7da
- SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhs5rKhxr+EHNmT8oW4ll1JCrLKXI:g7cBWMpPjN8DbEhrhxSMmT8oWgBCaX
- TLSH T10C659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 bcfbd111ec2893f12dada742721c630cbe2ee6f57acc5f4eedaaa10d45042131
- MD5 640008cdf76ca2e07c5af0b426a841e2
- SHA1 ae2dbde67f54320ce779fc1cf278900c5fd466f6
- SHA512 e2d780706cc1ee49f646fa22c4103b570d9010bb04264f99ec14eee7d9458440fe813a4d1eb526ca4f1d7d341adcab5f9e0a20fcae8e13e889bba8418807e027
- SSDEEP 49152:aF2YuHNETovcvNYf8kmghxSMmT8oWgBCaX:T6tCf8k9+M4FHX
- TLSH T1B1858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 cf409cf756e73312436bd6351bcc951b26db273c70b5ae8efd7ea69dc9739fcd
- MD5 d77f309c1d460d1f5a4850d18d6088a0
- SHA1 33f9da6e37e842e42803ed52857ba1c45104cdf8
- SHA512 3f82d64802c0f3102ddae1d442a5b8ca6e909a04f53560e03c84da9160f38c3c7ff0f1fb92858c1a3311b576f4e77c23dcb85a194d0f3cefc67099bbc88d5ca4
- SSDEEP 24576:PAFs06+Omlf3NXEbTo2rKhxr+EHNmT8oW4ll1JCrLKXI:YFs060lVXuWhxSMmT8oWgBCaX
- TLSH T1C165AF3F66AC00D5D47ED17E8997C91AF6B1746703215ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 c16cf00986144e249c075aa29118bc8f673cf30411b7f964f7f50799ec7eba8d
- MD5 0a5705a4d3a41fd476bcbf7e426e6068
- SHA1 45b93cc24bf4219e7666365671077d24726a0088
- SHA512 b47c9be556f5ab559a0edf335832342bae16a911b833c51e2c99c550c125fd3490877940467ae210561459cbceb7425828b6e62d96f6655b020551ed2cf2501f
- SSDEEP 24576:2JnJ5D3WLXrKhxr+EHNmT8oW4ll1JCrLKXI:2JnJ5DGLWhxSMmT8oWgBCaX
- TLSH T13585D03DD2A810E8D4B7C374815A1756FE72387D2B226ACB2874D5353F12EE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 b172fba89011dd2a86219e8299eaf68e9c118c5caee3bfb6ac8dc4ef2912a464
- MD5 8cb2f9dc1c859e6cbf27b3d9a47415c9
- SHA1 413e2920367411a7ddad4e7e57b5f57377471f2d
- SHA512 40b260517ca7c8ca926921f9f915fecf22640048c0379bc16a2a4636ca36a9fe69e69253cc88b703e1328fd43426b2f7f5223bcc6cbf0295e42c8e7e9aa150ad
- SSDEEP 49152:Vo06DIKdwc+eQnSt65aVkhxSMmT8oWgBCaX:C6+M4FHX
- TLSH T19B956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 1fccd8cd6639b8d25b843a33c1ef213824df1bd98f43b0491019b8caa834c67b
- MD5 4cddcfa54ee3ee0ba3d1632d6960c7e5
- SHA1 d2f917d550f15438cdfe44aea99dad660ba19051
- SHA512 61dcdb4ccc1629e1541a37808777248e208c317378f5dcefd08a7fbcd82ca215b901a72dd07500376e435ad3136b2bb1eef458107b276399cecbdafc4f8263fe
- SSDEEP 12288:HEP3RBtJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MBjrKhxr+EHNmT8oW4ll1JCrLKXI
- TLSH T17375126D2B5D70EAD92A813DD4A18605D3B2F478631227FF5AA5823D4F33DE92D39B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 59c50f4f3a55ec15c89b0eb0940e857377c950204ade2d2a30e21cd7531d5c20
- MD5 237679a0b8b942b46cf75878dd921722
- SHA1 f1e8392bbf99da966d53789a5574ecffe20827fd
- SHA512 ad280bbb8e23c6c1dddc6ef89d00b47c6b727668473fada14f348620f8b97445ea659bc9c09f5718e833c2d50b6cdb32d03c1a9e739d66105394a7d8d6bd5b1a
- SSDEEP 12288:HjkycJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:HIyIrKhxr+EHNmT8oW4ll1JCrLKXI
- TLSH T170751218638860D9ED7A4338D97342619E747C24AB1157EFA9A0FB3D6F32ED46C31B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 76e58a91abe7f87fd35166026337aa6c4fb70cd75dffd6f6452681f577905aae
- MD5 d64fe6a1bc2412505f43e15048fb553e
- SHA1 a9ad371b255f65a1498a64ed29f27205e5edda9f
- SHA512 6d708fcac3dc6059b8ea327187f88e97a682f7d51a1df8742638b3b55e6b9ccb2a9ee3a9091397d6224394c8576154fee6e073eea7e06356841668f7cfa5892a
- SSDEEP 12288:GrKJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:K6rKhxr+EHNmT8oW4ll1JCrLKXI
- TLSH T1F965237C5B0F749FED268338D932471195A82DBCA30125FF5EB9AE786B31CC61172A01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 3ae5a05fcac08259ba7b0bb7e22265c0e5548717e49ac1d8b5d85dc2a936eb22
- MD5 85512b2578c417d421523b08967878db
- SHA1 faa1095f88b5671870c9b52dc8c2e07fb2ed6481
- SHA512 1af257e1a1c9025ac00fd94bbec274f0cf844512e4e4d30b858f8588d048d26e6d3d3c1588129c5da532be77751efce5a53e9b0b911ef50e0e372ea6f43c9231
- SSDEEP 24576:3Q9MxZKdcz97w3RrKhxr+EHNmT8oW4ll1JCrLKXI:3VKX4hxSMmT8oWgBCaX
- TLSH T1FA558C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 bbb3f67984d55890bbecdcd96f88a8f4b5a67edc0afb867792862a58727d9492
- MD5 e874342771c432fc6d1a88e49e214da6
- SHA1 9895fe1245303c3537e7f3555c27a1a4c325e9d5
- SHA512 961a668561e9e5e970986f710874a8d3ee699ec2c28b1145f427488779f73f41ffa9832c4544a64477485b8baaab7bc4f82b12d725d85b93a0223daeac874b1c
- SSDEEP 24576:wyocbApErKhxr+EHNmT8oW4ll1JCrLKXI:9ocbAp3hxSMmT8oWgBCaX
- TLSH T1FB85EF1FBB6E40A2E136823CC9818305E7B3B4745B6267DB6691C73D4E239E9BD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 ccc76bcd92b99ffd4f7e0106ca68e0a117671b24392fed965859a3e9b523da38
- MD5 376a2852c2242be4bf3174647c3c96a9
- SHA1 57f02ce134cbf717b2164d068627ceefc67f99a9
- SHA512 d33f7eb99f378880f7345d8be8e57d47e57208545405b4277a3e78ba6c6418c5f2576b443ea9de74095d7a38817d45af96eb703e45d31c9bc8f8fc8c857524d3
- SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK3hxSMmT8oWgBCaX:e0zuNIj+M4FHX
- TLSH T171A57B3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.5MB
- SHA256 604c2ed3aa949e77f750a0197f41063f7ae40724748afa0f9cb9735a8cac91e3
- MD5 9729cc0f430296603eefd34dfe130bde
- SHA1 c78080c1a62a93e80a1fc200c5ab8761e8384e86
- SHA512 7a90d6c46493a70a3fe5f4fec98c4e97790b1bce9cf87548eb1aed9eb2c97d9662f5acc9ab23526da7616d4d3ad68308b50227d9ec5275b1154c1883753d057e
- SSDEEP 49152:3a0h2GEkuAe73q3ppj6zwwQ2hxSMmT8oWgBCaXzyMRYmJzxj8Z:3a0hNYGjJwf+M4FHXOYbJzl8
- TLSH T13CC5D01E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 2.0MB
- SHA256 823ce9448c71a6b6f07f9c5b61c78352ca00b8b19e0a6e970ba1617783479041
- MD5 c811bc7561f6fd8ff29a43487e4751f7
- SHA1 1086a1ba8e72efa5ec92a0b8cad66aa73ea1fd8e
- SHA512 6ff08827d3f386b9dfe8038278de4c42c2391f583276b921e3758ba3cbc0f68c31723e55eccfeb615c694d2a87f3d523e881494b69391476522443f6306fa63c
- SSDEEP 49152:nTDxR+N5YzTljMdhxSMmT8oWgBCaX+yMRYmJzxj8Z:3u5p+M4FHX7YbJzl8
- TLSH T15AA5E12EA7F915E9D1BEC5799A238512FA727821033193CF42A0C17E1E379D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 2.5MB
- SHA256 40d4775268c7663bdedb04bc94a9a2211ef3604293c5ff7e52ce267a01e8605f
- MD5 001827a3726e4b384e68fad5fbaafa5f
- SHA1 90275fe7c01b0ff47bfc001cc1832fd608b21e2c
- SHA512 84409ed641b22f107294d8149b386b2f78bad698c7b483b62997c93083d97fbccf1e7387d5f220aad97436587daca0c45d10e218063a245616341fe83ea87f6a
- SSDEEP 49152:Q0K+LmSLOhxSMmT8oWgBCaXIyMRYmJzxj8Z:Pe+M4FHXZYbJzl8
- TLSH T1BDC5123EA75D14E5E57AC23DD6438A07E67238660322BADB0690C17D3F67EE43939B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\fxssvc.exe
- Size 1.9MB
- SHA256 543327ae903c92a2e00b5ffd446b12c2b46bce9a987090aa57e1293c500b5c6f
- MD5 40779e96bb030a5f1393e37558094f63
- SHA1 9807bb69e0baa0ba0500dfcfb6c60b958baa6f2c
- SHA512 beec53333d7e970581976ee1f150558e8c3c66b293806cee9e0cbeb3ca0d752fefbbfb769a4b044d4e0dde7ac6112719d1a6ff44144e993e90f1456fc5ebe68a
- SSDEEP 49152:KBgnaTk46pqR/zhxSMmT8oWgBCaXEyMRYmJzxj8Z:KKi+M4FHXVYbJzl8
- TLSH T1B395E12EF3B910B9D8A6D236850147B5FB71782D1F209ACB0170C538AF16EE85E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 2.2MB
- SHA256 4fbabaf4557cdb79b90f6d66bb5899a0f9fbb09b9881b3b0a0a0274a47f5778d
- MD5 299b9cb5ca29c796681e7d525b57e581
- SHA1 9d180aca5425d406215ad63c3b95b12040b3e05f
- SHA512 ddd12af5f54b7211dd65bc996f2358840d2b19cef342de4811c923e1eba5064aac61215f8469fc45858be7986bcccc4f8a07e518f16c827fa38f5a216f32144c
- SSDEEP 24576:o+rKhxr+EHNmT8oW4ll1JCrLKXIQvM3yReRdqmCAzxj884:oBhxSMmT8oWgBCaX8yMRYmJzxj8Z
- TLSH T19DB5232DA7D83099F9329234D6220657CA70BC7E6351ABEF39A4E17D6F33AD55831302
- MD5 SHA1 SHA512 SSDEEP TLSH