Analysis
- max time kernel
123s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
- Size 2.8MB
- Sample260705-am1b8sa18j
- SHA256 60ae8596133adfef6cbe388e14e786f181072c4159b34170fb3cad536a1d2345
- MD5 f7404ac9d844944c236fd1a42579b32d
- SHA1 75b71254e1333065086dbcf1a61a0ae2ef7362d0
- SHA512 f49b632ed15c261e7a7afa32d629a0f1a4a8bdeadb6da0647f302bcc6f76835c4b887796d2dab5179f01feb435faf0fb75e977aa53669ce1b08f4341c98ae2e8
- SSDEEP 49152:4tbIwL5D4Jc+b01tnAyB63TANQnMEx6Te8wTuMdFrIe78vH/:akPbiHW6ZWTjYvH
- TLSH T1E4D56C07B3F941ACF0AAE2B8D73156329EB2BC53CB34A5DF125416151E71AE05B38B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 1000 elevation_service.exe 5616 elevation_service.exe 4480 maintenanceservice.exe 1620 OSE.EXE 2832 PerceptionSimulationService.exe 5528 perfhost.exe 5924 ReFsDedupSvc.exe 1604 SensorDataService.exe 4432 ssh-agent.exe 6012 AgentService.exe 1560 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b034218a59cd5fa8.bin elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004528ed2f140cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008c98962f140cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc9cb031140cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004546f42d140cdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba27ff2d140cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{644E79D4-C090-4B77-8168-D732AA1DB5CF} explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{8B98A1C1-A58D-46D1-98E3-918362DC7AE6} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 3812 explorer.exe 3812 explorer.exe 1000 elevation_service.exe 1000 elevation_service.exe 1000 elevation_service.exe 1000 elevation_service.exe 1000 elevation_service.exe 1000 elevation_service.exe 1000 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5556 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeBackupPrivilege 5924 ReFsDedupSvc.exe Token: SeRestorePrivilege 5924 ReFsDedupSvc.exe Token: SeBackupPrivilege 5924 ReFsDedupSvc.exe Token: SeRestorePrivilege 5924 ReFsDedupSvc.exe Token: SeBackupPrivilege 5924 ReFsDedupSvc.exe Token: SeRestorePrivilege 5924 ReFsDedupSvc.exe Token: SeBackupPrivilege 5924 ReFsDedupSvc.exe Token: SeRestorePrivilege 5924 ReFsDedupSvc.exe Token: SeBackupPrivilege 5924 ReFsDedupSvc.exe Token: SeRestorePrivilege 5924 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 6012 AgentService.exe Token: 33 1560 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1560 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1560 SearchIndexer.exe Token: SeDebugPrivilege 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeDebugPrivilege 4392 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeShutdownPrivilege 3812 explorer.exe Token: SeCreatePagefilePrivilege 3812 explorer.exe Token: SeDebugPrivilege 1000 elevation_service.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1360 sihost.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe 3812 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5028 StartMenuExperienceHost.exe 4612 SearchHost.exe 3812 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5556 wrote to memory of 4392 5556 2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe 88 PID 1560 wrote to memory of 2352 1560 SearchIndexer.exe 100 PID 1560 wrote to memory of 4928 1560 SearchIndexer.exe 101 PID 1560 wrote to memory of 4836 1560 SearchIndexer.exe 102 PID 1560 wrote to memory of 972 1560 SearchIndexer.exe 103 PID 1360 wrote to memory of 3812 1360 sihost.exe 111 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-07-04_f7404ac9d844944c236fd1a42579b32d_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x308,0x30c,0x310,0x304,0x314,0x1401ba6a0,0x1401ba6b0,0x1401ba6c02⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5616
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4480
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1620
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2832
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5528
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5924
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1604
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4432
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6012
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2352
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4928
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1568 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4836
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1492 1480 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:972
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:4164
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1492 1480 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2188
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1568 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1084
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3812
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4612
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 501ebf54672d46a3bf2503035f5e3c11c0beddeb08eef24a6fb9607854f13283
- MD5 6220019b569d7b6cb39ec8ec1036b22b
- SHA1 9cc240edb5122244e3474afc042b78704fec72a1
- SHA512 0aea80bdc93217e108f8e026e81644d8953b2dcba04190e798b305104ca0ae6ef1771567bfbc22b9a25523acaed017236373ab2d8b613f11a6651af4cb020c18
- SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjMdFrIe78vH/:a3q6sjB3TjYvH
- TLSH T186D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 22c149d6e263e298761db3db5de021479a1f0ce94f059e01e4614c58e870f11c
- MD5 49c239b06dbfedf47864427e66fd3ce2
- SHA1 d37e2cbe2971f2ed9aa2d4de29c0fc70d5154202
- SHA512 1c8a8eb7ef6123864475ddbbca0e70a9aaabe20b14f6396515e72eaccaa1c345cbfc7a5bf086c389aeaf60380f35632f9187c48f45edf90da4492fb293db6169
- SSDEEP 12288:i1XLsswWkxy2lRq2czAn+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjc:oXYfDtczAIMdIuwe3zfIe7xmvH/
- TLSH T18E65F129A3D508F9ED678278C8A28112E672BC554760E7DB03F099362F337D85E3DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 a6441986fb5fc3af86bf8e9d41e3f7fe771eddc861786075f487fc81884cb6e1
- MD5 c225bba7e3a87a4b2f619131c7e868be
- SHA1 159e1909733811fd0d9e86f7f64739633628c4d4
- SHA512 90d0546c9c17133cdfb3ec2345936cf25c001e3a15ffaaf8c8b2fe6615b1578b75728775cb6c53239bf825c7e7b8ccbac5109e573191dcb4d5cfc5ead4b9ef68
- SSDEEP 24576:40Le5ji0hmxxrMbMdIuwe3zfIe7xmvH/:4Pji0AjaMdFrIe78vH/
- TLSH T1C485AE16F6748331D073C0B9C5D2A69AE97130861B308ACB4296D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 205daad974cef53f1ac0b88f85b4dfbf75f62a2a9c4fe22dee8cac1b48f91116
- MD5 68d5463745bd58e2eb55efead936faf8
- SHA1 fd9ef336ee23df1d0e39d91b52fd8a969b099430
- SHA512 d6cba78bd2b6257fb0e88da9ac1005ce5cb82a9f14c1cd6dc05952e5168cfc0b63ac2da3f36a3020b1b4e7c48e68ff1b14710441bac1d875c35b065a30e4a4d8
- SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWn6q8wyuhMdIuwe3zfIe7xmvH/:L/ezSC6vUzPveHjy2MdFrIe78vH/
- TLSH T1F6756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 9fde713a89ffc0ee1eb06b124045cfd5fa2dbbdb0e45f296c212439e8951b8d2
- MD5 e925b976d97c75fdbba6401e850b2532
- SHA1 6d2ecb0cd200091f94e8fb1ad54f8affdd3e3a8d
- SHA512 419669126e179b7300b273b69de7f31e866fb624ad46786d9eab6de426fc36d0a84c0c6552594f5f165f5ac4377cdadbc687149fc0721dd4135bd20abca329de
- SSDEEP 24576:IVbqPb88hv/l+YMMdIuwe3zfIe7xmvH/:IVO88hXl+JMdFrIe78vH/
- TLSH T174559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 1b3b938a9d65f9d3d8e08c12ecddf39c482dec177957289252e0f8efcb2bc9fd
- MD5 ec052bf1706e9f0ad1c4230bbe77cf90
- SHA1 7cb0d2eb796b30d606b9e38ef0cb4bcf5f2f35fb
- SHA512 f9ba4fa6e0cc2b00132114ea14183a1e1592fea1c1253b5c4403d246426006e3c70a0140f1fa430f880167a2180073ea3f019ffb145fcd2753ad99e6410455fd
- SSDEEP 12288:uL2+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:uL/MdIuwe3zfIe7xmvH/
- TLSH T10145231BC746C4D6E79A89B0A45070F326A4CD6E58519EAFCEB07D3A7B78D2BD0C4017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 a6c59e85180aaaee73103c9ed29ebcf1f1b59fe379aba3334cd60b6f4592b879
- MD5 7be5db82883a34db3407e1b1cea6ee46
- SHA1 c5f7caa421943d758709f220e3df3dec0aac1632
- SHA512 cb7daaf1eeee4adde53b0fabe2728e6fb374748c42503de01aa120a57314cc65818b421fe241d8df4856a95ad45b9f4996655d3f76398de6bede48767f364587
- SSDEEP 12288:keBNUbTVO86Ur+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0t:kJIUkMdIuwe3zfIe7xmvH/
- TLSH T1EC65CF3BEE28FCD2C27A8DB856918240E77278314F62A3CBD175820EDE235E55D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f8d2c2687c5358581d6ee68a4ff2e57376f926682635d093fdebbdca44ba8a77
- MD5 3e5c5a7ea0c2f2bb1201b4489db69d92
- SHA1 a7072fbef76bc0319930d9ee917ea7197b53ed2d
- SHA512 c5ef37a25de8eaf506a169c61c133b400645417c7e1b20fc72e72fb3e6c4cc5aa6bdd29f3bc36718d20a6a304830846e491b4e6f0ad7ae6f2bf529ceb3139739
- SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH2:7QvGAdlCEL8c/DRNw5CSTjYvH
- TLSH T101267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 5dd28956cb39ff39b524455fe59d11b31c0385abb8b24b1b9c6018a7848b05ce
- MD5 ad940eddeb91b58ac76bf11015c9152e
- SHA1 5884b8a3309d855b6db469e4a8ed70273f97c405
- SHA512 c150a58244b01463259b687d990728a917c9de4855d49467e70ea01f2c8cbee74771ad49ca37fe2f51835d75a12a9304925f7f3a19b740a64556cb0ecc1b4938
- SSDEEP 12288:AAwSfxL/2Dc3RDLLmt0LDQewsAjp+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIp:V0ewsAjKMdIuwe3zfIe7xmvH/
- TLSH T1C775E031FE75D036C3BB0DB21B26D716147CA9204B511AC3E3F89E9E6A346D22376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 34bb59dbb649dd6dc8e00947a71086f24f118388a4f57c9d4fa51d33e02bd726
- MD5 38ca43fac9c4ba85a82e042e47580291
- SHA1 535267ad863c3fec32d59f0bdee1afd6ec37b88c
- SHA512 809786744fae8213cdb619ca56e25ef502d427b051e3ba939e5963f6f135fe4b61b3185a12ac7d5bcb19cc4c954f0d5c4234921a4b7a351b643d433a9440e492
- SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHBv:YUEtQevvqc2W1cpV2tI32J
- TLSH T176474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 b538bb133d7a15be0ab4951a3d32c1d207d69d03998793f3a418c8d0ef929721
- MD5 278a7a884bb6694d303567461245246f
- SHA1 32d437d978c1f63985ca1bdd063004d11b1a6ee8
- SHA512 000b4d7b557b68a080ab4504f42657144eecef915ae9b2de8517bebe811090da7d5bafd80149c31a5c063037e29fe3826efd845755f566eb1b6f7430938e9481
- SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zqMdFrIe78vH/:ooquVjnmOTjYvH
- TLSH T10CD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d0fc51528f077cc8f473b0ad54ed3af22f0e507d74cdeb7a923374d39aa4f5b3
- MD5 6e7cc8f8b8672ac6b6aca29bd5006a81
- SHA1 904a42678db4c6638167ff390ae737993cd0696a
- SHA512 d0bb9d7e035cc32c955e472b0b05a4feaea0c87d0816906cc1380f21298559e122507c43e24afcd117751ab527c413fd9066d20eb8963de7d5b08febcfab4876
- SSDEEP 24576:7AhGL3IFoiwtA5l7S53tMdIuwe3zfIe7xmvH/:7AMUFoiq59MdFrIe78vH/
- TLSH T1EF35AD81E7F945D4F5B39AB899B69171EA76BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 112e1365cbefedee33569ce854a1e394eae3580d2f97b40c1132b50ac7377d08
- MD5 5fcf2b77d7afb7dedc0b5af69d001195
- SHA1 6397c1149ac9d53818d1815e700f95c0b6dddb0b
- SHA512 a93218f5040346027d96d0cd57446ffcc0519c88b4e1737c287161173a88aa1daba840b92ca47d10e9096d566369f5d8c123247348b84f07c08f1bae42e39698
- SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+Co+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:Qwu4OWWMdIuwe3zfIe7xmvH/
- TLSH T1FC65F14A76A50CF9E9A781388557D132F7F2BC162A21DB1F4770C62B6F37221AD2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 77661d4657589bf954759c0d07e0d28a3286454355c5b346bac1eff5d1b955de
- MD5 5db3221a9fea3d95123a7aef1f7733fb
- SHA1 e7687bafa111d8f8bb279a1f68a34fd1f2a5ef6f
- SHA512 4d7113b84d98a3f4c1e393540ff66282e30477556e492df8f11b72ea940565b663b55fe2b4feb535f338bee813e7c8062ee442abd6cdaae1107cb0501e030138
- SSDEEP 12288:CeZ1Iy5+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:PZuTMdIuwe3zfIe7xmvH/
- TLSH T17E55125A23D460F9E2978178D8E05196E7B1BC6B273143CF4A705A6A3F32ED65D38323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 bee18fcea3c5d89607accfbe6083dbaf96ed473540fb32bf7eed776cf862aebd
- MD5 bdbcd85541267c38014f12d58957e138
- SHA1 aa771798e66e55c35142a860e50e9f3f5e5a7272
- SHA512 77df01bd76f29efb1ee5007f8ef4ac2561612ff8dff99c495965ff21e21bd7b4c8599a6b2e88ded58d4b1e95a61ec5210c35a2e85ea7064820ff38cdd4164844
- SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:1QRQyi36YOcPbLvw2gAf+PN3rTjYvH
- TLSH T18C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 55e4b448fa9269e9cb53dc4e982915f9d173cbc44cd9b43d29c4031b2dbd85a0
- MD5 2d10e1876d40c0b8389b413c1dcef534
- SHA1 20f7dcd5d4f7298ab0ed647140a9a2dbc52fc58d
- SHA512 b7c20ba5502d2de41c90cbae345b50d9a28f1c73d0f32dd615f23873d3ed1fdb8ce5fe564570c968eebc1d93521728df1e73614628d66b8acbf97613ae2ae16d
- SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:CQRQyi36YOcPbLvw2gAf+PN3rTjYvH
- TLSH T10A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 17b39a0c974f470b1b6073bc84688ac697809dd05719a22dcc37730f22059bdb
- MD5 a8a0d3d4ba32bda9ce2712cf48d6137e
- SHA1 64223b5fa0cca5045ebdc0535d54122f05b42c8f
- SHA512 0a7867cdc4450a93dc4a4fc141dabc0b7ebde78dc8deb686f41d8cb9f210b1f891a8cfe9da7995a9628c19ddbc7bf3598365c8f3fb54999e8a557d46b6e830d9
- SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0jMdIuwe3zfIe7xU:n68Qg55nhceWu7PNU3/aMdFrIe78vH/
- TLSH T165B55933B2F200A9C44DE1769F4A973196D17C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 86d6e267c677a1e1b4a6c7fda5c4a7bcb3ef65eabcbd79b489e75c8afc1dd0a3
- MD5 f3a369c000d2e717016e6f93177cf4d8
- SHA1 42860819eb5e81080da808d3c2d6108266a44aec
- SHA512 376db962ec74e05b1f23ae8a1aeb337a2ab2134ef2bb4708618a64fe740bd8508c44f9f9a522e8d9db8afabd53087bd212a7e3e79d2232cddfeb5e05e27dd05f
- SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:My5112gYy5azzVvt69nLKnhZkTjYvH
- TLSH T194167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 105c6218a62ccf991c4cb6433e84b354cc50babd22b9b36dc16760563ee66cdc
- MD5 56f4ffbd43853e85820685cc6e3a2e70
- SHA1 56204179c965b2858af703c929ceb3fe6c1e8854
- SHA512 a765b089b17b9ff602e93007d771c5c4c8cd6e7ef0aab3f21f1ef0e4e0919084b9352dc1f9f69ce16cc6caf0e4b47a23f9f9aaa331e1d3dce49f15426c39f3ca
- SSDEEP 49152:oB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsMdFrIe78vH/:iu6Jmdxd2dnTjYvH
- TLSH T151D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 dcc3bd3f52ce59ef3443949a09289bb8d312e09f8b7ab840cba24f75b40b7f3f
- MD5 cb8c7d7f955f0688ee9db12174334c6e
- SHA1 5a5e51e65ec93d8d2cc76604915126d5cdd4fa78
- SHA512 a0a3d05f108101e8834ef86543fa8e8477eb2824ee9a08afa7cafd5d9fd51bd470bbae8218a541c23f166946da56c3d280feb82b3a3052400af5a7521186d6ca
- SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xEMdFrIe78vH/:2mifPWROTjYvH
- TLSH T1A5B5BE13F2D901E8D05EC17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 7d725e5145ff309656fa4cb354049d76185a4c667ca7d8ca384bdbe562395305
- MD5 21f50e3fb0dcf38367f3b60c1e163ed1
- SHA1 8456410e159bed2118a8533a7dac6e3295b7a4a4
- SHA512 ab31171267616aa51f7dc76550fd979223ed442d28575d39c792d9b39a2026a60c743f9acfbdac5b955bce311ee24723d13f6e0418d8a690b302b434de0dcf07
- SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHqTMdFrIe78vH/:g5dKii61YTjYvH
- TLSH T1A3C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 02e23ba1d6988597b4477dcbcac981cbed27d41544d9cc5529f8b203bb957bf0
- MD5 100a849b2038376b328f7b16c2bf7be2
- SHA1 dd4b98e8a0a48a0121775583820de2b3142e7b49
- SHA512 a77b83d8ba01a4a95efb4a7c6849d136b0cb3c32ca9bb765209ecbfe581f5be41e25f71db3abf4b9d1ac8062790e02023cecfa7dff820b8649b7fa0e781855a4
- SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wIMdFrIe78vH/:eX2imphaTjYvH
- TLSH T1D295BE13F2D900E8D05ED178C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 616b7fb949a54b9fe842f704d3cead476b9081c2335772483cb0f12279aca38f
- MD5 046f0af0fba82af7a026f0ba12521d6a
- SHA1 3e9f6ccd28160d648b23066efbffa502167cf7bf
- SHA512 8b9eee593b562bfa323361fbcc2364b39baa586e4d257a7224c90686cf85b87e1bbbe93421ce4e64f95aa2b27e816e97ed7009fef1b2986576af1de9d2b79c13
- SSDEEP 12288:Uu+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:UXMdIuwe3zfIe7xmvH/
- TLSH T17145231BDA9BC4DAE3858AF0905071E36598CD6FA91249EFDFB06C367B74E2B10C405B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 64899d545a2a6710f0e1b905133918717f29fa36a73cb44f24924519f66c1a3d
- MD5 336682a79039dcf1addafd69d562faf3
- SHA1 28fa5edf91a0593bc43fd2f1b1e8550eef20cf35
- SHA512 c1b3df89e1d20f9eb4a6544510131a4ad754bdcb88da75f07fac458695e6a79af4caa6152c84f9afb0286e952f6eaf484223980a0a06d958c4572897886657b3
- SSDEEP 12288:MF+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:M+MdIuwe3zfIe7xmvH/
- TLSH T1C745231BDA9BC4DAE34589F0950071E36598CD6FA9124AEFDFB06C367B74E2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 14a3605ca0458dc366ec59aae4dc21ab2d770ebfdc53f03107e68e9971b3c8e3
- MD5 c2cdd07308c9901b3a0782915ae87f42
- SHA1 3628ab3aadbd9fa3b9be16aaebfb1698d2e2906d
- SHA512 7947604a8a70a40191c606f67f107242a7508da84dadd1957ca3411427a7d55d9fc9a810a239f048d9d69824f9aa66fae658c7f884ddffc4e711c57153a7cdab
- SSDEEP 12288:dD+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:dcMdIuwe3zfIe7xmvH/
- TLSH T17545231BDA9BC4DAE38489F0910071E36598CD6FA95249EFDFB06C367B74D2B10C405B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 6c4b3804952d68939ac90bbe94da4a476032a40dc62ce87145f60c7e920f3c68
- MD5 325dc03d5d9e51a3264116b6238937d7
- SHA1 2be7c612ac971102582ad86fa95f4313e95299c6
- SHA512 a4afa49e90f4cefdd91d8a347f8dcc2edd13e675f07b3b3a502714ff6affd258786deeb4ab498ee092bd26adbc8a77fb7eb777499818f026119848a0dffb7f46
- SSDEEP 12288:2Vs+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:yMdIuwe3zfIe7xmvH/
- TLSH T199452317979A80D6D696C6B0C42060E3A2F4FCAFAA325BDFCF301C2A3F70B565494657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 b364706804093730edba0767f5c77b9f39b054283e00f9e04fb2a1c5472ed81b
- MD5 5b8b9ee728ddbe701002e52a69edf5d8
- SHA1 b082e458e838cdd3e31f7ca0713cc574c4938a65
- SHA512 579858798ce93bcde33b1b9029eb94976590d0e44af75c2ff4debda8c7b27eb57a9c2a9b2d36c42b35e8c23b94f0c671269fb9e9a7d16a29b28d611082e701cc
- SSDEEP 12288:6U+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:61MdIuwe3zfIe7xmvH/
- TLSH T14145231BDA9BC4DAE34589F0950031E36598CD6FA9524AEFDFB06C367B74E2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 8e2f8e3674ca472c10c33e6fcede699026a6447ce60dd87be1939ccd042d5081
- MD5 0cae099e003b2703ccb4a6647fecd9ae
- SHA1 2d94b6898798f3ff48d9dacc5e75079334bad890
- SHA512 451c6f65fb033054862d71ee5d03801df3b6575beb460c79cd21258bf7189f8d61e11efccf0e29bf6ff2cb9f171136dca3c0f8640d328bce28578aedebc86f87
- SSDEEP 12288:CB+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:CCMdIuwe3zfIe7xmvH/
- TLSH T13545231BDA9BC4DAE34589F0950071E36598CD6FA9124AEFDFB06C367774E2B10C806B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 c4eb244f540676cbeb0799c93e886c053dede09ea9e175948595b572b8d49531
- MD5 cf993c63b4c704472c275f450afca48a
- SHA1 93737179bf39a4affcc48ee948789cda909d4496
- SHA512 ad02f41db56ebff836cce46741cf2ac9d241af7f85fe89ce920ab21354d2d89f1423d45144318a8dc2fe7da5d1230483bd83bb22e83e5787aee926168108188b
- SSDEEP 12288:Wt+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:WmMdIuwe3zfIe7xmvH/
- TLSH T17345231BDA97C4DAE34589F0950071E36598CDAFA8524AEFDFB06C367774E2B10C806B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 a1a033f44a4ca5f85b35ce443ebafb3ae0180d3c95ec3f61caab869ecdc1577c
- MD5 a84a9aee4a002cc5999e68ef0a5d856b
- SHA1 a31ae6c9c21dfb497946bf98d71ec34705eaea92
- SHA512 44d816f0e06fc7763f4a060cb1384418d7e624b0191621aa22d99cf53acfb4fcc13001d713f9be7aa2cbc594ae2acfbcce1fefe252a2fd25d20f2dba9fba4172
- SSDEEP 12288:CiZwbVzzFEoS2cPvyl+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUM:lZMRzFVSOeMdIuwe3zfIe7xmvH/
- TLSH T199650295B39008F8ED67813EC9119956D2B1BC6A0B70C65F07F436276F337A11C2DBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 7322d8b30611a4405cc34ed0cf4f983ba649d13d7e26d5b23782d185d44f6a68
- MD5 60fdd3eb46e9e8c346aceb3de2bbea74
- SHA1 b1d70728fec14a03867feac654bdd5cc6ac0030d
- SHA512 30689f59c6d7d0378910fbfb93e9563733b52ef6a2a1cae49cd74e4a8d4b860b0a8c52137c9aaea174af54f0a1d19aef388d18f10f62f3b10946578d08fb8fe8
- SSDEEP 12288:6i+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:6DMdIuwe3zfIe7xmvH/
- TLSH T16345231BDA9BC4DAE34589F0910071E36598CDAFA8525AEFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 2a9bf2a63da48b5ac5ce34e04d8e2e24fe139850f77c20948a0ea0d220632444
- MD5 8db84ca2e852821f122f8d1705768025
- SHA1 855973e6134606e6ef36c7b2567d50646ff989b4
- SHA512 243e16ba88117492d2b15608bfee2479bd1df3042b40e111263cfb29ed5b9d6575f056ab178d50334bea7364a0e00fab4c328b9377b31efc04accd6461e14df2
- SSDEEP 12288:dG+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:dvMdIuwe3zfIe7xmvH/
- TLSH T18D45231BDA9BC4DAE34589F0910071E36598CD6FA9125AEFDF706C367B74E2B10C806B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 6976c0efb1ed377493f3ae96c6673f81f99fde775a4a36faa24c69a6d7fd4ed6
- MD5 6e2ccb6b632c68d2e0e2eb08210edbcb
- SHA1 5ad2791a06de41982a75264a5ce6a791cb3e6368
- SHA512 b9ca0addfd375b5ca04f06fc7b2aff19911de8f42aa9c9c7777b747140fd1d9e8b4a9f476e43def78bea33a99bb1bbe43fd3a4af3d1c5c76171033f7b43f64e1
- SSDEEP 12288:byPz5L85+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:Wzy6MdIuwe3zfIe7xmvH/
- TLSH T1CE55121773A620F9D1668274C8611692F3B1BC3A4B208EEF57B00A763F376A15D7DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 b9ed04ae96d6b6e16b891852e464e12c8bcccc545ce5b4be3258ee62d0ff3b17
- MD5 6e9c909c6edb4431bb0bfe51c26b3c53
- SHA1 3ce2ab67d967a1d7a21c08b7a101a4ca47efd762
- SHA512 8b085120f39c8037acac81b855cb8a4f3a8a81abd412ff274ee1fe3d358e62abc0243fc0612ae9523fd169890ac10785e079b03a6d3a30b377b85c16db9d3ff5
- SSDEEP 12288:pi+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:pDMdIuwe3zfIe7xmvH/
- TLSH T1DD45231BDA9BC4DAE34589F0910031E36598CDAFA9525AEFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 165e05772b53dc3f59ce8f5a214d9945bdc5310e5575820b9713434c9f2f9996
- MD5 f140f11dc6f74e1b173c6fbf68478b52
- SHA1 88996baae161effad2ed7880b9c94d303689f050
- SHA512 5b0e420b8ae190736b2142ded2e1feae044986f9ce81661f311bd8e9825f09effb5d607c33c6ad54038c429b628642bab2e3543d669ff53fd6bac2e04cc4d0b7
- SSDEEP 12288:Ti+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:TDMdIuwe3zfIe7xmvH/
- TLSH T1DB45231BDA9BC4DAE34589F0910031E36598CDAFA8525AEFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 6e1c1e6d1f210bf4afe9d11a65aa2b92f15aa4599e567a1c4ee84042c83d8dac
- MD5 2e2a5a0ef6ce2a377e642385683c6142
- SHA1 deb94b2087b1b5c45bf578bfbdf43e768ed2b46e
- SHA512 a30df10dc6e89f907dfe77c0ced3d2254b996fa9d6dc9ca0561cb9cef9297bbcb04c4540046acfad84dff092062a94b7fd1ff5e556821bf773452f920651c164
- SSDEEP 12288:LyPz5L85+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:mzy6MdIuwe3zfIe7xmvH/
- TLSH T17F55121773A620F9D1668274C8611692F3B1BC3A4B208EEF57B00A763F376A15D7DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.4MB
- SHA256 7a6961c4a973872ce7f40fd4c57a5f1115e44bb1502af86f5cd1e9d816c66032
- MD5 50fc5407168722c40b6eece7a5ead001
- SHA1 bea70ad8da689e484973b3aed530a679f41a4f73
- SHA512 b1ea830106d7cdd792a2f3fd0368cd84ab9a96ac17f7884cba34dd5b0234b4a14937bf3cb7f745a9839c377bdb87db132a4d30eec0b4cc855aadccc4f9e9ad82
- SSDEEP 12288:eCd9CWYoaLHF3z0z04PDvhz+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:PTDaLl3z0zDsMdIuwe3zfIe7xmvH/
- TLSH T1F66502A5B39048F8ED67817EC8119556D2B2BC6A0B70C65F07F43A276F333611C2DB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.6MB
- SHA256 4a7abb96826f7b71c442831f65d94cde2cc3c9060a65825ced767defb19d1710
- MD5 c73133184501cc2ecaa8d946ce7f8c80
- SHA1 6f1df44828008fdecf2beb9989112482c8921c0c
- SHA512 a4a8b564ec98af4c7ca38f39d970d1ec9787949629225a4c223d62acd31ecbbc58086abd086ffa77f46abc1a8dfbfe6135c2dad75a745ca433b88ca7d7017667
- SSDEEP 12288:Pi4e7KRdTfgwCHKy7GLbbdIvQ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7o:P3vd9CHKy7GZAMdIuwe3zfIe7xmvH/
- TLSH T19975CF91F3E414E8F1B78A3589765512DAB67C5A1B31DE8F03A4251A2F33BD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 623c9c52e84fa7786e0275f508a8bb2a5e1c96a8ea71c8231eebe57764d7e2e2
- MD5 83c45c25e73925859d53b7b1610b3ba2
- SHA1 da6ddb8b9a82fc809faabec84692aa575b1e812a
- SHA512 ecde08a6ec04cbbbc2089a7853b944870ed6058fc26af7d7f645ff42b4608e718e2818e0e14eb591a2336c06a3c0c3f383195de96cb2d89fb98601a2b8a2b8b8
- SSDEEP 12288:Rj+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:R8MdIuwe3zfIe7xmvH/
- TLSH T1CD45231BDA9BC4DAE38489F0910071E36598CDAFA95249EFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 b5a49cb4a5ad4d54eda2cd610a120466ff34b33e2f7444ad7978f38f46da39f3
- MD5 6c97736154c96d172afaea585205b120
- SHA1 ff08fb38b09dd25fc76df071142a4d1866532d6f
- SHA512 621b029a7b0ebf4d045d5bcd7ef0e5675f1a6f470d4ed3f646b35a1f7643781f94f1d49206523dd0d3ce76d56107019fd3fb46650cc93bb51e2561f83f80461f
- SSDEEP 12288:WZ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:WaMdIuwe3zfIe7xmvH/
- TLSH T12A45331BDA97C4DAE34989F0945071E36598CD6FA8124AEFDFB06C367B78D2B10C406B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 76ddb4633fe7dcd408f281b6ed6a1aa06f482ae13c852b2d7875095c07bb13ea
- MD5 600207badd4a2d0eaba5d9bab5f999ed
- SHA1 af873e66077bbae78553495d9a18ec3c928eb9e1
- SHA512 24c0acd5bae88195172b770a47de61573daf88b7351e648248ff5dcc4de0903a133db473e1719401d957d72a32259f8b867a35b43f36fe90d3ddf9c82722ce3b
- SSDEEP 12288:OQ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:OpMdIuwe3zfIe7xmvH/
- TLSH T19D45231BDA9BC4DAE38489F0910071E36598CD6FA9525AEFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 5d692ceb1df7b407b6b82fe17bb28a1a180338752b3451cff4a61f27b07243ae
- MD5 5e2fae447febf80ccc24d3185016386b
- SHA1 2545c40a8f2716f89c25383fafd6560735d4f497
- SHA512 e1b59357d3984bd7d1fd782a1d15464e594c82e96b333be545bab845f2c70ac925259aa1f5cf74e0f1e0c649fe0df6b9972cd469258c6427ee9bfab5ca67ce6b
- SSDEEP 12288:qi+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:qDMdIuwe3zfIe7xmvH/
- TLSH T1CA45231BDA9BC4DAE38489F0910031E36598CD6FA8525AEFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 90a7265b0686bbbaa58372d458812dbc6330f1d313fe4775bcf8c9c73cdc9370
- MD5 a0c733f99eb37f0dbbf26c265f7bf755
- SHA1 0b25402c4ecdd8fe603546356079452c9d5452b4
- SHA512 c88674e7ef3694b23076f6b409f55f72fc61d0c70631f51da050d860935c3ee5541d5088a1be9270729117c6365bc66ed4c90086c150dd9ee41c1f4f8764634a
- SSDEEP 12288:gj+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:g8MdIuwe3zfIe7xmvH/
- TLSH T14E45231BDA9BC4DAE34589F0910071E36598CDAFA9524AEFDFB06C367B74D2B10C805B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 ede7f53c6dab5c5091e94d7243e28b5012cfb71f7bb6496dcbee17dcd4c0f9ed
- MD5 bd2d0e184ec8c7f23e1f8c7929b51674
- SHA1 979d53408823d0df3a7297c636332f13c11b571f
- SHA512 97279d1195b4a27cdf4ea89e6ff21ee2eb5ddfa2d895ed995e7e6d07e2d8361e4bb8f402c2a7978d4e14b4b1d666b486d492d944659ce03dd1c000e6147157c4
- SSDEEP 12288:4q+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:4rMdIuwe3zfIe7xmvH/
- TLSH T16645231BDA97C4DAE34589F0954071E36598CDAFA8524AEFDFB06C367B74E2B10C801B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 4e8d36367758d262e1e5d4d63e558415562f4ff0e892a96fec19c43f0643abb2
- MD5 f63f8106cfbbc643273de53a37da9591
- SHA1 3ddd49ca0f44473692c143fbe3daa6c99c4c7bc2
- SHA512 ef8a453e32110b3b8314d6f4aa694b505d2f7c556d5ced08792f114989663c0a15d1aac26614d1fcf3bf2173dcf9aa787c9d809e5253ab59745f4c488bc4b8f3
- SSDEEP 24576:tfwvUk9RX6wkyAIfMdIuwe3zfIe7xmvH/:/MnYIfMdFrIe78vH/
- TLSH T1E285D029EBDC44E5E1B7823C89B3464AF2B178691B31C6CF029A536E1E33ED45D39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 794bfcf84f5e55be9402774594e1d7059d1c8b7802ec41fdf38dc60096d3fb35
- MD5 86da181a92749244327d46a9d1e1eafe
- SHA1 5d25882aec02d2aee170803ec32238c18d0d04bb
- SHA512 891b5b4703023061064552895bf3e38ae405dd047729dc5a5b3682f63f2f38812eabe295c1c7cc16c2afbea46aaadc81b5395357f77614869a9905ee70087032
- SSDEEP 49152:9YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oMdFrIe78vH/:QySzPLTjYvH
- TLSH T10D066C56A1A841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 000a577bfebd222198d05157d7bd2e876e9bedb06ac86dbf012d09fe3f23617b
- MD5 3f126d4c9cb549b14eb1c3b81fbd00b7
- SHA1 baaf6fce8d0316bd49eb0a0b79049999fbbe17da
- SHA512 4511e081f31cb3527b13284adbcd5694bd822aa61e69060189ae28329b08feda49538298f055ea6ebe0314e81af394828c0608e42b3d591dee561f1a2b4ac017
- SSDEEP 24576:C47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYOMdIuwe3zfIe7xmvH/:C47JUQjTirIhCnDHUPfF/YMdFrIe78vf
- TLSH T1E565AE1EA3EC01E5E1BA827885155A5AEA71782E1F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 6c02dace72c562ed6356a0f72cbf0670256dc80d87b8ad4b5cd930d402e5a2a8
- MD5 e78cd2c2f1876962d8e727e0cababa9f
- SHA1 10d3bed0131c502abd14b740a1c276f53fcc74d2
- SHA512 62945575a1eefdcc57b62b1a77970e31bd0ea80d6dac280e895aaa09678a5a421293e9e28817d3f8e81a5c42c1de36839dfa6102622ce4c87bf388a0b49015c1
- SSDEEP 12288:ubsfS+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:1TMdIuwe3zfIe7xmvH/
- TLSH T1F955011AD29842E8C16E9275C7415281B3737C2A97E1D3CF97E0F93E2F36A915DE8603
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 8f4ee827bb80b915573343f35ca4ae607fff6d018f9d1af896b2164e237028ca
- MD5 9d3f3b2f94e482bf753eacc79e8c5868
- SHA1 1cf5f3086672eb5b5316e23c3f314f29942aec3d
- SHA512 41bc073a95844b3766bb169ef3f9d5e17c68d871d23ea522a3870d4cfa5d8891301584bd3df17b422a396f005f2654d82eb0ec8f91560b25bf8bd573baa6d496
- SSDEEP 12288:lo3U8FLzU3fvCk8N1GJ1i1deLG9o7VoNu3OSGTE524G/Hk:lWBFHUP63AzLG67Vog37Gg524cE
- TLSH T117451701B626D78BC6A940325E76D6CCAB70BD51FE056F0373C8873FC476658BAB5282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.1MB
- SHA256 f39011e206a521bcb427882762a52456af4aea6011367283b246d655e915f0c5
- MD5 3712ef37e6661df6ba6ce0bfaf29a03f
- SHA1 deeb37de03c22d6d00b5ce9961b763b790a5cea5
- SHA512 41ea54b7df0c00e1f0d86a8ee8db0214b424a6f945478d04ba9a64e49b8f02b02ad9d54f4250c52b3f8c40a6da743554c5e82aeb8e26f46c6c5e5fce2aacddf8
- SSDEEP 12288:7DZ5/IJw5pKGNbDCDSiu+quEoPf6OlgDpGBnrhPZ5z:7D30AH+fNquEoNvZ5z
- TLSH T141352901F177A75FC9BA4033123186CEAB74DC16BB493F05B3884D39D86AA19B5E27D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\b034218a59cd5fa8.bin
- Size 12KB
- SHA256 61303d121a196217b5893ae560a86325af8c0c9f96d87df608fcfb6d3d4f2adb
- MD5 cf2de52bbc714e4d247061fb5a5305df
- SHA1 2449987aa81b83eb83f50c62668d10047768aca4
- SHA512 e8b7f39fbf698e3292fc9a6ba0c882c7c64245bfd15ac55c4446efc7f5e1a1165fd7d2a6edad3282f10971c86f96bfcdf2a9d7fa2d09e977fcb5764f52e88d5f
- SSDEEP 384:bHTGJtO4SB8jMa8IKy+/sslpmHO1gG5VurvOe:MrgIx+/1p4O1gyuie
- TLSH T11942D0C8046B4B815609B9803BDA7F813A8A5108FEC0C4C5A227CF9D4A73CE48D7DEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 3aca12de7eda8cd941318994e752877a011ed290a326a766cc2a05aa192411a5
- MD5 2e960fabffffc2ccb34691e68e58b4b8
- SHA1 2bc44f41b9ee74a5ebbd7f741317653852f4e768
- SHA512 9bc2dae028dfce0232d8137ed8404cf98595cbb5aa17df585ad79f271c070a2c8dfc854dc3b36d2939ebcf485fa5d057c51740a50e55ed053c6b3f7b449f9446
- SSDEEP 12288:z07a+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:47MdIuwe3zfIe7xmvH/
- TLSH T168452317C78AC89AE6A98AF05015B0F22158ED7E5F0089DFEE202D3A7734DD65CE421B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 03fe37eaa3767126b3e2543cee7ffb4e13da90ed702300ad6c929eae7fde0c6a
- MD5 91b1af46a14687a103a82387462337e1
- SHA1 db384ca6900cf2f9d948852a2b701a53eea53864
- SHA512 b0d543475a361c8a62c22a54362f17fb7d96fe20cef55dc11b3dc19213f5769e12ac00715a861ca7e0f26b8695b0a8e70afd033d007874eeb417e42ad0baf9eb
- SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYhMdIuwe3zfIe7xmvH/:Dgb4mBIBhGFOMdFrIe78vH/
- TLSH T188659E1E22EC02F5E1FAD2B89DA64417D6B278160731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 69f68371b67b3d70273c90a7c11cdc031497300d231db4eb37c5d344811194f7
- MD5 bcb41f441d818165b6ae28171884d1d6
- SHA1 7d96bf0b93790467219c54490f9cf4d29cad11d6
- SHA512 641f56b613fffebe4f955a668eeaee7d025230f9dfed646f572d171cfd5a3eaf8fa26623d4884ea5266788ace4d900e1f1d8780983478325fbf84d272bd7fa79
- SSDEEP 24576:uG88u8FpJqH1bzria7/meMdIuwe3zfIe7xmvH/:l7ZFPqVea7/JMdFrIe78vH/
- TLSH T16C85016577E101F1D47BD138894246A3F6B1B8250364EFDF0BA88B552F23AE50B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 2cd3206b40deb4ddf650bd14ca2043a13b3e13c0f68044a180cade90cb9ea7dd
- MD5 bfe1318c97d2d61b697a855437d39b36
- SHA1 24b15bb87d852c2ebe0d021d982c01c11fd50334
- SHA512 c103f249350bc00049f7fc6f77969657ad3971c2669fdf6e82830434fa6c8ebd2a3ab6485e231c5af40c8930407e38d5a4c0b8907c90805c7633f19a90e427ca
- SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCMdFrIe78vH/:FG05lO43bsTjYvH
- TLSH T197D5BF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 3bd42e200d66561e2bd06fc9dba8e15d859d72c8cc915abe03fbc089aa91d873
- MD5 a2547bca4a93fb54f41ca65e9782b560
- SHA1 967f0fbc04e68d2a8bc6b2330a25ee937f25f60f
- SHA512 6f40c9795997cd1499f330f7b827dd35756fef879c7e9cfb4e31f4d0113ba8c5c1df36a769d125d5c2f49f0396a93d61357989681428b64fbb80d77671146654
- SSDEEP 24576:9fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnoMdIuwe3zfIe7xmvH/:Na5POZ3BJt2pasx2+maMdFrIe78vH/
- TLSH T16365AE5EA6FC01D5D1B9D17DC583461AE5B1342653329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 bb9de869c16b0036bd67d82ba75e6f2cfe1e3c51c8aa4907ee17391f7d14933a
- MD5 76f02c9a248550edc63f743e17df9d74
- SHA1 34ceeb78cb4e8a9260d10353cbc57700de64c553
- SHA512 05d37ce94db99866e93eaca24106431deb063eadf3ddd80c10e543f3f633fe7d23c21c2fd49d51cb4a0277229868ba3b61ff6e4f837ce57a57fab671dedfc0b1
- SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk2MdIuwe3zfIe7xmvH/:9Nc/zEOVHFpMdFrIe78vH/
- TLSH T17B857C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 76950e8bbec06c181e2dab085ffc2d7c5c0f9e2d6ba9adb941803fd9c441b1fc
- MD5 89b600058d907f63a42ae3507e6ed373
- SHA1 13f24435c56d11d33a989f51d5c529a97faf886c
- SHA512 c000c33c59034b3758727e9acdc00bb6999ae5985b06e1c0b1a50effd0ee5c166d797ea36f098be97d57773188a0c78de52f97bd2fa1e52a9328a752d1e96d99
- SSDEEP 24576:XTkNvNnaFeYhJNtmZBmYMdIuwe3zfIe7xmvH/:XTMwBtOmYMdFrIe78vH/
- TLSH T13055AF2EBAB845E4D1FEC6B4CD238512E6727861073293CB9290C13F1E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 d775c98b0afd97d625cc03f076f26d9e537df8ff3d510651760cb21b2b41c097
- MD5 bbb7ecc7cf470f1a01178750937bd52a
- SHA1 8fbced733d903a264b010339b49917e3ade76419
- SHA512 fb7551d3be448ad1b95bb9a750fb11d1f581eb63b17cda67309f490eda55c006702c766b0f314d5a87ef8d42395a881d9f0605a1209a7d5cf6ae362eb749bd6f
- SSDEEP 12288:WHvUrBFrEjwaQR+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl++:WPUr+NQyMdIuwe3zfIe7xmvH/
- TLSH T12E65F12F62AD18E5E676D17C85828259F771B866171292CF02E0813E5F37EE8BC3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 2ab4fd42b36762fc0ce8e2de810abc8ab8213b6b5bdff35ddb0cccbdb3237f9d
- MD5 78eed257b252ab9aec497152edb691bd
- SHA1 196d8eac3cd140ecd58eded5a0583261d05d5b53
- SHA512 43560637715fe5d15d4e3182f9c5cb0d8f6ecaa6c8abff2c56f4e7841b1c42e328d7e8bc4f565b46079a21a549a9079f0dc6149adad8da834e98e8ddb34f3944
- SSDEEP 12288:KQcMxWDXN1Dp/fshBItT1IQgAO+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByInec:YD3FHshBIYQgA3MdIuwe3zfIe7xmvH/
- TLSH T1AE75E13EE69D04E4E57BC1BCD6538606E77138AD032256DB06D081BA2F6BEE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH