910fe5acc0769f02c12ef6809bbe18bc770f077058611b925bf45768dff5f3a7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.5MB
Sample261110-3fbdracd48
SHA256 910fe5acc0769f02c12ef6809bbe18bc770f077058611b925bf45768dff5f3a7
MD5 2fe602a40b2aaac80a23b47fc7d4c45a
SHA1 549e026441f66854be3680e6b396276c03ab41fc
SHA512 0e9e63969f7afb40194706f8827432ca522045706b9c55ca7d1221a31d22afcdb8efee38fccef8448df347872d56401c0a6b37911f001ccb0c179f47b8d421a9
SSDEEP 49152:/hA6yeRc8pSXQWL6uLenMQQJbSOgMw+rUne9LWZdul9mZaij4Dy64X9/0Fx2Wd21:ZtgXJDNhW6+mgRPH7wRGpj3
TLSH
T1AE26390673F90399F1F7967896766606D972BC199B20D7CF02A0915A0E33BE08D7A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4964	alg.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
4020	fxssvc.exe
5320	elevation_service.exe
2368	elevation_service.exe
1408	maintenanceservice.exe
3508	msdtc.exe
6060	OSE.EXE
3356	PerceptionSimulationService.exe
2188	perfhost.exe
4100	locator.exe
5748	SensorDataService.exe
1216	snmptrap.exe
5212	spectrum.exe
4480	ssh-agent.exe
5152	TieringEngineService.exe
3104	AgentService.exe
4500	vds.exe
4184	vssvc.exe
4580	wbengine.exe
2504	WmiApSrv.exe
1672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5e569e44bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5af390d6b71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044cd190e6b71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7d1db0d6b71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d73ee60c6b71dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a141d0d6b71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c4e370d6b71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
3488	DiagnosticsHub.StandardCollector.Service.exe
3488	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4020	fxssvc.exe
Token: SeRestorePrivilege	5152	TieringEngineService.exe
Token: SeManageVolumePrivilege	5152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3104	AgentService.exe
Token: SeBackupPrivilege	4184	vssvc.exe
Token: SeRestorePrivilege	4184	vssvc.exe
Token: SeAuditPrivilege	4184	vssvc.exe
Token: SeBackupPrivilege	4580	wbengine.exe
Token: SeRestorePrivilege	4580	wbengine.exe
Token: SeSecurityPrivilege	4580	wbengine.exe
Token: 33	1672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1672	SearchIndexer.exe
Token: SeDebugPrivilege	1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1372	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3488	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3232	1672	SearchIndexer.exe	112
PID 1672 wrote to memory of 5792	1672	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2760

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3508

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5748

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1216

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1120

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2504

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3232
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e2639fcf6e99082fd36f5b42bfe1730165eaf80edd78fa14c6812cf480906a1b
MD5 c97eaeedfc90950f3e381e47d2e487c0
SHA1 ba6b5f167707d03c6f2b7a3a50745ff0768af65b
SHA512 7feef313ff88e5ac79868831d5d7d29fd84554656339f887cc3c8d1c2f50130b11cc33152f270e52b2797e78bd1190a9c99f3c3d7bc8a051c9bc25ef4682bfa4
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnxLNiXicJFFRGNzj3:r3q6mjBq7wRGpj3
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7ecdfedab5b1fd805c8095f6dc5ff8543ab8bc78e11ebe67a0f82cb9866fecab
MD5 8ff9f6bced43e539643e9f4965e5b711
SHA1 a15f523a2e25edbed360d6726972eca45c4b87c0
SHA512 ae6258c2ae576d9c8ef4344f472137ee559e309e71f829e1cf9572f29de6115fe0b1202adc7469ba7591ad18eea481e99c229f6fd1763160de5b453a2f613ab8
SSDEEP 24576:WXYfDtczA+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VtcvLNiXicJFFRGNzj3
TLSH
T1D975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 900eeee76ae90791f5b12b300e5aaa93b71aea74328699bef5df151f237ac386
MD5 5ade2a44196968f35127003d886aca01
SHA1 07d0fb5b031ec7cbcba389a40d425baaec567e7b
SHA512 e71f72d5dc15df7ac15bea5de7e8b8961a444ff1118171845ceb797ba896d4e2b9f88253b96639823cf3b046cbe4cae16c5b2e6d28ae1cc7a0e0da36cec6ee49
SSDEEP 24576:Q0Le5ji0hmxhrMJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QPji0AzQLNiXicJFFRGNzj3
TLSH
T197859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f115a625fc3c5797329403c4a8061b407a7c035cab2ee979a165fd37d8ada3cb
MD5 45e424eaf81814d93d553172fef9d767
SHA1 4c170373c0d455e5d01a39c6e05f780036a50bd6
SHA512 aec0fca7182100c44c23ec25b653e8d33b423cb1146217b271ed22b918294ee45b93ac068be8253bdcbab0e93c3b34011703226aa84805ae99566e7e5a2e7713
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWj6q8wyu//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v/ezSC6vUzPv+HjyULNiXicJFFRGNzj3
TLSH
T1E6756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ce01a9304197649d4bebece48e1291ad98105666e273d71b67eab8e8efc723fb
MD5 806d7d2bd81e7a3742d63292acbd7005
SHA1 e64665cd95dca015a23941f739149d2d4f6eb126
SHA512 c7d08842cd859a1e534a64d8ea0bcdf4dfe54fc8829f968971bef5e14237c6bc0e3316565d2be295cd496b9f92f2fa12d50668ea2c477d86df1eacb469ca3902
SSDEEP 24576:wVbqPb88hv/l+B6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wVO88hXl+wLNiXicJFFRGNzj3
TLSH
T11F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 42f45897f9d6fda8928b39367b542246243fba93d224eccdfb4b952a21861aba
MD5 7f39c7a179028f8fbc1d16ba10b9b19d
SHA1 d0718c4d399f791003df7c040d62e6082adb8e04
SHA512 66a5dcc338d97ecce800e473b558dcd30dc779125c78490c0fb6704134edc0ffa567bce17950a1fa2d76f6e5fc5b381b490f80b616901c2daabe5c3ea544c3f6
SSDEEP 24576:oG1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BLNiXicJFFRGNzj3
TLSH
T1BC5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 5c05901687b681878bcadb2e8f04916d09f993d6d9b57da328cd9fbf4a03bfc6
MD5 eaa92b2232666b5a007fecb777020848
SHA1 f79b8ed17d2c8bbbbf84196745f8f0598763b5d3
SHA512 e938657c3d56e8e50b935851a02d0d299c8705fe7e2081178b5ca518169b85aaddf878d9b531e46e8621380f7fff276221976936c8a887d0708380020ced7ff4
SSDEEP 24576:+JIUy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+JIUyLNiXicJFFRGNzj3
TLSH
T1A775CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c638828e9db6520d3e8e8d2a357a211624066908e77eadd23c81d08846525b02
MD5 7764a005a6dcc419b8ddbe704fe1092f
SHA1 b50ea3c400a80f2b05705760c0ee2726d1fa2a02
SHA512 64e165e64389d7864afebfd532c8898675efcb87f825b06f3a6758bddeb20990d3c63215fb7729cfd7a2ab6c339ae7a2e817b24e4ca3e673d753dac0c8210aa7
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THM:LQvGAdlCEL8c/WRNw5CP7wRGpj3
TLSH
T107266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6b2d78fdc548a5ae8212ee70e3a17abfa783917cd4c5a4d8ac8134b1a8e13c22
MD5 765f690f910e73aad92d4364c94225f2
SHA1 ed3391718327685d6982da2ac6613f66fd381673
SHA512 b3d3fa6737b9ca2fc6c045f0f6899df297a63d9f1162dd3a5149252e5b63d3952bfb3f3047df7825b393f4a0645d87c9f3216d71777e21085fe4fca1e7377dd1
SSDEEP 24576:mfewsAjg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UljgLNiXicJFFRGNzj3
TLSH
T1E575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0aefe96a93ebe5c788ac5fb68efd5b852edf4ce5b2779ae5969466d907c5fad8
MD5 1110354cfe90d9277c773a32cffb68ab
SHA1 2136b3c91199e894bf1f454cf4168d62112302fd
SHA512 843690f9212798fe373d068cfa0cd8485823b5723e309275cf4487efcc530a96e8c136de8a6bece5483c460075ee6a7de7feb2e081320b9102e3b60a036bddea
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHUF9:bUEtQevvqc2W1cpV20I32I9
TLSH
T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02fdb1e6ea3ba91975d16172c1734767122b4ad2b209ae87d253dce9601b3d7a
MD5 4e9485841af6cbdc839f04b097c54174
SHA1 5a24eb5049fc882cacc3e9e1f03f57111e1cd34b
SHA512 d0d1fc4db2844894412f72281bc77085740c281aef0b83c907db36a77ce734fd98fce8e8763edd0e126201177ab97a482cf8aabd224b126a67caa04bc50e178b
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/zALNiXicJFFRGNzj3:Noq2Vjnmj7wRGpj3
TLSH
T168D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7f24f0f63d185f44a8c001692e6c3fff20f4cbbdc32a0041c3512838375ed7b9
MD5 bdc703ca746e40b4a0d5874028e1f263
SHA1 e2e9ea0a38ed33ae822e6cc67911d92350c8f97f
SHA512 72b84b54b197f6a092bfc1ea0941ebd107de9e8811f067f5529267fbe7fcc0154d4a36e023ee82842ca419fcc9b54600f37a9d85752757015483de84ddc59ceb
SSDEEP 24576:xAhGL6IFoiwtA5l7S53D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xAM5Foiq5zLNiXicJFFRGNzj3
TLSH
T196359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 be9e69db2058e0838828e7d6d25636e490a7c70b5fe8d327683749ea14f90325
MD5 45a2b00ce6ed417a3accb9062429e2bf
SHA1 c264041582476cb8bfc1d0baaa7053c72db08b49
SHA512 dd41fcbe9ee67bd7b04a1eecd20efd72ac9f733d2a9a88e61dc2939b41772c84552636b803935dd411d2e4b5d2bbe462d09733c4e356c4f46d5b9501480f5255
SSDEEP 24576:CwuROW0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CwSOXLNiXicJFFRGNzj3
TLSH
T1C865F18632940CF9E9B641398657C036F7F2BC152A21DB5F5360CA5B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b22b8773f1808826b5880683a84c790e085579b4db617b761e1351424f2f4fac
MD5 cf5628ff2ff2304e1b1526d0b76c99c8
SHA1 00bb37934fc8c6095e400f54da21ffdcdeeba3a5
SHA512 5cbb3d2d44f386cbce854abe624b284ddf0eccdaa9f402f0d15ac7e951991805a90b0c72c706ba276b302f8e75dbcf4d9ddb2a5b2cfcc51ad4f4ae40c1d15a99
SSDEEP 24576:WZuB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FLNiXicJFFRGNzj3
TLSH
T19555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ffe2e953ae68d6a4708da79cf47fcfb1b657b0ab0ec58e8cceccfa385d939d77
MD5 6834a09bcf81585ee1e8796f3e535b87
SHA1 8190109394ffabf28aee1de40d5fc6f5ef81ed1a
SHA512 a4de60a818d8e139ca4cadb0188bfcae1f33be31aa8ac7b7e8aad1a1596bae48f704d2a914db18f9c154e2b209cf04b319bac127203fd9686584399021b64fdc
SSDEEP 98304:kQRQyi36YOcPDLvw2gAf+PN3W7wRGpj3:rQyiKanX+PNqF9
TLSH
T1B4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8336421df2110c60e09647b432d72e35d223656fa7e43a718db03aef94efd60d
MD5 4d40bb11b3cd9d88aa8be08cca0b5df4
SHA1 4145a9656a0f1532bd8db4c717f06f6251059de1
SHA512 4219d8d057ff8f2bb4bd04317a18bf1eb753ce4e6dc7f79167d9f3f8115eeddd0b41a2f90127214365ca2d3c3e5c101826d215d0fb213c7a814c6133390ab22a
SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3W7wRGpj3:hQyiKanX+PNqF9
TLSH
T1F8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 29a43f34e1548e146d0c15cfd3699af8f9aa4673b65215a7573b9a72eed46a08
MD5 33f15d771294abdf9756f93e8d28264e
SHA1 f4829367d947b47fdb856fabf55f3a29160b626e
SHA512 b4deebee5a193191d005ad620dc9257f2fdabd6e2230049af93c81cfa61b458bfdf89fd16a206f7a8b5294f5adbde394fcdea86a28cdfaaa19a996309679385e
SSDEEP 49152:s68Qg55nhkeWu7PNU3/QLNiXicJFFRGNzj3:mthTRc/Q7wRGpj3
TLSH
T135B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c91ec2d9991d35cdbc32a0a5d419ff58cf76f87729949b48337eadcdbc30bd10
MD5 a91d6c9cca17114015638edcd74ddb3b
SHA1 278212cb24c68cf6fd4dee8624cb5cc247e0a048
SHA512 517af09e6c35097ad2a48b737060b7d0695aa5b90f8f5e948501d203ec09be2153a4a337860ee820b14886767ec2abdbda4f0e7cd1a5d28ab983cbf337bbfe0f
SSDEEP 98304:2y5112gYy5azzVvU69nLKnhZ17wRGpj3:nLIHRWhvF9
TLSH
T1AA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 09d9d0053a7c9d0bba7b0958a7b26a49d199cbaa1e849ac417ccb3ea894a0fbb
MD5 3abe3989b866e0c83135f01c07f2e46c
SHA1 83bb16327b855b54acc93ca6ba1b2b6829ac528c
SHA512 9d7b06708bc8e84a39c5a9ac55275a3ceae5d7098918b4e5b69bf24bfa4101c320dbceeff092b8f456bf084d508a53b70cc8bbf4c8f051458638ba90ff02b106
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gluLNiXicJFFRGNzj3:Su6JmIxd2du7wRGpj3
TLSH
T150D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 750184a52c663d2d4acd347a437ac01ac1ac0ae44524c2bee9b2d740e7fa1d89
MD5 a82aa3a27faac0f7b492a0b62e02edf6
SHA1 ae84cfb909181ad66290f00c67b686b40831007c
SHA512 b5499f28a7b2a743847c7a6fde9f31c7f3a242a023ea77b269bdc40440b169a88993238e049634ea0d23a45219867614b1c45a4b96d249d905089e43f0d52498
SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4xSLNiXicJFFRGNzj3:6mifPqRj7wRGpj3
TLSH
T107B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6c8509982714a033e2b07290d6cea0886f3e97c7fb0baddc2a961d374fcf1d31
MD5 9c15fd8c84aad506cb72f234440e6874
SHA1 ab90446748ddd9c39cd058d26d3a45ad3252ceb3
SHA512 5a177be2533caa64d625910f8522eaffacc1ae0f0fdb2ff3050a9349fe1a62e9b63877d20c62a1fa4a82e5c061905a00397652dbaa76941d95f4db1d54802a3e
SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHqBLNiXicJFFRGNzj3:M5dKqi61B7wRGpj3
TLSH
T12CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 837621103691a5828da05a628784c1ace46a4d4ac4fa74b0390d0a7f5305ad9d
MD5 fd8133ca519ce1348487d66ddab631ee
SHA1 0fb5c83819a40f406af9aa6dace0cfdf04bc8d34
SHA512 0d4a2b2f7c52730d346e911b541cf8bee66527b6717864014f52194d96c3bca74d742657639f393e1382fc2f91889cda91d9012a01ad3a9fc2168baf3f590e26
SSDEEP 49152:vhtSn8EApI0figjgiDn0AP5w+LNiXicJFFRGNzj3:+X2iWph37wRGpj3
TLSH
T1A095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1e4f05aed11b69defc63d19116e86c56fb35e85174acb3ebfff1620af9820d68
MD5 5f76e9121fb29b4447b659cf674b4bf3
SHA1 6eeacfecb78e19d7bedf98da04c773d55fc2b322
SHA512 e818ac8530cac6efcef02ed23d1a9b8f45ebe256636ce922bc21392946f6bf45ba6bc34b12e1d6748333d7d2276c35e745c40e18642432d956c0c970f5b71068
SSDEEP 12288:yhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 976196e36895c35bfe37b6cab34c68e06fe9b13175edb343db260c67282f34c4
MD5 784a94e01efe58b5706c9451e0178744
SHA1 bb3ad65f5a57cba2c76ea6256b7dd8b031a373c3
SHA512 1a1ae07d657a00d66831fc0ce86560805750b815bdb8bde7ea22fb9fcc8b23166d68dd70232ddd74666d9cdbd57bb228e2f32cf78900c47d26e054a941518e57
SSDEEP 12288:maiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3558955B1EABC003986754428F5882E2DEB5618E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 739f433153edead4a1969cb9b473f461f20181ca25c5955175f9ae3a87d70fc0
MD5 a18d4a92c221d877903665b6cbb55613
SHA1 2f6269f0916dd07bedcfdd6607ec1e3a50a05e1a
SHA512 f1cc20be7a00e7f0be3872dc7139d887c06516ccf2b5fc71fb3db61a9348869fa58dbcfc635d1e4def08936f9e28860e840689cc28a865e9226f288a132304f4
SSDEEP 12288:CYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5d5f776d1af296ef64624248f5c5668797642703fa068865c9c4c103730b556b
MD5 f29f1c4d01f12215f62ec7ec01075425
SHA1 843d9d2f84ae60f0a41df8f160691fcc861ad8bd
SHA512 a122413901a010146be141d3e1a7301d50399cc5413c7aa8bd4436f55a2c0286b6308422011736774f30b6909a1141754d9eeb76bb250a81cc05a9cb21f2c8d0
SSDEEP 12288:PVXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A5552392168900E1E9FD803DC6764424F2A47D6CD7365AEBD3003D1E5635FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c1945f9ddee862b827a4a162974045d5330d7310f4cb09f96b8524c3c9cdbc1d
MD5 a09113d69f39a837fdf7ab8df2c37d9b
SHA1 9af17b8d18f6d0b112e845d34c56bd2e446c786e
SHA512 a8c81b11f0f588285310206b0abad8c93d8a195838ba117924748dc01c89ac17a75a6662cc6c0fe828a8ba8f56c1834bcdf0f3a6a5973d2d29a6fd787b17e735
SSDEEP 12288:FfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 df3f960ac8756b8048e97bebb05b1ad970109e0a567e0d68c7d6f0bd0c9e65be
MD5 0ca64ee6adafb15a9fccc84d14a67cf4
SHA1 105d52e50708275cb9f5702b83172a3e649453dd
SHA512 f477464c2bdd88c7310ac0309844096383d7c3ec6314ffa19b44ae525ecdfef46d651539798672b9c4e690b32cb69e3b91cf2f12784bbaf3ee0cb1dc3148c01d
SSDEEP 12288:FuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1725523D3558955B1EABC0039C6754428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 28ff2e6a9b01ea405b202cbb99f4fc94161da0d61a84184bb0dd34a82003d7cb
MD5 e3e8cc543f78f13d7c7827ad54974e8e
SHA1 67f8b6265b1c4a6130a898a477d25fa6b3096686
SHA512 804c65f4bd745b83ffacfe20ac940f19d011b922a1fd4fd6ff7d03854279644a489e85e25042cbdb32d92c83162944c6b4c990abc7f40e6d59c08ac73ce83a0b
SSDEEP 12288:8iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3548955B1EABC003986354428F5882E2DEB5659E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6b5d12ef41103c8569ab4110fd82a1d646ddd24165ff47377fbf832f4b20cfe5
MD5 209b7d205a26a461d5240b4d02e255ac
SHA1 470c51822f6176760bc3a069d24a301c19948dd8
SHA512 1f8af8301e663a40312594372c5fa7988f999a03ef7b11953e2793ead375f45b30ead50115d8a24b42c7a30d49052b67ea86e3633655a6e262989c199b20ea50
SSDEEP 24576:xZM3zFVSOc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xZM3zfoLNiXicJFFRGNzj3
TLSH
T1A6750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a4aefb3caa170813dbf1328f90387bd03f497666c2f0feafcfc31cce501a02e
MD5 1b4178ed7a2e9ac40eaefce2ffa897c4
SHA1 4341323b9ed2f22f3dae80af1b742ca0b2020590
SHA512 cea3119c22da6d68297de8c3beb5507fc322c54053477ce1362cea6bddca8d50abf80ee011d48de1315274592c7bc6142cac70aa93b68d11fd6c3770a3849ed9
SSDEEP 12288:ZNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3548955B1FAFC003D86764428F5881E2DEB5618E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9050af02ed66b62bb1912d4ebd8aaf22c53017b4dd38567208aef709316e0a88
MD5 6dc477e0f174bd89d6c37078a338459e
SHA1 2eb89f672a7291d403a9569845e528a208ffa69e
SHA512 16d13a7f4b590016eeecf8e4377baaf028b3626a76a55f99e8db52d39ba816c7af0d24e033d514074f06ecac03d88df2efa5e6e2177b5ca0706df938f95a19a2
SSDEEP 12288:dZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E05523D3548955B1FABC003986754428F5882E2DEB5659E3E2483D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 581b21eda4063004989dcee5394acb45383e79d0bf1c177776d5bb47016ba6d9
MD5 3ce648cb466922f3508194dcb676d67f
SHA1 b796f111a8764d77ba6209c8036ecb0bedb29af2
SHA512 91a1956fe3d65bda4e1672758caea626efa54b9172a0345a32da7e5ebdcabdbaa96aed6f280cb5e5489d1420408da2b7ce875b8faff864fa354d2fdc7dbf7ac8
SSDEEP 24576:Wzyw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W3LNiXicJFFRGNzj3
TLSH
T1FC650247629530F9E17A4139C9620911F3B17C364B208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f5ab60c9a93696d85a62320e293f9a78db65b62325d839794a4098c05dfc0357
MD5 ba59c0266889a8caa5f20905d4a0bad3
SHA1 b12302bdc3b410c9cae6b98bc67340f25f56c384
SHA512 200b976e0a05967606a59c7dcf3f75102f481930f1fe25fab6291b4e8c3c36e2c45d2a7063196520ad25b7f0a04fead94cb7db92ebc5bb65e2199f03392c948c
SSDEEP 12288:aNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3558955B1FAFC003986764428F5881E2DEB5619E3E2483D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c0d5d04416f983cd4f52a786a5fd5b74ec4d8076974685ea038daa599b1211f8
MD5 520d72a1ad3b92e90856cd6b7c59114c
SHA1 c5127d5cc6b81f4761e9b94b352580ad07328b81
SHA512 310a287e8f07f517761e4474a50928280dd3c52a328f7fdd093d9f22c2578e408dd45cd0d984ef8be72d4229b4f078de6e3dbe74b11106e0ec4eec496f323030
SSDEEP 12288:wNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3548955B1EAFC003986764428F5881E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f8bf08d5ce3e625148f8acaa8fcbfa42a2d93d394f676a0bd0ee38238d614e3e
MD5 07d074f2be7895facae8174fd139715c
SHA1 eea3bb75aa789e69914c356839eaa2aaee46735f
SHA512 577c7cdb02c6b16a04ff7fa4b15a764e3b5c1ddca36df8549de26513f4dc90578a03788ac2fda2fe7696d5133dbf164c537b31e176a703ff10170f66a033e76d
SSDEEP 24576:azyw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a3LNiXicJFFRGNzj3
TLSH
T1C6650247629530F9E17A4139C9620911F3B17C364B208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 384ba88399cdf25dec1020cf68f5c109118ef3db48decfd2f5d10f867642f077
MD5 7c8d042e6baa9db1d4c731d7103db42f
SHA1 0e64881efe1ed151c07241f6e8787e5c31f45464
SHA512 2a5592941abe2bb98a10e1790c3c4e0c5a6acdedc59d5d66e1f656cd18c4f9c4b4f085e8caa23253031541cdd8c3c1b4d7d83c1e98ffe758e63450c947cf0190
SSDEEP 24576:KcP4mcvIjkGOxhKP2l71nNKbrh/8KB5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VP4m4IpOO67W8KPLNiXicJFFRGNzj3
TLSH
T11365AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ce91c8b8dd9c06deab7f64442938ae3248f4039d30eb09d03d550e498917c5d1
MD5 8c0ffb02266a14590cbcf3b302ddf2fb
SHA1 a14164acb912970562bb4d5900087f484cf31d89
SHA512 21e82a204b5679a3b4ed8f78f6759bdb8cfbc0f06d813a68b99b15010306197cd9b40bfc2d014036bf7c98420befce82a5493e28bb032bbac28c26fbe3f6afde
SSDEEP 12288:qpsfdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E665F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6f8070e47bed117522b2399a6eed315bccfc416d0b1072bf054edad2be38a052
MD5 6136f4e96cd2c7beca6353abd7eabdc2
SHA1 7cfa3d811d99462f476974051823b9e69c23442c
SHA512 c2aeb816a07d58c022a783ec0c25cdbeb172bb31ed924b32165a5db4ec2a984197a8201c6491a39a04cd0b8f7172c85ea853be609c8f6d835201c757ab09e8cf
SSDEEP 12288:W9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F6552393968C5562FAFD103986358438B5497E3C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fd234d4aa4acdce9e8ec10b4f737f5ad7495827b2e91549fec9d15f21e13dcba
MD5 6161de28729167d887684f55e9f00707
SHA1 3c837f96fcd0cbf4e5d71a736639c629d813955d
SHA512 acc8f828bd0417b4c06545394cb5f5df37b4def15fd40abba5112243fe6660891f98f6ecb439cc29ff8465d7b1b5ba7532b43815460afb7f783a35c2ce7f24d1
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQrLNiXicJFFRGNzj3:sa0hNYG4JwI7wRGpj3
TLSH
T13185AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a1fba7d889c3372e344391d96784e39f77ebae769ac27ec79ffa020b1747da4b
MD5 09f0f9c2cdd944706990c604baa7b5c7
SHA1 59d064fd7d900071d374a7cd9f57b8977d719f0a
SHA512 eb21b0b505bba628a692696dd78dd8ef761f3210131d8c503d0330d492d7d4df7aa6b84756c33c2f6eff6b650dac1b4c41c8cf0ee579da8b2bb80569ebd390a8
SSDEEP 24576:1hbHjPs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1hbHjkLNiXicJFFRGNzj3
TLSH
T1665512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eb6356169e15ca3a064479a84bb868d0d5c0a1b980c026a230b737a25b53000d
MD5 33a1a2adc11f699b09ba7e33f247546e
SHA1 f02e059c9a6aae018824d67ed83db5f0d7964dbc
SHA512 bcc7303bc97e3a9a648f9323265ad5dd36365958ff1c59768abc0bcd7b63aaca4bba367041d47ae9c349559edd073dcf8458f1896ffcdf80bf1ed11935307f3b
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1IgnaTk46pBR/0LNiXicJFFRGNzj3
TLSH
T11C45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 592bdbec10fb4cb77b5a469dab0aff488a7f1ba0701773eb3922a7b3fc87a1c9
MD5 58504297a71309b48272263faf241bd6
SHA1 79d4355a38a9b28259ae6c245a5ecd61ec40de1e
SHA512 bfccf699b404b78941a017916d08eba7f69c6f1eab79274b6a2bae9fcc51bde4344fbf4bb3b69783173173c0cef7262fb17506e09a4566fdae8e067ac10ba0bf
SSDEEP 12288:OJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D2518955B1EAFD003D86764428B5842F2C9B2619E3E1543D1EE27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 37eff23d582b85ab945e3be46b691abb8d9a264091baecb2aac3be2762e26842
MD5 21bc4ffc41d7ebf06bc39f48d255194c
SHA1 4eed88d2bda5402427f86ba6aaffd0e26a87503d
SHA512 ec02d329a1ed2b8e287088379acfaa4b9e3f23d5405591c671cdfcd2291ece33e0c030f95c00674bed013925bfe9882edbc0c851383a76ec822b0ba60b5936fc
SSDEEP 24576:GAL3UT+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GAL3UyLNiXicJFFRGNzj3
TLSH
T1F1750155E79400F5E97B813CC9728916E2B2785D0724E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d5d19dd96dda18be00ee1919103a48467bc7fa9b8f55901a1b2d78b780793191
MD5 16a330623b358429c624795e10d3d6f9
SHA1 66d389f441ee8201bea1dd7a12694c88cc2753cc
SHA512 9d0807f51285a0ce930277da334bfd34f801e4e1102f9b7b6baa5bea654e047f2bbc41597f93cfb1c318093cb1f0a9a6ba31c083ef0359cf194f0c14f139ac73
SSDEEP 24576:HOS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HOSLNiXicJFFRGNzj3
TLSH
T10355126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 103679b07721cecfa1ec371e414b0aed0a86de416e6d286af49ff3581837fcd9
MD5 b3f5178f62492470f709fea868b9a2b6
SHA1 b349bf133099926b420ca5bde64ed7b4cad9564d
SHA512 f4ef7113981d23824ca8dd576d8cacd658552ef8464c8cd19f6f99d7d72eaa9e7da54259968e317224a82da42464f5f7693078724ad62a3e281a3ddab78783d9
SSDEEP 24576:d7NM9YqZqmWMUkPjZM48Mv6bEhsR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d7cBWMpPjN8DbEhMLNiXicJFFRGNzj3
TLSH
T1E865AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f43cc2067373844397a8321afb33dc9c594d3ae1da5971801c42113da43b6e8f
MD5 8a269605450489e7df91480e5dd382ca
SHA1 e856d5794ac554b6762d8e88f52c1e9883e9d1a7
SHA512 43b0ca629f0c0195a05fac55ee5c7b0c29798bdf8793c70283eeb36499d2e588505c835825f5810fae6bd33e5b4fc55c532f2f472582478a97c4e73d9b18aeaa
SSDEEP 49152:9F2YuHNETovAvNYf8kmxLNiXicJFFRGNzj3:I6BCf8kS7wRGpj3
TLSH
T1A3858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 93bf773221beb2d22b0449d0bc3b089a186e8c68797fd6d5520d6ef8800ff57d
MD5 f102b5610a994639ee7fe1f03ec13ac1
SHA1 b51ba9aff25b95fb5f93206d4a66e7144c648795
SHA512 a8c47215ffb9bbfb94294e49b00afc0ad1789a0a23814ed472441460300c9d69ebd05da3b1064f950b7d8714453407820410bea8eab8b4d34102b853b9150d65
SSDEEP 24576:0AFs06+Omlf8NXEbTo2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Fs060loXuLLNiXicJFFRGNzj3
TLSH
T14F65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4e4688577e207cb411175c3e95bf005ea17dc6b8f06f33471741568a6cd9cd1c
MD5 6d3280a70dcb76bb1b56f87471d1757e
SHA1 48df2f59a1db90f0465dd9b9cb75eb6a8ee23e82
SHA512 71fc4b100f46ac429c8eda5fc2afbc74808cbe9c9658452223d66a98d42edbaf2f5197c4ff429caf7e7519c851580fe8de87892ec7263fb86df2c156d3876147
SSDEEP 24576:pJnJ5D3WXL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pJnJ5DGXLLNiXicJFFRGNzj3
TLSH
T18275D02DD29810F4E4B7C274825A1655FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b94801b494a7d011443fbe8cec183e625c32ecd84ce2e104c03f501613ba18c6
MD5 4d27299d663de903b21eabed5caac6fa
SHA1 de3ca8187adc132311472e284420e77be8f39f06
SHA512 5c3b00683aa8b10add950265f413a0534e33653806b36ed00e908e588ee38f7e89dd6bbb2ec096b12be4b1d91b94eeece25c81fca7a3b0588ce2e6e7f2a3a3e3
SSDEEP 49152:Kg06DIKdwc+eQnSt65aVNLNiXicJFFRGNzj3:jH7wRGpj3
TLSH
T153956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 05d6903e6243cb5d03e213b57f2529675fc2c50fd65f63b20b2a9b256ad034fb
MD5 4c5f18012643c367b17f25e55c947915
SHA1 e2eab414c235e549de866a25163c933c199eb7fc
SHA512 a15730300bab608c27d322a6f1ffa50e474bae2d9a1aff5419574c638409b904635f3af594239f4d948eb2ba4083ca5a75a6f1081213ab9371903040904dced0
SSDEEP 24576:Bnf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BnfLNiXicJFFRGNzj3
TLSH
T1915512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 aa3a8f280bb06e0bee127e7489c67a2bb531b6456e78ecb9743d46f5ef28c87b
MD5 4a9821a5ce3d0d67c433fe23b4c6508c
SHA1 eaf6efd8048faf0d7e9d3cf82195554379d89b4e
SHA512 76d1174c967f47219d792c1b402587753070cc309dfc6b9a460b7f1cbf16fe26f3776a221d7d07ef9e0d3ed5fab2ed01e62620cb301478566e5492dcc9d8adbe
SSDEEP 24576:GIy8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GI7LNiXicJFFRGNzj3
TLSH
T1B665124553C860E5E6B9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c6a94aedbb26dd1b435c1a34ce6ff73259b5e558a19f0cce0e4105ecee59ba95
MD5 b762c35f02f91ac593352825ef953df6
SHA1 50e2a513e03f9be7a437585668cec64c4904ab7b
SHA512 5fabdcf6d01a5f983c419454ffae128db6f5c4b9bb38bc95144178ca86a23a675f92d1f45364217736aa7912682fce7416861e74d1e96d67ff6bc0eade2476bd
SSDEEP 12288:cywiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ji/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE55239A118964B1FABD003D86354824B1943E3C9B2628F7A1947D3ED339FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ccbdf3f6cef44a41f9bec57c5b094042f1a94063dfafcdf90f01673929329282
MD5 d8aad0c26c0e60094c1aaf0029ad3649
SHA1 b5a45323f06e9c1b5acea538e6465f1d4fa45041
SHA512 b1be915c88e1d17a942d7b17761d5822217c8c6cda0ae4444a0dec532b7c25e33722044f24c9c017e807059bc010b4fa9fd4f93d8ba37379371bff9f8bb26cd8
SSDEEP 24576:aQ9MxZKdcz9dw3p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aVKZpLNiXicJFFRGNzj3
TLSH
T180558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 00872f978eb6e946aa4bb5e94a2e594ef7e6ce87d4109107992665ba95d9125a
MD5 498679da6b713ca9fe4d880dc82cf014
SHA1 a8b8ed23f2f2372690425537e23dce08b9b5fb7a
SHA512 66dbabe8719298bc4b91b464aaaa6fc5bf36fe8a916a3c7f65e7b7959ab8a9c5a64c1a83dc2317c9c5b6f4d544f087ec92e78be04edc1cb5dc659d769e592697
SSDEEP 24576:cyocDApg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BocDApgLNiXicJFFRGNzj3
TLSH
T18065E05FB76D40A2E176813C89858204E7B3B4345B6257CB6191C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 78018a51905d9499ae97de74ce684a827778cbbc6a87e42d954c0b21d85ca758
MD5 d0469f4c7ce145368271ded01c33a915
SHA1 25b0958d534cadd9936257aa3a23a681caf44ea1
SHA512 269f56c2fd3ce3bb5fb63437d468cbb4681058dcaf303e600509713bbf476362c76ae6b3a1250511f4e6535196f6eb7227a8b133cd28e9e892d32a04a3607ab1
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKgLNiXicJFFRGNzj3:m0zuNI+7wRGpj3
TLSH
T175A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 330319fc3e3624908f324e5199f0f07ba8a0de2b172325d3c198b48db50acbd7
MD5 434a4c16a2cab00e4f07e2a63363a0a4
SHA1 9273810faa9caa73ee47cfc63cb45e04d921cdbc
SHA512 05335488ef175e7bd8bd12c21f37c2512390b632191837496c778e47a10a803d41a59ee203a804d5b5d621916d0a914a05430a9ca6e1ae92b0b7cbfd903709c1
SSDEEP 24576:y1QT7EcpfxR+N5AWAz3ooiYzjMqbf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vTDxR+N5YzTBjMyLNiXicJFFRGNzj3
TLSH
T11B55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 950b761baa247b987805f319fb04343327b2fe7c1cbbe4365351742aeb57811d
MD5 832699248e14a353fe51c455c07f2dd6
SHA1 d06a45210a9bbf8971f030557a97a415b9368923
SHA512 dc424db744b943a3bc3a2f3d5b3e4292eb3dbff5f72068e4b40ff93b566af22b5b1e4b005cd5f395f11f3ff3b2f150bef6033d10ef889f01f29e48cacd992358
SSDEEP 24576:vTMdOz0FFS+UmSLj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t0K+UmSLjLNiXicJFFRGNzj3
TLSH
T16F75E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 cf9e3c2bb4ca4f142154d58c64279c76bf26d175eb36efbaade30ca94046b3de
MD5 aea2e7c57df54cc3022f134c8ccb6fff
SHA1 23907d0b0f22b8f0710b7c4af236905cda13b073
SHA512 3aeb3b4c9b2a49d9c7c2cb3d6e148c09dc4b5de4a5ca8febbfec5adab8b8261ee2ad17f45107da74057f410fc3a99827332b308868cdd21784ea8e67237bc732
SSDEEP 12288:z4KUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA55125A13C830E0F5BA5139CA364014E660BC3957255AFF71D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-291-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1372-0-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1372-6-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1372-71-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/1372-8-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/1408-67-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1408-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1408-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1408-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1408-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1672-352-0x000000000CD60000-0x000000000CD68000-memory.dmp

Download

memory/1672-216-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1672-274-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1672-200-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1672-423-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1672-316-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2188-103-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2188-288-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2188-98-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2368-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-421-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2368-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2504-315-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3104-138-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3356-85-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3356-91-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3356-317-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3488-24-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3488-23-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3488-22-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3488-16-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3488-335-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3508-72-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4020-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4020-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4100-289-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4184-311-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4480-308-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4480-131-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4480-125-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4500-310-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4580-312-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4964-14-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4964-319-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5152-309-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/5212-114-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5212-292-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5212-120-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5320-38-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5320-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5320-32-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5320-372-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5748-290-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5748-355-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5792-357-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-393-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-356-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-359-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-371-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-360-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-361-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-362-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-363-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-373-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-375-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-379-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-381-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-382-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-380-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-383-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-384-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-385-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-390-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-391-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-395-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-358-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-394-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-392-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-389-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-386-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-387-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-388-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-376-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-378-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-377-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-374-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-365-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-364-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-366-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-367-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-368-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-369-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/5792-370-0x0000025184CC0000-0x0000025184CD0000-memory.dmp

Download

memory/6060-422-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6060-75-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/6060-287-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6060-81-0x0000000000830000-0x0000000000890000-memory.dmp

Download