Analysis
- max time kernel
121s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 1.5MB
- Sample260629-e4pz2set4l
- SHA256 15e362a35837fabb7609214da778c4159c7cd23120ddd434992390c355fad964
- MD5 a0f4e87531d87060784c00fb7a017e08
- SHA1 775d0ed9b9a65a6b943f08e952f9d73f25859554
- SHA512 61e60d57eaec0c8775b3209d54f8b58ad959e2c6a8fce63407635914690cac28ad95805acabb6260d53457d18fb7f3c4e5371a92553c34f141986b2f83c02a1f
- SSDEEP 12288:FQGNTZmzSwM++L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:FnNQNM+WQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T184650105B69C3DEDE06AC234897591A29B31FC312750A65F43F47B662E33293BD29B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 5848 elevation_service.exe 4256 elevation_service.exe 4340 maintenanceservice.exe 5240 OSE.EXE 3408 PerceptionSimulationService.exe 900 perfhost.exe 2628 ReFsDedupSvc.exe 2328 SensorDataService.exe 5084 ssh-agent.exe 3832 AgentService.exe 4824 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\50ab14c581289776.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e7f512fa7f07dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea927ff67f07dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4bf77f77f07dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050b50efa7f07dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061d761fb7f07dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043485af77f07dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6ac6cfc7f07dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{05B41679-F37C-4793-A3E0-C9BD6017F5CE} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{8F9F2D82-D668-4EC7-AE44-FA2E84E184B9} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 5848 elevation_service.exe 5848 elevation_service.exe 5848 elevation_service.exe 5848 elevation_service.exe 5848 elevation_service.exe 5848 elevation_service.exe 5848 elevation_service.exe 2732 explorer.exe 2732 explorer.exe 4256 elevation_service.exe 4256 elevation_service.exe 4256 elevation_service.exe 4256 elevation_service.exe 4256 elevation_service.exe 4256 elevation_service.exe 4256 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1372 2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 3832 AgentService.exe Token: 33 4824 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4824 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4824 SearchIndexer.exe Token: SeDebugPrivilege 5848 elevation_service.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeShutdownPrivilege 2732 explorer.exe Token: SeCreatePagefilePrivilege 2732 explorer.exe Token: SeDebugPrivilege 4256 elevation_service.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4324 sihost.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe 2732 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6116 StartMenuExperienceHost.exe 2080 SearchHost.exe 2732 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4824 wrote to memory of 1276 4824 SearchIndexer.exe 101 PID 4824 wrote to memory of 5268 4824 SearchIndexer.exe 102 PID 4824 wrote to memory of 1388 4824 SearchIndexer.exe 103 PID 4824 wrote to memory of 5136 4824 SearchIndexer.exe 104 PID 4324 wrote to memory of 2732 4324 sihost.exe 110 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0f4e87531d87060784c00fb7a017e08_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5848
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4340
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5240
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3408
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:900
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2328
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5084
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1276
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5268
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1388
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2904 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5136
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:4648
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4788
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2904 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4288
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2080
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 564d75b95178f1972211abebe7b4295009ea7750897b545685bd4a902088fd77
- MD5 082e6424fa9f63df511a0b081fb3cedc
- SHA1 1260d850e94346c195d22c017fc3d612b56672a9
- SHA512 c7038aea00e637a11b1780903706f8e5bff00a58966b2a43a615c485beeaabe020132c020b2466896b52ffb9d74c3a09a03fefe83773c119e54d09d52741d7f3
- SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEQ+NdJBJSKiO:W3q6sjBZQ6lJSB
- TLSH T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 6b70b55a05f4f581a362cef4121f1a9f0eb0443d595f7b234ca820bf4a5a235f
- MD5 0791fc26f6693f3ba9587bdcbd62d77c
- SHA1 d1df6dd2305de722e87fc80bda1d30fd7dca14b9
- SHA512 3a890520634244ecda9e602d94eb455b5e1b6bb207e9dcd768a8c6a7f9810a8189350dabfda74fb01d9184408fdcc5af4d13857278845a4bc8d4b8c829902382
- SSDEEP 24576:6XYfDtczA9Qr4LLN6hKBVfB5EJ+SpYiWn:htc6Q+NdJBJSKiO
- TLSH T12C65011C77D409F9ED6B8278C8A28112E6337C6587A0F79B03E899660F336D46E3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 58f68ca88528f5e013a153c2436a6111e63840ea263c8e5acf5c39f5edb1bd8a
- MD5 b24e57d7754747f342ad4a46212f9f57
- SHA1 b252dbac8d2b67427f6a50379ce4e68737b7ecdc
- SHA512 8188fa8b5a7c826b308cc1aeefe970519d0318e4e9c657c3b8d3816bd84624699ce319ab0799d86b88e3908e5b6855e704b8e59dcfcacaa837be4ab1954f7848
- SSDEEP 24576:j0Le5ji0hmxGrMMQr4LLN6hKBVfB5EJ+SpYiWn:jPji0AIXQ+NdJBJSKiO
- TLSH T15985AE15F6748335D073C0B9C5D2A68EE97234825B308ACB4286D77C7F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 2f88bf6848e9f5754169279673414d2c3d08fe0b46542fc8d7a9b16723b12323
- MD5 bab7f4747e9375b7fc4ddff5a8ea5500
- SHA1 57858a7b1410b987746f11c4edf7ef990b0d951a
- SHA512 0f3cd34af4b572e63c4827e42132673c13a1670bf595539cbd8b65527d978519d94f9eb07d3f79b710b40d46ae692a1e72708e3e5a57833cd383ce5da609e878
- SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuKQr4LLN6hKBVfB5EJ+SpYiWn:M/ezSC6vUzPveHjy7Q+NdJBJSKiO
- TLSH T160756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 bb5709ebc98eab51a8969c0ea7981636738e309c4a5af267331eff9a8d139be0
- MD5 cfb3fe1793c40559039241834181a43d
- SHA1 189f0cd80a45ccf46391596e040da4a058fc8ac2
- SHA512 a14bbd62c59d47ffdf89f30c7e6dd9d246fdb3a89f1d7bdff77c2f1b41e91d95807b9adf5d53fd60afa6f6b1e21adbc94f06b8085e5cffdfc1e512839322abdb
- SSDEEP 24576:qVbqPb88hv/l+YpQr4LLN6hKBVfB5EJ+SpYiWn:qVO88hXl+CQ+NdJBJSKiO
- TLSH T1B4559E66F5748331D073C0BAC5D3A69AEE3234425B318ACB0246D76C2E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 8a8ea0aae817dc3571b951890c3605f48dc19050beb29101c8f1c5bdfb15c110
- MD5 1ffc45f70ebf473ce8c0798459fef5f5
- SHA1 9bfa05d7a74c2cda0df86e06ed1b05514760b3e6
- SHA512 356f6a50c1754c6b3cd4bf98d72f39ca375e19358715ff31e2c009de0dcc82de60475351d760b24364c74f5507e6054a5408309b44536bcc3961780511cd9c1c
- SSDEEP 12288:hxIL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:hxIQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1C655230C9D8C57D6F78E03B0A1FB6117942B6D74FA97FE6AC4DCB9A645308A1F838025
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 3a80bdef75afcf03b03b608aac9cc43d2093a3d28ff93917764eab034c73ef1f
- MD5 6351301a1446df106f7c3017caae4acb
- SHA1 6a371a52b3a8af7b3fd11d5df56229cdddfe7b39
- SHA512 f19ef6e231f019bfc10b44a363dcbcf4aa1234ae9c3df6a29356a8b5f36f057a5d30e21c006fd47916145be0eba157d49a6ff1bbcf2ff4fa93f2af8c9ff3423b
- SSDEEP 12288:aeBNUbTVO86UPL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:aJIURQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1F175CF2BEE28FCD2C27E8DB856918240D77278708F62A3CBD165C24EDE235E15D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 c06231253b01e34bc1060b3e13ace7ee83713eda5a07da0724da564ffedde1f7
- MD5 139f93a6b3e405f3f7d1d1b61751a2fe
- SHA1 32487bed57a8580387c67120ee18e12865cb09fa
- SHA512 c7e073fe7d4a9f8a9aaf8e66d6e5ab11449faa7abe68d95beccbfd7b1acf6f026f613c63e545b96c52c95559af07da06aaf2adfca7efdcc91eac5347ef595aff
- SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:tQvGAdlCEL8c/DRNw5CaQ6lJSB
- TLSH T108267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 7c401218574f4aec4cc004cfe19ac84984a2debb3b5d447ea62eeaa894d3ae2e
- MD5 95dad7ca32360355b7b91d895dcb6ae1
- SHA1 b0ec254b72fe2049fba6ec85669baf5fbba742c0
- SHA512 2feaa86065d5c45a3764dd2290664d73954e5ba14f6c16968c3099b868b88103fdedf0db66b1cb58b341b3d87d0e8a14f0665b5fe34a3608b1ad14dfb3c32ca5
- SSDEEP 12288:dAwSfxL/2Dc3sDLLmt0LDQewsAj9L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOU:OBewsAjnQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1BE75E031FE74E036D7BF0DB11B76C316542D7D204BA22AC3E3E8999E59302D22776A16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 517526ea97bf79bba61e7ec31b4a9395a54654c8bfb4039121f684c33bcce493
- MD5 f4af39b7add49228c8d349ea7dfe3546
- SHA1 8c946278ed6608509cd343124094ccc3381a9a26
- SHA512 2284d5a1a3e40c799b5e7c27d1343ec6029559b26dc407ac1a5766f6d4ee705b2d52f68b1df03fda1e621a7a6d82fe317a55f3f1a42e02e966b24a3ee6583539
- SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfQ6JQ:BUEtQevvqc2W1cpV2tI327J
- TLSH T14A474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 9214be927c5df855d5698b03b732be060bc4e44f2b829b9521b02fbb23308bd4
- MD5 04a8a377580ce2f9df650ea5e7cee5a4
- SHA1 c09f0c489e121a98f4a1047bcc1ca889305933fe
- SHA512 7cd3649c9ebe9bc9e00b0130e768166d98f24eebea52bc79fdac9fce627125f3752e1d1e58daca7f5b564189d88a42b9082bcb7e9a132ba9c3f8dbd63df506fe
- SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/zHQ+NdJBJSKiO:YoquVjnmeQ6lJSB
- TLSH T18AD58E0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 fe1aaccd2730acadf6f06141d957822dcd6e80250175f11b9192317854cb497a
- MD5 ebf0a69e57a90d2e983240211d17da4c
- SHA1 cb9f258349a5aa48ae67f12e5b28faf1e985feab
- SHA512 d8d913725ae1831c7db567109a401034347c77dcb948b05db415f83cd250c66211d2db4e2b8ab70a5700147fe8afd6f4f32fd25536daf6088d833f064e52aabd
- SSDEEP 24576:zAhGL3IFoiwtA5l7S53+Qr4LLN6hKBVfB5EJ+SpYiWn:zAMUFoiq5uQ+NdJBJSKiO
- TLSH T18E359D80EBF955D4F5B39AB899B68171EA76BCAA5E31D20F2150D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 bc680804572c24e3fe8364ea233924d00eb645d70098176b2d30edcbb321f356
- MD5 6d69f0b31c1559208ee1c540a75a9f3c
- SHA1 f2385524fd392e02c42ccbe7043d5df794324805
- SHA512 c336bf6dc402821867e597ee72b7d7bc30654cba6d6425d092c692f31a60f5e6c293018872023a40160650457ef6832204a662fee2036d4736f0d46df705d62f
- SSDEEP 12288:wmw5HEjsChNcBFgl0WDm+CyL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpf:twu9OWbQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T17265F14976E80CF9EA674238C597C136E7B2BC112A22DB1F47A4C65B5F33261BD2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 f12635aa525d7169ce6bd706c7022b737b21da8784a820577d92d41e4d3ccc40
- MD5 0ed23103a31df902152c94e63a77ea6d
- SHA1 f339f719730cb0c780e358047487fbd24c91f56d
- SHA512 e098cc07dda1c5529e771202921156ee04411c4820e8b09541e4d93932fd3fbadf46b1b1530e23d05a494a3e30e458c838abe00f4d4847fee738db8ff6a39316
- SSDEEP 12288:hgZ1IyNL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:6ZuUQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1EC55120D2AD821F9E29B4378D9F65206D3727C72677393CF41A856AA1F32AD16D38331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 94fbe7c051b161eb054448f823b26ffdc920ce55f63e5c3a2ec122d9ead6a9ba
- MD5 073ae611be9c338803ef926b3cdd5a90
- SHA1 049abbced13e2d4223e0e12b335f111e8329b85f
- SHA512 cf3f43ce1568316c8393fa287baae04707d01f1644f7d4b32457be6c952f09161cc8c2b00ef6c2bf05ee4561ee33b54072bbd2751a47e0466346f1323d724e41
- SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:+QRQyi36YOcPbLvw2gAf+PN3FQ6lJSB
- TLSH T1FF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0a8fb0bfe0bf2c58621b1977378f9116cfea0fa3c34cd2913c5117c87d3b0c34
- MD5 a0816880917f749961a2b1893ff71ddc
- SHA1 2496edc13ef4d5042d74ee089e3dda6acf3212bf
- SHA512 8cd41f74f532ac424190be4d5c4c73ed563e72a1de10c6358396f68e71a837caceddc1527032e7e681c84bb5acd88fd5c321135e710175c1b37c6763c47b620e
- SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:uQRQyi36YOcPbLvw2gAf+PN3FQ6lJSB
- TLSH T1F3667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 90b64d189188f19a8ebc779cb28697e9f5a4649beba7f32cc20324b3f4657a17
- MD5 8b0b666fc7bedfc3aadd6db8ef7f4a56
- SHA1 b49322f09572020cc1cc26b2807e18f027c565dd
- SHA512 2e08832a2d1cc44c96a6cebd89814757f8f3684e3ed213acd319fe87dd48db9e85271b3ff6e0628744ad59994c705cd56c146ed2e0a0182aea1ab945756eadb8
- SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0EQr4LLN6hKBVfBB:q68Qg55nhceWu7PNU3/XQ+NdJBJSKiO
- TLSH T166B55933B2F600A9C44DD1769F4A872196D27C75CFE1E3DB8505720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 4e06eaa0dc7079e73fafcbc98d1684432b0a7179d2c994c1027dd429df058b4c
- MD5 559a6961259dfdac8be542f13108054e
- SHA1 798c15ca4fb02c8f49a689d2be4151647136a039
- SHA512 83a593813a87f1e59e80ca7b2a34cb03e81379698c4a10d0db7ae91a80a1c20ef780dce4ba88f20112a0764795cfa47534381487d7c0b24f28634ab7be6f457d
- SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:Dy5112gYy5azzVvt69nLKnhZIQ6lJSB
- TLSH T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 db8043609df8aea79475898f41ba948c91dd4f6220df0bcaa24a2aa3cdb2687d
- MD5 dd9ceddfbec52f43a0ee658ba6c0087b
- SHA1 b1e22ee76b5d36837dba1f16c0a6d70e0c6658fc
- SHA512 8831860277f1136aaebb52fd370d47b205ff6dbcdf50b47e860a264480811f98ed1611f9a44a4d40e411f7e8f32a5ad5959bcdef558a0b65d62e4c032c391fa0
- SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gltQ+NdJBJSKiO:zu6Jmdxd2dtQ6lJSB
- TLSH T1AFD59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ef1abe5718f61bbf5372e06cd06be64850667c44c63899758aa819998e68131b
- MD5 ed5a755894e1b50d899b47c4d1ce9244
- SHA1 311ca6b57ab6ffeab4ca280380bf9b5f6acb5171
- SHA512 c2f01e99e31c075b059b3d5bcd22df3778d7da629df78c94fe4bf9037bbc57ed86f3f22c6671831897a826c794014a842363a145e410135b91ad3f597a4e7ec1
- SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4xxQ+NdJBJSKiO:hmifPWReQ6lJSB
- TLSH T1ADB5AE13F2D901E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2e2b07456dec4507784cc8339f059e20e87139e2e506bec2c6191e703e221287
- MD5 344b184065797ee84e6080378cedb847
- SHA1 9d696f59d43d50bfd9ec8a4dd6685d2be6942beb
- SHA512 242246772779965b8c1f573922f246311ef816bffb4c0fd0bf9f14bc1e23d1def22d866f6bb5660ff37ac1987cf9dabf70620795a85d714063d4c4fb8e3a39ba
- SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqUQ+NdJBJSKiO:u5dKii61UQ6lJSB
- TLSH T157C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 e9934b7fad4789bc807c762d8480beee46eccb33ef2691bf66ed11ca5ca8c883
- MD5 e5337e94eed44882f3aaf49a490d5224
- SHA1 e29100310cd949718950b34f73054a512735fdff
- SHA512 75a18956bee199181e5b8405e7259341786802fa69fa73630328b3762c4d85e231bd140d1d32d4075bd5d68da679db9761942fe5cee928a9897be534e369dc7b
- SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5w9Q+NdJBJSKiO:vX2imphSQ6lJSB
- TLSH T17C95BE13F2D901E8D05EC174C7568632E962BC160B35BAEF0A90B6561F7BBE46B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 630a5e46446e1cc5e75c9d6114c0425e6221a3025efc986ef53b1ee7e15b959b
- MD5 0e026c7aaecfd2b7f5d0d312c8ece6dd
- SHA1 1157d5206d2b6467a91431e9ad967888793abef5
- SHA512 7759681358d2e13dbb95135cd321399982b95f3b4f72350704ff2aa8a8b488aad3cebbbb605dc103847986df4c178dc9af37121f59b0e56dedc06bd279a69a99
- SSDEEP 12288:kwL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:kQQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1EA55230CACCD87DAF74D43B0D1F76157942A6D7AFB93BA6BD4CCB46656308A13838068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 bd348e8b32e4691e39d6f7f58d9b6991a806c43e9283faeef772e8f9abdb3176
- MD5 dd9faeebab38e65cd1e4ed04fa9b8750
- SHA1 6e2621323436aba5d3d72b31211084c969d9f831
- SHA512 b757ae25e0a5125aa31fe1b4a937c95f58e591011584d5f5e2e9601cb38e4aa4ecc750840e8f30c34b7af9fd5a0d7ec889c430ce67611ccc6f2658a3d8eb0b7d
- SSDEEP 12288:6pL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:6TQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1C055230CACCD47DAF74D43B0A1F76157842A7D7AFB93BA6BD4CCB46656308A13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 c31270fbfff8cfebb43a66b0e9d9cdd76c29a1adfc4edce0cdef1ccea8d32d5a
- MD5 d5a3ae76fa5d8c342325b4a7bd7b03c1
- SHA1 800792191777057bcf0ed688cfa93a6dcf0a8a02
- SHA512 a582a7edf2deaa4cca117160264fc809dcee75d10c1237dff77ac22450c6d605fb7666124e114574a8606185557eabec9c6aa2408f58dea67bc51fe353e445e9
- SSDEEP 12288:AXL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:AZQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T13655230CACCD87DAF74D43B091F72157942A6D7AFB93BA6BD4CDB4665630CA13838064
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 a83fe04b5ff239cf0e03fb4b766bbd698a4897be92dd65d7087551cd8d16ac67
- MD5 aada0bb239567707095c4f60502eb536
- SHA1 bf6410a301d11353afe3dd608ffaafc21eeb3392
- SHA512 aaaf738f9152aa641b2aaf4ee1322c6c43644c97f37cdcfac56f43cec73e15b6ae7f25fbd0b7dd37a56a92e77b3cc3ae96343cae4e6690986b33ae0d7b976259
- SSDEEP 12288:XVmL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:wQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T14D55230C6E8D43D6F65A83B0C5F75112D17ABC75FB63BBAFC58878660E30A907838664
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 a7b17273c0b8efad0f975dfc0757fde61c760d48950d5ca0718b2ebb8af71fe5
- MD5 bc9455c4a1d81df5c64705f16454f6b0
- SHA1 1a4d833fe01fa9b8fb9cb7e80255c3ad71eaf13a
- SHA512 a4031841533d07b58730d55237cd94cb9d55915822a9ed4a91e5134f18634dbb302696eafc6991b4d597a4ce681326b3e75be0c55a2eda834eaf86bdca8cbdee
- SSDEEP 12288:c+L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:cWQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1AE55230CACCD87DAF74D43B0E1F72157942A6D7AFB93BA6BC4CCB46656308A13838464
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 b6dee54bd7914b7ad1234e077688be07dc12d1cba7a9827c91d1c885dcb88206
- MD5 1ca951716e15bedd490d22ad87d7dc6f
- SHA1 dd76e0bdc9cb8f3dfcb51eb7af40542703b4c101
- SHA512 e34d1cc9b4b3e43e8f11d84c81c9d19e11eac0b66a70e8a4f56117bfd4051152efbf0ce9a8dd7386aa4ab66696b459fccad946ebb3b046a0b95fc1a529825196
- SSDEEP 12288:qFL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:qvQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T16C55230CACCD47DAF74D43B0A1F76156842A7D7AFB93BA6BD4CCB46656308A13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 3dd522ee9afe2fc0c761766ac027e2923a23409a34217b160e871e3d64ae4b5e
- MD5 48fc52e565fb261d69877e5321fa468c
- SHA1 19e7b169a481831680249fec76b858883c0dedcc
- SHA512 3a2672a12d88cd99979c4005559764f3958c374eafa49c88fc06425e335365f2ef7f2c95ba2a75f20763e1e8bcd57e434f83086d8db1159bf107357e950191ee
- SSDEEP 12288:HBL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:HLQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T14655230CACCD47DAF74D43B092E76166842E7D7AFA93BB6BD4CCB46656308A13838464
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 55513bdf47aa72f4d4a893376e3453bbae0a2691c3a0a7c2f7a80e7ae466e29a
- MD5 e288eb55749d201fe45737f99ff898b7
- SHA1 4d3e7bffd7b32aec472939335dc375b8b4ce8af1
- SHA512 a2f31c48c8b54b6313e3b711c2db6694cce2b1b5e5eaec658198b5c6d357069b1e54d1d816111ed6547663f5f70d3e2645589d5eba9f233c18ae2cfae6aad638
- SSDEEP 24576:MZMkzFVSOzQr4LLN6hKBVfB5EJ+SpYiWn:MZMkzf/Q+NdJBJSKiO
- TLSH T110750258B79018F8ED67823DC9668506D2B27C6A5B70CA1F03E836675F333A11C3DBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 c78a5337a40aa3b6b92cf6f8ca78bd9ac37a2fe80e701b3b99fae8ec264fb122
- MD5 c685722d06c05c090c2375bdbb0b220a
- SHA1 886dad5becccf0866d482a8d74795d19336fe646
- SHA512 5c0c6bd058578f9233a892710ccb9f6005caba0d903028ceac233c8a3144744ea474276eccc4f4a8b1e99ee9f53ed93b80395621d48924486af1135693c12178
- SSDEEP 12288:KEL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:KkQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1B155230CACCD57DAF74D43B092E76156842A6D7AFB93BAABC4CDB4665630CA13838064
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 ebb28348270f518a5f2c657eea4ef524d60c24e158e20be51d11ddc051bcc8de
- MD5 24c60b63c6add83e2781dd30339c9feb
- SHA1 61b93be1b99e000b42630d002505491a1fad15af
- SHA512 5809c747f823b9c50adbccc796423d10e52f80a5d53a464ab0f2ccfbb2edc4ae45c9d86a1dedd01843d77bd6e5c8ad39ce1e81dff47662bb473c7292508cff47
- SSDEEP 12288:7YL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:7YQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T14155230CACCD47DAF74D43B092E76156842E7D7AFB93BBABC4CDB46656308A13838464
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 f983555965305f6e79fd2191edda7a135a47b7d2e2b9a92545ee825160b5037e
- MD5 dc0ca33e3f961a092aa8290db39d6c77
- SHA1 805899f13f78dec4e081dad61d15d71a4e0c52ba
- SHA512 df1b34ae92fdc20b1b092de5099b3d7b75faa652b499dc673a6b0eac404e521851e62539196e99381ed5b500d7c90f102a1536dbf93ce6655c3e022618d0779a
- SSDEEP 12288:GyPz5L8NL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:7zy3Qr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T12D65020B769531F9E16A8234C8A21602F376BC3657619FAF43A856761F336E06D3DB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 a431de1d5343cad7572b03c591e225ae563f8256550278a56ef7d666309fd9e3
- MD5 b1b322732cd898d6c5fffa072d8ebb65
- SHA1 9edd2e7829695ca2deedd0f9619f5711e31c8212
- SHA512 d8f2dfe4403f747d19a6a0c657f4e9c6342160e26cc3b2be846b46023974ef898343e71d56342e68d4c9e4c66a7edeb7919cbb13d9baf0b9a0580f2dbdcb7391
- SSDEEP 12288:XEL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:XkQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T10B55230CACCD57DAF74D43B091E76156842E7D7AFA93BAABC4CDB46656308A13838068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 06aa52e67b6c2b751f9ceb6fad06096a83ff1dc822ffeff45e1b2e6f0e91e15a
- MD5 e354324c58929146fef4e31d6d97100d
- SHA1 1eb936bfdf5af45dd90bee37ba9ec0d2ffae5d37
- SHA512 088bfe972a315a7c4c63220cefdff04de83e9cd33d43242d1039c1aec2956409794254df9384cc47a3d8a5b64037bd1e977177bab99005faa98db8f29167191e
- SSDEEP 12288:nEL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:nkQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1EF55230CACCD57DAF74D43B091E76156842E7D7AFB93BAABC4CDB4665630CA13838068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 b5a1d61c1afd2b562c2dc1f86b30565a352804ad36b7f0bc10c7075356f03c93
- MD5 596dc8c6a909f2e594064fb74926646b
- SHA1 36ba9cc011476d6c654922ba980ae664ee8f8d6a
- SHA512 91eda0290ecdb318715c2a1876f4ae388b6d0a773594802fd03dd88f67be1488f98f780c297e0f61cb76f9105567d5668233ea3c2ed27857fb06d2adf15666ab
- SSDEEP 12288:DyPz5L8NL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:uzy3Qr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1EE65020B769531F9E16A8234C8A21602F3767C365B619FAF43A856761F336E06D3DB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 223c36c17c13952f0acb77305b3e970d27e329bbd74d6fceadc8361ac8fe7403
- MD5 9c0b75eab977352b0bff7d0b3c04ad7c
- SHA1 567eb8395b1481c7393d120213c1a6de30fa659f
- SHA512 0ef26609cf42b1aecaebdcc11d3baaee95634b5d7e0cfb4fba1bf0c13708104841ca51ca09dcdb6deece39eec30c8f60cb33db978639957f2e0ee074ddf6085b
- SSDEEP 24576:nTiaLl3z0zDJQr4LLN6hKBVfB5EJ+SpYiWnt:nT5LljKQ+NdJBJSKiOt
- TLSH T17F750258B79018F8ED67823DC9668506D2B27C6A5B70CA1F03E836675F333A11C3DB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 c1568633ed584f5da4904ceddeb316a224f3a639f1a69dc03cf90571c833cc57
- MD5 88f07defdb34916f391c37c0a264ff94
- SHA1 08d9ea85a6e69dbe39cc5d103bbc095d8bb676c3
- SHA512 aea78cddb10fd15bf8269058b20ef98cf7f3b0bfb196768ef715300d6388c9b13af70c0b6465cdcba7143bc67193bc3a04c84a74af4b8aa059cfc6e1114436bb
- SSDEEP 24576:d3ld9CHKy7GZlQr4LLN6hKBVfB5EJ+SpYiWn:9ld9CHKya/Q+NdJBJSKiO
- TLSH T15E85DF90F7E410E8F1B78A35C9764512DA767C6A5B31DE8F03A8251A1F33AD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 1012250f71e174f29abcf009c983e0d74dc53202fee76c4adb0fabbdb6888b99
- MD5 a8f0b3111ba41cc035e1607ff4e027f7
- SHA1 4b71efed7c9df50ef1c16c07dac2585518d14aba
- SHA512 e2112e290040862de7519d064d32af7d8657cdd3ae5e67ad80da7aed0d7e87af1c421352dcb9adc83039cd9cd075059acd122711fae04cec289a4ab3cbddb16e
- SSDEEP 12288:w3L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:w5Qr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1C855230CACCD87DAF74D43B0D1F76156842A6D7AFA93BA6BC4CDB4665630CA13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 857146c606d1ea4a68ff95883c288bc12410ce3e374462339777651077713e75
- MD5 5ecb6543dec1effbcb8cf5bba94464fb
- SHA1 99d12d057f33032d6d03d3e9b66b8fc028346e83
- SHA512 7f5652fc4a3fce909a9a7bfffeb3fd6e14747b85713bc74c71418135db6c2d3f28617b23bb1bc4cab2d5039680085ab6cc3b14173c04ae92085cb9af9ce42c8b
- SSDEEP 12288:StL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:SXQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1B255230CACC987EAF74D43F0A1FB5156941A7D7AFA93BA6BC4CCB4665630CA17838064
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 ef27f2d0074686ebba5aaa0d6853c68e924200b8ed6c8f3fea26c9194611f9e1
- MD5 ab93b96a13a6a6d7e245621ea5c32e82
- SHA1 b92bf01c118ef045fb56f71f9dd84f8e911a30a4
- SHA512 953469db9df1ed4f0505de7c652e35d796d9d920dfc4d92c7f23a4eb97d788c754617c8f2bc3ba22e64ba1fd0ec89ba4718e05583ef2442a3a56d197972f0498
- SSDEEP 12288:oKL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:oiQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1B255230CACCD47DAF74D43B091E75156C42A7D7AFA93BA6BD4CDB4665630CA13838068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 3ca34275663dab937027cc85e79dce1fedf930e6c9419a37edabbb17eb06a427
- MD5 91a016b49bf0d70cd5dfcdab81f71718
- SHA1 667458a2a2675cf5b30f41a24e395e1a0f1705ab
- SHA512 6805a9072fb7341e195486e6f02b7dba0b37937b38ffdca3a895b926564d0f40dbf2691800ef6eabc86b51b44a80728b1dea2aded2201320a9bc204470ff939f
- SSDEEP 12288:fEL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:fkQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1D955230CACCD57DAF74D43B091E76156842E7D7AFA93BBABC4CDB46656308A13838068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 15786ec08932124e6d905975efbecf57e3ab603d2c785cbac9bf80b5a0e4b65c
- MD5 81800b331468839f059e0bf3e40eeedf
- SHA1 e886d6de566e636d308227c453aa49aa63c73b7a
- SHA512 0ca2230127be1a8ab7446529590fe2ef1e0101427f137eeefaa9d637413b20148962d4d9b451ed40e4f03c657072fd79cca1c9f69d5313f2ad780cd1aed7f31f
- SSDEEP 12288:53L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:55Qr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T19255230CACCD87DAF74D43B0D1E76157842A6D7AFA93BA6BC4CDB46656308A13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 45858b8727b0a94d36f51ab40b69935d779479951e216241d68544b6e7886c51
- MD5 16617ffdd7d9af26de4cc682e0a2aef7
- SHA1 c749b3afe95bb142e73cabc21e64fd60fff1da99
- SHA512 d1d8fbbb762713d4f5687f388549426fe4b50e6acc1907fbcf1ce1b40665b2afce652be5d8dd7e53ac63831bc718a4159c2953f70bf990d7a79484710fd7cc7b
- SSDEEP 12288:H8L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:H8Qr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T15955230CACC947DAF74D43F0D2E75167842E6D7AFA93BB6BC4CDB46656308A13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 854c9024baf5fa272b4bdd15f7c05584cbbf7a8c10cd07ed33df0832a543e420
- MD5 ceb4e040a3ccfdca0861920fd0ed52cb
- SHA1 c8e2fd19226bc96bf5d440cea5ea1045b8f154c2
- SHA512 abb46d2c4c3eb6f2c3679293c33e7f9f211e971c872b995aeba4b4487d9dc2576cd808ef7be8206f328d88cbef114a811b5bd2712f24d65bba37ac23d0625b00
- SSDEEP 12288:f+L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:fWQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T13155230CACCD87DAF74D43B0D1E72157942A6D7AFB93BA6FC4CDB46656308A13838068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.2MB
- SHA256 85ac1334f784621b664f47e41565f75e28594af897e327f27cba588b95d1d91d
- MD5 55fa29640aa1caf66eb4ee2ccd2457bc
- SHA1 8d9f67b4316fdb58a2028ca3fd385c3e11e7af99
- SHA512 754141a05e3e56cf390ed1aa6bec49fbddd14c1c3f9542c79c0d4fc0a09c85b374328facfb557675e3df30c40d4e40cbf99ca8acad07d1eb3597121a73764ca9
- SSDEEP 12288:cfL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:chQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1DB55230CACC947DAF74D43F0D2E75157842E6D7AFA93BB6BC4CDB46656308A13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.2MB
- SHA256 6174dbc774a7c337eabd3f40b91f42b62050c3e3b2c3cfe63df0fa370c643038
- MD5 de72978854bf35cec47e7e860481ba3e
- SHA1 382439e7f137d4f82868c8ab052e21f1adb18088
- SHA512 f81912b3d79f0a5328ab4651e64b089dee662d9c185a39fc0a5a022cb01ec45d7833ed29f518ad17fc78f434c82e635bfe3e97a502a30ceeb438d9dd84b1d074
- SSDEEP 12288:h+L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:hWQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1C655230CACCD87DAF74D43B0D1F76157942A6D7AFB93BA6BC4CCB46656308A13838468
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 775feafd5c345c0ce26148c51f0f866b8e4418c61125608a6fcef6ee4c66f6e4
- MD5 6ff56fef65d0ec97e6af05caa54e021b
- SHA1 7108d7e4424a4fd9d1d0860e3763b5cfbbe20041
- SHA512 35acdbd20efbb4c9a295d241947a62857168583b5b5c4b3f412abda5154840c97c0d7b7082ce4b412f9e5e9c53a33f08217a729aead4c43420117baabaa63a96
- SSDEEP 24576:pfwvTk9RX6wkyAIoQr4LLN6hKBVfB5EJ+SpYiWn:EMnYIoQ+NdJBJSKiO
- TLSH T15C85CF2DEBDC44E5E1B7823899B7460AF6B178695B31C6CF029A536D0E33ED06D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a2e5c9ade4fb66d8fc62a03a41fe21b391867c99a992c0d9608565f7eaf2c60d
- MD5 361af0619a8996288e4e4e59917c96c9
- SHA1 c06174727cba6b620ba954f9677f1bcf81c0c11c
- SHA512 7f459ec59b2828c2731ce9b7a2ab98b6ad41529224ad1c3715814cbaff63405efdf06f2a0397c5161ab447764e4b49a56a7c5647e5d31e18d3346339dd647459
- SSDEEP 49152:FYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dQ+NdJBJSKiO:oySzPlQ6lJSB
- TLSH T1F5066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 95a3d971c8e847818c56f74ba871f2ecf8c8820f1e81579aaef24617cad08815
- MD5 5f0850f01df91e78dd0cefc829bf79b4
- SHA1 51e87cf122280ddbf3983eab9d6e91e845957bb2
- SHA512 b8bce01affd1dfdf4cbf4805c2861072f61e8a0433629c847b774937e94f6501b63a7d4b978a2772f6f75625ed9d97fbfbb53d5d941216661676c59b6a56121b
- SSDEEP 24576:A47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDQr4LLN6hKBVfB5EJ+SpYiWn:A47JUQjTirIhCnDHUPfF/tQ+NdJBJSKN
- TLSH T12865AE1DA3EC02E5E1BA82788555461AEA71782D1F32DACF12B0837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 3409bc501b2d7763a5a74ab5ae8500fde34eb5911009c7247a8fe70acf54d205
- MD5 3401c365933410b77d8dff6fbaabfbc0
- SHA1 1ab7929366301cdaa27b0b8314785b9d3d8ba002
- SHA512 fb50093299787159d69c770e234f864d41fcde032fcbf07a76a49af890566492bd37fd2544a5b43197a3f0ea5bb2983ce9cf3023597788bf484afef5c79face4
- SSDEEP 12288:+qsf0L9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:mUQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1F465F00DD69802E9D16E4274C7A65241B3377C25A7E2E3CB92C4F53E0F36A90ADF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 69742ff2807007a5c78631ff73ca857b1bfb7998b730fb4d0b1b2e63387c81bc
- MD5 dfcfdecb033b25c721036124b365f665
- SHA1 613f28d4df12910129082887a1e061e1fb766ccf
- SHA512 eb881d18ea6667ff20d78836ad044dcdbafbdbd8491eeec1f1f66abe3146b517a28b915e91359a295a1f1c2d2cb38e9e14a601f06dc5e70df0c95a6b10eb96c1
- SSDEEP 12288:K3TjvU3fAH3/5BOL/rIPhnTOOnIO/KLlRzi+g6uNCcn4:K3T7UP4PmLDIPVqOnI+KLlU+g6uNCc4
- TLSH T161452800B626D78FC5A940725E36D6CCAB707D41FE046F0773C98B3F9476658BAE9282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 913KB
- SHA256 57b59acbffddac24d9b11f8f176ae426757bbfbd6a179b27b0945108942280b5
- MD5 f68a937df4314efed65792ef7e3cedac
- SHA1 6253b0de56c1ae9a818c1a775f88605f37fe6158
- SHA512 a4b329669d08dc225da9eb0506d0447b23d0490409073b76832e130603a57715251fb0233e8fcbc9b8c70e51c03062dc4bb8145d040b03b361636ab5e7c55820
- SSDEEP 12288:exWLP9el3QwU6vSxklMmJgzcV0WTOPh/m07VaSJh:ex6PwxblaxFLJ7Hh
- TLSH T127151805A077E74FC4BA40B35331864EBB74DC02BB4A3F0663884D39D866A5DB5E97E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 9955d9c09955ba4c32f9089a77d274ee7dda61a26e0ee0b8388bda2bad350cce
- MD5 07d7fecb9c0edfe3349c1206b1bae1d8
- SHA1 f015e39e7e3af123c102831d07328a12293c6bfd
- SHA512 7bf7ba6277ba7d99baf938caacfe1a23cb7d42d3c7905e5cf8f20dc5c1d573b35c5947f5c7f42e4e7f53c6a1b6cb7cd8de3e135fd9fa362160dbdfe2136e0556
- SSDEEP 12288:DC7sL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:KsQr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1FA55230C9E8C9B9AF6AD43B091EB5122501FBD74EF53FAEBD48CB5A655308D07C38518
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 8eacb46a23e6c192f0ea51b4e097886e19e9d96f75bb8c30428c2344fb34f133
- MD5 39832639808d250253f1e4848555c672
- SHA1 d758f4a1900cd9a0fb7d09349344944c25cf55fa
- SHA512 a33b481abcdf6b4a3d3af59071f4d02d07f2023d4457abcc26e8bc6de71b4352f4c0e44e11be2a46c847d74f9afbf4091e87b77cced73243daab20ac17e3394e
- SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYKQr4LLN6hKBVfB5EJ+SpYiWn:Sgb4mBIBhGFDQ+NdJBJSKiO
- TLSH T1FD65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 8b01df58cd86e028948bac9f8c57f7dea808557aa2d01c7fc7e64be198b15b3f
- MD5 ef2bf3a9b144a6b95294a6480875fd40
- SHA1 35aab6f479ce7d35d3adfb3f497fe1d9b470fc40
- SHA512 0382a66cd8193e20667562f8125134c2e293a490b7718dc1354f7f2480933687f4cf2fe4e1e6ff6e6f790dfe540eb85c54869df696101e8ba24e94560bc827b9
- SSDEEP 24576:3G88u8FpJqH1Qzria7/mzQr4LLN6hKBVfB5EJ+SpYiWn:27ZFPqVva7/CQ+NdJBJSKiO
- TLSH T1E985011976E102F1D47BC13889864663F6B2B8251365FFDF06AC8A551F33AE14B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 156c615709be56d5565995affb43fbd80d36763a836203688045ea0b6ab483dd
- MD5 62f299663369be0bfa877c9537e25486
- SHA1 3855f39d3fed7f50b1a37512b8078bfb33b621b9
- SHA512 53b3147716f28c3b174dcde20bfe3a867b75331d125f6545ed7ef8ccb7d0a0324955141eb24c9fabeb193fcdf0238412ecbb2953c589187bee09f2919e329ac6
- SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvQ+NdJBJSKiO:ZG05lO43bgQ6lJSB
- TLSH T183D5BF6E62EC11F9D1BBC17CD9C6460BEBB23825032556CF02A486A91F27FF4697E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 7044288c969a03b12770ec990d04ecbaf876668a98b3d38d9b50f8ac399e87a9
- MD5 9f1b243ee7d04bfcea21b1b943cc2323
- SHA1 64f7d6c4879e1c98e8dd75cf2580036d2e0ef6fa
- SHA512 dfefc4aab9c9f7bb5da4462547f43aca7bd4a9abbd2cc12827ce0ce50d56a6797bc47e82ebc57265ba6ea2375bb0d5ef5530b42525e2dd4a648f92d83631b9b7
- SSDEEP 24576:rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidndQr4LLN6hKBVfB5EJ+SpYiWn:za5POZ3BJt2pasx2+mXQ+NdJBJSKiO
- TLSH T12D65AF5EA6FC01D5E5B9D17CC583461AE5B1382553329BCF012182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 be2dbf90647d332f319d33500dca3a1dffc63aedc790d7470c70a75684021bca
- MD5 12ca405c9da9f64f73424fb177baedcc
- SHA1 743c7f09ef065b7e72f8d54264abdc3e43bf19b1
- SHA512 2e09b5d10c51450318528ea59293b7b8875ee627b0e93c47c85323d98fa2617c73678c40a3ef411a9e730b22aca1ea8f35626c1e19b20222557bedd9d5d37967
- SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7Fk7Qr4LLN6hKBVfB5EJ+SpYiWn:nNc/zEOVHFiQ+NdJBJSKiO
- TLSH T16F858B1A23E901E4F1BBE1BE89779546FA71786553308ACF0291811B1E73BF46C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3f73ae62fdf96471fab02b4672d069867bf7a9cda17c1dc7f5563064589780b1
- MD5 9fb2df776ed81b66398493770c301107
- SHA1 16e1e5a4f45fd65c2d262360b3849a2bd70016f0
- SHA512 8f3176f2e292febd010b574d54d2666305d85840f7a15cc6e16f7d284b0a27a8df06d01ac6834df41b66d84e7058122a7c0aa95c0fab4cf777d1d6ec7bda192e
- SSDEEP 24576:dTkNvNnaFeYhJNtmZBmhQr4LLN6hKBVfB5EJ+SpYiWn:dTMwBtOmhQ+NdJBJSKiO
- TLSH T19555AF2EBAB846E4D1FEC6B4CD238512E6727861173293CB5290C13F0E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 e03b535c76a598e20c05a1c4f3324f589f0440655b7d47b857007e6a9f57e1ea
- MD5 d8a01fe1d0f729343aebb7854a010603
- SHA1 20787412799382dca4a9a411ed026d4f5aeaeabd
- SHA512 329df8a5436289971fdd7c7a1c4aa0c1b104fd740c2e627c85555732f50809582769062f10e089697de642ff84c52a15e8b0a4ec2bdb1ed4d29d249291392889
- SSDEEP 12288:sHvUrBFrEjwaQVL9QPWU4LLNEJ+EhKKsJjfiiea60n0LJh/fOnFBSpY5EW+I10:sPUr+NQ/Qr4LLN6hKBVfB5EJ+SpYiWn
- TLSH T1D765E11E66DD18E5F67A917C85828219E772B8625712E6DF02D0817E4F33DE8BC3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 e90fbeb7d7642ef6d68628aaf898b1a059dc3e3bac4ecd51c50d804d96baca60
- MD5 9fac7e106e4ae54571ddecaa49c6dc08
- SHA1 9027f1f9a8c1488ea33106fa05fa5b82b18624f3
- SHA512 ce70cb0635678a604680b93316cbe1830033b054c753bab69a9e3a23594af3b0ef5d5f18626265d0d351ade43c73aea76e67062e42db17b6b587f283e20f16bf
- SSDEEP 24576:lD3FHshBIYQgAwQr4LLN6hKBVfB5EJ+SpYiWn:lDVHeBIAAwQ+NdJBJSKiO
- TLSH T18D75E12DEA9C04E4E57BC2BCD6A38606E6713CB9032266DB01D491B61F67EE47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH