Analysis
- max time kernel
115s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 08:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 4.4MB
- Sample260709-klbmlaft7p
- SHA256 f3fd41759b399eb8c92c490bfaaba03e2998e9bb35ad1c13573f7b4e23a849f3
- MD5 4a1ccc4259e0fa828742195aad06a677
- SHA1 2cb206e53a788669e1c73e738926e16139633996
- SHA512 19ff9c057f621ce82fce2a7f64a828ee597174ea745c1409621038a0eefb077fe80c1a2b3b094e4f353142815c04281fb9132a2f7b63291ce8d7e7653d61c538
- SSDEEP 49152:/474cNEpbt0rjQsM13HbDlKbFZNi4vbkfcdC5r5p3mATY00ILNiXicJFFRGNzj3:TAnQQh00I7wRGpj3
- TLSH T185267B17E2B940F5C0BAE1798A579517FAB2781A873297CB4791474A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 5652 elevation_service.exe 3140 elevation_service.exe 3984 maintenanceservice.exe 5168 OSE.EXE 3576 PerceptionSimulationService.exe 5556 perfhost.exe 2964 ReFsDedupSvc.exe 5072 SensorDataService.exe 5572 ssh-agent.exe 2824 AgentService.exe 3188 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d7950c723cd8d80a.bin elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Microsoft OneDrive\UpdaterService\logs 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a41e6b27e0fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f774bb27e0fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da096fb47e0fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df827ab37e0fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006de4b0b27e0fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{E332BDE6-7F6F-4D51-A399-225E1A24173C} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{20E1B712-02EF-41FE-BB00-B45B7CF8D0F6} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 3196 explorer.exe 3196 explorer.exe 3140 elevation_service.exe 3140 elevation_service.exe 3140 elevation_service.exe 3140 elevation_service.exe 3140 elevation_service.exe 3140 elevation_service.exe 3140 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5300 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeTakeOwnershipPrivilege 5652 elevation_service.exe Token: SeBackupPrivilege 2964 ReFsDedupSvc.exe Token: SeRestorePrivilege 2964 ReFsDedupSvc.exe Token: SeBackupPrivilege 2964 ReFsDedupSvc.exe Token: SeRestorePrivilege 2964 ReFsDedupSvc.exe Token: SeBackupPrivilege 2964 ReFsDedupSvc.exe Token: SeRestorePrivilege 2964 ReFsDedupSvc.exe Token: SeBackupPrivilege 2964 ReFsDedupSvc.exe Token: SeRestorePrivilege 2964 ReFsDedupSvc.exe Token: SeBackupPrivilege 2964 ReFsDedupSvc.exe Token: SeRestorePrivilege 2964 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2824 AgentService.exe Token: 33 3188 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3188 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3188 SearchIndexer.exe Token: SeDebugPrivilege 5652 elevation_service.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeShutdownPrivilege 3196 explorer.exe Token: SeCreatePagefilePrivilege 3196 explorer.exe Token: SeDebugPrivilege 3140 elevation_service.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 4092 sihost.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe 3196 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4832 StartMenuExperienceHost.exe 5804 SearchHost.exe 3196 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5300 wrote to memory of 2704 5300 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 89 PID 3188 wrote to memory of 3840 3188 SearchIndexer.exe 101 PID 3188 wrote to memory of 1896 3188 SearchIndexer.exe 102 PID 3188 wrote to memory of 2376 3188 SearchIndexer.exe 103 PID 3188 wrote to memory of 4952 3188 SearchIndexer.exe 104 PID 4092 wrote to memory of 3196 4092 sihost.exe 111 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection 2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_4a1ccc4259e0fa828742195aad06a677_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5300 -
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5300" "1476" "1328" "1464" "0" "0" "0" "0" "0" "0" "0" "0"2⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3984
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5168
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3576
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5556
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5072
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5572
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3840
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1896
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1640 1488 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2376
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1484 1512 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4952
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:4780
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1640 1488 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5840
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 1484 1512 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4464
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3196
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5804
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4832
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4ddd301cdad88a6c87c289107c3ba60f9fe90db16b2cb59d839c07a9c120486c
- MD5 85636b9a358566a412defddcd3f202c3
- SHA1 ff7ee8b72873b42b68f08a84e63b587a509eb912
- SHA512 b202932bc0b8cea441bad976bc44ebd1339002049a4757cd59060a0c162860a25f54044a2bdc0a5854e7b625ef18d563df6d19314d2e005fc0e5f19bbaeb3bab
- SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnELNiXicJFFRGNzj3:93q6mjBj7wRGpj3
- TLSH T175D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 b3d5060a12afef2c1993d89dfa4b1c3e2c43680faac7b5f95a6367632ecf882b
- MD5 68b78161858038ded4dd8421950a13ff
- SHA1 dd9d1f5d1b17f7a9d2b3cdd84b62ebb566f3648d
- SHA512 1ebef885d9f340348cac977bebb869e8b968b60524b02df15fe75c47932e8a4f951854a5c217d6d752dff50a761d01ca722fd9466ac72813f501702c8ffcba30
- SSDEEP 24576:LXYfDtczAX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OtcKLNiXicJFFRGNzj3
- TLSH T19585012963D408F9ED7B813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 829f31c67c5c38a13f7f24d23f1bb19419679a68dcf2d0e9f89722662690377e
- MD5 efd8292db9017c8d8ef061572822dd84
- SHA1 b873d5d7ada594e6c3a2189eab7e66f923463a61
- SHA512 1c1dab84cf432661031702e11893870d99c954c93c198a09aa384a5830cffab9331791d4d6a7230c8e533c3e3b4493a7aec7586c9e8ac181b8e8555c57152c2f
- SSDEEP 24576:l0Le5ji0hmxPrMs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lPji0A1ZLNiXicJFFRGNzj3
- TLSH T157959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ce11692fc4a2ab3c5b0187395c8234068ee8692a94b4c6f7aff93184f4b83e9f
- MD5 f70a149166c1f24bff313829e32e4e2e
- SHA1 6d423b1480f1bd842860a21fb0907e223fa34939
- SHA512 4682127e26dd288545e79c59ab5a55365b1a2bce85603a13e0bc03f87706b0c6c0956567af2c4413f20614b3b87001746126c261d9fab994dda7ab0e099fa455
- SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+HjydLNiXicJFFRGNzj3
- TLSH T19C756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 8d2ce4bec41444cd4926cd530bd44b1ab6e08bbe2b90e2697de57991b6cc8407
- MD5 6a43c8809b0f0123fd112bbf846371b5
- SHA1 38355cdbfd16283e8f896fd4ae86c8b497919c10
- SHA512 e6101f7f249c6640e54e21c48ab2f0c2163f9c76b42764d6c1a8be21e43a132a0f4e9c577f5dbf894d1679838990e55ca395e6a90e6e87264ff9b35893f6c3d1
- SSDEEP 24576:HVbqPb88hv/l+Bz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HVO88hXl+5LNiXicJFFRGNzj3
- TLSH T115559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 222884b134122101edf19843a1e8ad2c4d1f6dfafc2d978f56ab996001256888
- MD5 eb88ecf8f974d5de2d81e904760572e2
- SHA1 6f24f9ecf4f9bf54d696f4bc97c3b203159315c5
- SHA512 6dd0da4a7c10bcc30a21589be49b1292360793ee96c2dd0f5a57bc48d28cf6192d85a76c40568a60ef96f717455acf0c0c24a8c40476fbb58dbc14146ea1ed99
- SSDEEP 24576:El4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jLNiXicJFFRGNzj3
- TLSH T16E6523D3468855B1FBFD003A867A5828B5845E2C8A555DE3D2503E5EA13CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 0fb5f3d8bb49c1a4347d282f23b981c3399abd0bf765ef6b4cd6da35d0dd6f50
- MD5 b3ed4ba9ce7608432f565d49d96cf7c9
- SHA1 f3ed9dbd9a813f45c97f2ed69b378075dffa69d1
- SHA512 edf7ba9f0f555c47c5f140bf50dd32405de4780ab748e3e2115280a55f5826561b21f181335ab30b028f15315a42b6b4d6ba9f2fc590219385fbd1f316e0fac4
- SSDEEP 24576:rJIUb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rJIUbLNiXicJFFRGNzj3
- TLSH T13685CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 698f661fbb20c4db349a5c2e95dee65d9b581a1c0e467b7fed8fe2fee6d8b51e
- MD5 1538f56eaec2dcedf91d4338ea34d752
- SHA1 1108c0cb51bf0b4271c7ea809fa2be149ed1a367
- SHA512 bcc03302b0dd4f6ddeafe2bb200ef05c2440eb57a40f85f0a6533ebb30c33ea92f75ceb694f98542c31f79944d0f9b6e8f98a42e1c4fee088304c5934b942ea9
- SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:/QvGAdlCEL8c/WRNw5Cq7wRGpj3
- TLSH T14A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 a12a06013d02224823eaae1004959be9502c28acd2161fc9bc2a570801e7fcf4
- MD5 518c708386a9f9a87a815efeef1108b1
- SHA1 28a08d89bcbdfa3ddfbdbd644f7ede1d01e8f75d
- SHA512 24629ac644005f53578a767659c071e9516e5ea702a3750a9e5aba7ee389903e2f7c26661a6d6e04d2d3966b7245369ec506af9104aba6f81b315a2e015c5f9d
- SSDEEP 24576:a9ewsAjp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aljpLNiXicJFFRGNzj3
- TLSH T15985E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 afc98d064bd069275ab75490fe942602126732475e771db7762928596359e614
- MD5 668312803f0b98b60ce24e2710d8ae06
- SHA1 3bf60b3c97ccee3c7f521db2ce31ce6e8a9c08c2
- SHA512 d78946a01dcd42a68009e5113caa66ba1be46776c0b032d96211bee480fc88adc8be6ae935258f4066b95a97a6b5ff4349d393a80a306d0cc79ad4e97e513483
- SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHFF9:JUEtQevvqc2W1cpV20I32b9
- TLSH T120474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 febb47f0b8653dbc53227242c206eb6f529b20d11ebb71ae5ffccdf52a98883b
- MD5 e4e3c774012deca4e84674619324d940
- SHA1 480eee8e7a2ac0ef589c62ab3cce63e68f497642
- SHA512 68b19f2a7eaffa7f1e032d36004d11d3887be4688c7f36d45b0f04842cbc4309f1cd5f9e9a69f1276eda6dc67526b34fe7c097cda8b44eed4fce1f9510c9ac24
- SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/zJLNiXicJFFRGNzj3:9oq2Vjnmu7wRGpj3
- TLSH T1B0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a32dbf69f8882537e4cf8628fbecd9988e41f578024ed50baebd83b3b0c04ff8
- MD5 5fc3b4e7f03ab557c342bd271ff1c442
- SHA1 b9a21f67c3ae34c89ad960e5ebb5f9355b97c42d
- SHA512 6059b436daae91afe66437aa70fca5b3aaf18be32bf02ddc33a8866b5efc6a34bea9c823cd6f0586f2c366e04abe2ff5c4441db9fc2d4f766bc8fd221fb13ee5
- SSDEEP 24576:yAhGL6IFoiwtA5l7S53O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAM5Foiq5+LNiXicJFFRGNzj3
- TLSH T169359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 d765a4ad1ddf79d1df488cb8fe5cbd840e29f61c26e21637db9490834b6bb316
- MD5 7a6a9dc160578b27ae50e3a61b181c6c
- SHA1 09152de3a5b0d7f2107d3ca190966406d2fa67b0
- SHA512 5a77624ff038867304f0b87699d543823c3b31e3ef7b07206db360654c29a5d3455177fd9114f7a83e9a21b8db8e3c00513b3448bd6b50ce983eab1f418082a7
- SSDEEP 24576:uwumOW9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uwtOCLNiXicJFFRGNzj3
- TLSH T11C75F08632980CF9EAB641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 6d186a088bb0e3a72f4cab33af86d6d3d8fbb0c741f61c0304ccf5f7a4e5a0b1
- MD5 72d19b287723cfa013f6480849037a5c
- SHA1 436b09690a401e2b75778da0e9fdea2e200104c8
- SHA512 d7b82d1c32e9f85df6cb4666ddc21b1ade8f0391eb2327969f3f191125f4a94d306d007d436eee6937c52440cee9823bda2652c8796d495bbf678a8c6b62a65e
- SSDEEP 24576:CZuU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
- TLSH T1BE65129622C820F5E2BB413CC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 be48d091e04d5ae333c6fa2753666357e81a1174865bd19f12644fcf68041b8d
- MD5 c5a57028b5244032a9876aeee87e244f
- SHA1 1c38a7ce9283d39eb583fd9237408cf0bb3d3e64
- SHA512 0a1a12373f92e5996420af5c14121d59afb686b0a24c575273c25f2cd260acf649af03d984bb5a61b59a0c1830fbc47d0f909ae625bc9983c3d4df5ee95313e6
- SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:hQyiKanX+PNTF9
- TLSH T180667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 bb976af8ef68d0e386321ccc82179fda9e1ee1d60ae787f60d50f6448d14d4bd
- MD5 e102d6ba15bc5905f808052ed977050c
- SHA1 c37404f35f8f7d3aeda09303ee104405914d66c8
- SHA512 68bca3da83e2573429b6e1b0fbbf59eec2ebf59881b3247b7051be89b5b0667db3a35f0a867f31b4e1a0097133259bd979fb5bb48b33a578aab634e539fb01fe
- SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:IQyiKanX+PNTF9
- TLSH T14D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 36cfa614bf6fe83877a82b78832d66d3894c08da85c23303f3fe6429ffbda3c8
- MD5 5092a4bb11b58431026892a9c387e70d
- SHA1 9d715050e5dee8b0e79137c64961a5d6c74b8aa0
- SHA512 7c0f3aa3f2ce07b2404fa1df2ad70104805c21f1124e9830838c415dbd4c6bb70a4f5dd71d9f171c05520fe56ce1cfc69641b8f53ba793f417eac47817661014
- SSDEEP 49152:c68Qg55nhkeWu7PNU3/ZLNiXicJFFRGNzj3:WthTRc/Z7wRGpj3
- TLSH T14EB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 e02bca58dea86434e0c1aa018c61bb4aa716dbc286448702d8e85903d26ea685
- MD5 aec798519e4ec4aa3af163c0809da1e3
- SHA1 1e80990fdb53cf192b01c5cbd5959633019354bc
- SHA512 60a5df9b226f623cd4bdd02b1b298ebfc9d6b2b08a321c04174b5fbb940b26ce9cbce7d57a0353e7937a3c741c317575063d83f9e9e4da87ae98a52924c17070
- SSDEEP 98304:zy5112gYy5azzVvU69nLKnhZ47wRGpj3:OLIHRWhKF9
- TLSH T103167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 51ccd972734570ee343e5fe4ddf8ea470125b81036c19629163399a8ae9fd10d
- MD5 45ef28f46d3a2013f1bbdb94c9e6f4cd
- SHA1 c654e0db86a03c2913dbff6653577e6c2d6df280
- SHA512 3306475a968565b18a9fe84905be7794aca2202db78608f050da9c17d24c7e18d3b83a2c0d445a81ebcf81d7e83de4dd13d5ac58a7d1a3f603e6e7c7c668c790
- SSDEEP 49152:mB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glwLNiXicJFFRGNzj3:Uu6JmIxd2dw7wRGpj3
- TLSH T148D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 177614150b15eee25314d9011af5f028c117ad24d53d89e29e07959ee966dc54
- MD5 1cdb70fc64463458419ab44dcb6b25a0
- SHA1 9c6966432add41a9c90f4d898b8eaed3c7681716
- SHA512 965d868bca0abc785a950bec33d15ac08760270d08961d30a112c7f015dd123464ea42ca2c1ee881de371f551f6597d1f642bd5658ceda3f7cc18d2f4d4fc33d
- SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4x7LNiXicJFFRGNzj3:YmifPqRu7wRGpj3
- TLSH T16CB5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 1a57d5c039c15187594f0b6b6a30e7c029ab88e44d72077a24940b12fbb8bebb
- MD5 cb5d1aceae238f3e29b457b5bfcfa472
- SHA1 95f70eb73e4a4a298db5c20e401ef7178ef7993b
- SHA512 189289ad52520ca3601cf386ffb501d399d4bd9ec9c2fa2e21f237d45ea63c2278882321db11724ebef4b9ef7f74c8e8580c79bd232562d541c1f2996968d7ec
- SSDEEP 49152:aSuZQIY0Be2KkRVtOnks6NMHqULNiXicJFFRGNzj3:E5dKqi61U7wRGpj3
- TLSH T1A7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 dbf3523de7dc5b5ecd183cadab7c85a0a44ade9c3577ac3c7ec651594b92a88e
- MD5 965b27fe11fd69baacf2776a21989a06
- SHA1 a19be71f5867459049477b1182fb7f67515f63ba
- SHA512 308bc46ff7c25f05a351b1ddab36ff5de3a52c2af6dc448c1a39c3aa62af66fb5bd1e5345a4c93668c85581a95b379490805def8ebc7d23fbed40bc1ce8d4e52
- SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5wXLNiXicJFFRGNzj3:JX2iWphi7wRGpj3
- TLSH T1B895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 9837858fa36e11ae58e26938bb28216cee5d7d453ced3b5997be06bb8b238f93
- MD5 2cd3df9fa5ac6f7d7393f11d631af239
- SHA1 a18cb8888ec3caa1862e6282c24e9bc3499b7fb0
- SHA512 c47fee17611ee44e98fd506005c1f55f5033749111135c9276d8cc14939d1e60b1ce202c19751dc8d66894124b13f090ee087748e9f14430ccd19fc5e8341c3e
- SSDEEP 12288:YWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1636523D3558955B1FAFC0039C6755428F5882E2DEB5618E3E3083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 8d28d523c29e373d94a08227308697f436708c6b1f13919396a9e942a01095a8
- MD5 a506a74b24014f6f9ad92de1e269c898
- SHA1 3b92df12054a4f9af6d9adc6cac174c931a9341d
- SHA512 91c115a24654dddc43b31487d495d9a7e161ce546d5aab99dbfddbc04fd07a95d27b44d7a50dfcbc5cd746166a1251f5d13e1e6710f44716205f3cd004d53aa8
- SSDEEP 12288:5JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1756523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 dff28d263cfcc1704686eefa0ac829b297cfc9e5b9590992c24a456c024210fb
- MD5 8a645067a875fe27993d4a221a5d3330
- SHA1 313d2764fac3f66d9fc98511cb73aa880efba505
- SHA512 f4925a7d2b4be8fc847b710265f323c3365c6534b6deb99cb6ecb9ca57952cefd2364ea09cf40f20227471d4e537fea640cdd33073a449052e97f356ad0dfbde
- SSDEEP 12288:6XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1196523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 c13bc3915d740dc3df38b9dc159f63afd2469edeb076324617c920748ff83050
- MD5 a07a1af95c6460280a167497d214d10f
- SHA1 20f34853fcb75fdc76fdf195d469bf8ef98409b4
- SHA512 66a163209ca974748613dbf653a86118cf622483ae8fe960b4c63d611a4359370a3a4dfbc12d9a7cd4435e30d74e482416740b3cb1cffa29007f64d2ee6761f7
- SSDEEP 12288:9VkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D5652393168900F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A75FDA9F38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 ecbf0a72e2aa3759b59db77474fed4b36154f4f66a2f1095ef54b31d091437d0
- MD5 1878c7e71f9290ab5df7d3a88b6adcbd
- SHA1 a1ffd3e4fd1b8770b9eae52de2e90642d090d6e7
- SHA512 9b4fd45318c5a60bf86c48df9d17d789065850b73ad75bde400de76097e2f74c2e6161b0e94ce8200e58bd466d6086beddba5154e1da8605b7923f128c6765d2
- SSDEEP 12288:L8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E46523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 b31d00ae3223b78b247d82e88b7008f8931c5ebdb52409bb21750e949dfec7ca
- MD5 f2d86817390037a487809bd3dd652de6
- SHA1 b1e6e0ae35b0258ecfdcb0dbdb49ff9be94b4765
- SHA512 eed6a005a9cdc2bf200001997a8ccb10869a0ebdd8a71aa361a49b52f4c137c0793152b94d70881fbcc6f7c5feb38a1682f012e641a9bab5b5043e12e3b7268b
- SSDEEP 12288:HNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1626523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 7080f4912acb1541d5ea5e0217060f368d389255e0a8a69000ba9bfba3fdfbd2
- MD5 6404bb11580503626c459a677e5c4a7e
- SHA1 3c50b420e5e4526d76521b65e5e5d1b7f87b251b
- SHA512 844a30fd7adeab54b6c768dbf14d8c50271bd5404e996f4b2e0a1d8f4afd2415e68032546e3dcf9f15da3a5ecbbb264a3a182852fad8f80e1aa45758e67910e0
- SSDEEP 12288:tBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T18C6523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 38d3d2be9ca081f8e2dd2fd26317522a4d7331ddfc439a2f7d29caf82962c56a
- MD5 e2ac51d094490070501218c7ae63ac54
- SHA1 01608aeed685c1529e7053afccecf0c589c86429
- SHA512 872c778dce5d51278240d73e965cda58d77882ee3f65639146c51d188f77f83c9fb1c1dd90a3a54c712a3c1519ba32bf0e55eff61e75ee965eb80ec4c29ccb5f
- SSDEEP 24576:IZMNzFVSO1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IZMNzfhLNiXicJFFRGNzj3
- TLSH T15A850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 4a31be567086271777f16924add00c4d0202d1800dbdfa5b4e1c9824e4f72db7
- MD5 690560791d7d1631990d5b516d3ad802
- SHA1 5dc9c6c4b041df5daf2357262f900815814577b7
- SHA512 234e98ba39ec1a356a1c046d78f90645249ab2fa6236b55bc1a327b00b37ec6896b193cc9e9b978d9b11fe85db251fea7588e1b83dc8ff51b7ef97f2e837e10d
- SSDEEP 12288:7iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1586523D3558955B1FAFC003DC6754428F5882E2DEB5618E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 b969e3185c91f23687abe02ed77d0b05882208e4e133ea53177368730a17fabf
- MD5 ce1b942658a0e6945819656018266879
- SHA1 0e658c679847f32f073334afe6d8298f7d75e32c
- SHA512 3d387a5770d274ea1677c54a0a58e56802a78f3fa87afc0c4aa95aee85716b07f5f919f75301c40bbdcdf72f3b05330dfe88148298a32627f831b47a8fcde08c
- SSDEEP 12288:/+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E56523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 7ddf57d0842d1be202e5be6a77369ca276bf021071a9c8d7ded8fb140d47be59
- MD5 9f42f5332518a9bd9391b2806c07f6ca
- SHA1 7e4683849b41a3132cf1cb719e10a96d8310c55f
- SHA512 0cfc1dee18cde5f9a386bb702aa18a95427ec1aadac833cd7e65e1e3a091f9e22895ddf83d1944a0e7dfcb490e11fcfc3f6aee85469d95e4cb02713333f16c13
- SSDEEP 24576:4zy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4iLNiXicJFFRGNzj3
- TLSH T1CC750247629530F9E17A4139C9620911F7B17C364B208AEF53641A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 e230ae0719864c3d96c7f8bd2a7245a52029ec6750fd1dd6ab943bd1dec733cc
- MD5 9acaac411eaa74ed4af98a6001059aeb
- SHA1 541a245f0c17e90eaabf0bcbfbec741834fd547f
- SHA512 c13004a26ba607fd73797a0844f4ab042fae68e6ae8a0fc9fd5a7ebdc93d575295827f608338cb4e02b9bdfa4a9a7d21cdde51cc9edb07bbaab5f3b5e367cbe0
- SSDEEP 12288:kiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1086523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 19d8e932cc8a39e0fad1e92b75a223df93dc524fc81b6d7a7463baff26b8a6b1
- MD5 c62ec33168ca3615a5089fcffb73c01f
- SHA1 084a69612e0186864035130c92a680210b2f375d
- SHA512 516a66f34bac85db290e406d543eb3e70bf7e5f9abd2b936668b32584b4771a96bc99ed7eda45c84d31e3971e6f7d941e8f3409f2b0da2894f9a1690bc1c8121
- SSDEEP 12288:OiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ok/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1846523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 deaa246301ec36f0275202782261600039f7129762d5f675ef6cba78d94171b7
- MD5 8343af49f35f4ab81eae1c5fa1caf3cd
- SHA1 9a4b8e2311dd26f614cb54e4218f25217fd85f03
- SHA512 38a4d948e848c0bb8737fcc5148984c18ebbd2b215eab1d0285f08e09e21b36864163355c8101eeb2a4cc0ff25f9b8502cba4ff75f7a25531a272ccacb3ed926
- SSDEEP 24576:ozy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oiLNiXicJFFRGNzj3
- TLSH T1C4750247629530F9E17A4139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 d71d376224abbe421631a8177a97c3a79c327cdbaaf4d2a506988ef69abbc840
- MD5 ee548bbb2b687662ff40619722562fa6
- SHA1 8018850641f886a5f8be50448aac126b84142e05
- SHA512 8a551e67658be566c53a277c951df7168211423829a59e8273d7f8da21ed33bfb2109b3468693b7ef1dfeac017a00bb6cb96f14cf9032639a420c693e62b87cc
- SSDEEP 24576:uT6aLl3z0zDT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uThLljaLNiXicJFFRGNzj3
- TLSH T1578502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 bca91c142dec3b2d29668c17372292e0ad955d53514cc6d913a99f62ecb1308c
- MD5 0f21676771c11531b23095f83f55514c
- SHA1 e889ab21671909c246bc8b36544f9ad7f466a549
- SHA512 64542e766da05398a53e3db11703c0990161172b72d7ddbe391d4d2eef3d1a735de6240a9bb820ffca62f4649401f748a9a4a79c677fd47fe5f7f2bb37a68cf4
- SSDEEP 24576:n30d9CHKy7GZ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:30d9CHKyahLNiXicJFFRGNzj3
- TLSH T1C495CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 81d98260ab2d800ed90462f3c0a4295a075f9d65f5fd5187a71c3a915dbef4e9
- MD5 661952b9751a6d494a18a34a67faf45a
- SHA1 7b5c6d3daecd28f81c8901b7f9ae99da998c6fd9
- SHA512 3728deced4e5e0739c1d05f1cfe56499b070395abdc982d0ec75d41d69705d24eb3d81c069e53c3fa38ae3991373127dd7ede58cdff93a1754031e23ffacac91
- SSDEEP 12288:b3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C56523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 ea78a9575db8912a731c5b7a51b25db4f9d72c9a3f7f0e269cff69dc70882313
- MD5 2a122b2cdf45333500d43420194130fc
- SHA1 d2e88b7f253f914fe58e3962a59875c0d2ce4142
- SHA512 68ffbb1478a44eec9e4a4615a63798e7c8d6b49e432eabb6b6365014c5572318916a1f20d41dc31adaed85862291506adbf0ce41aa1f740c495a8a457e36e8dc
- SSDEEP 12288:21iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1826523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 f3c648f58c341b6d591b6be022b261277e1f81a648ab91147fddd8c5782d4c7a
- MD5 560659363798a86665f88aea687bdd80
- SHA1 daf00e73c5be997649cf0d95d78d9c76026db334
- SHA512 e0ddb50012a5d240fdd3a056f0a249de4e8da561fccf3bbcbb5ae7066aa7771ea755e13ffd5b761e5f21d23c3cffeb4c1e598c806497ec2f1497367b11a41544
- SSDEEP 12288:QgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1716523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 9e6246ec05df46edd60eb5c3dba130b8187a8afb0331ad824c025a6f38c5a6fe
- MD5 ce21ced595b057c9b86a29daf2ba3a93
- SHA1 a995a8babe7ab76d30b29a814e3dd296812876c7
- SHA512 193825e07e0957e30f4e8f425ca9f266912c52a9b7a586af3fecad63cf29431ee90f2bd94f1191b4c808571154599ccb9b5e5a98ea265f87c1747fcda40727a1
- SSDEEP 12288:5iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1156523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 0e48fb441919343e5f1d803bc17b4a3a34c5611c4c20035237c938c13e108ac4
- MD5 3590c0828c1e496d90c47cc94c124644
- SHA1 34df1d730bfbabe1912e9f1785d41547f84659cc
- SHA512 5efa7a60dbff5e24c2c02ca8ccbf421e7f215b9bb79f78abade0f4d786c0756b5c3101b1d1ffcdae28eda00f9b9cf6671294c0bb9f0c1700026df43eb357c86b
- SSDEEP 12288:q3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1356523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 8147b4d27307a0fa3c16f3624347594b47b04ac3913515edd49241b00245c383
- MD5 8c638897c6bad93ee370fc0368802bb3
- SHA1 29da6a7096afa543b202af87d13ed3c53dc71722
- SHA512 228a0fceed7c9216021318ca44811449e177d63faf53ab09ba5ad256198d69e9303fd3810a2bfdc294bbcdc2de77cddad09d9238b723bf09c6063e9b236b305d
- SSDEEP 12288:s6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1986523D3558955B1FABC003AC6754428F5882E2DEB5619E3E3043D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-09_084058_5300-4748.log
- Size 1KB
- SHA256 5aca4490b82a1da384f0d2eb1c257eaa69c790f03ce6b74fcd975664340abcca
- MD5 d8cd998e572f7d103a792ad47fc329c4
- SHA1 6a510c08fb83f150a1693cda60d1f7dc84feae47
- SHA512 4fc5d9070e90304880f9dc75e1e91d1bd5d311164da414af5ec69ec3751f03685406993bf6ef263e6fabf2ea0b708366b478100f18d8299fe443d617ed23dd3b
- TLSH T17C21A2253BE80A85FBFB9D82D9F61183AE3539912831C50D10A5434D0932F42EDB4327
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 67a8a3ea410793b8cefdf36e017fa94c68a3093f3f2f8e5e585748fc5dfb7008
- MD5 bd1a019e276fe617df970347765bfb59
- SHA1 82d51157517b926c16bf80963a9ea8bc2575f9f4
- SHA512 9796f122024d9b5075fbeb8a3bdf16d527f119d21bc2242e753186d863e5d58037808ad5cfed2da2d8b55ee4ae8cc59bb63908d6737daa3a72426ab31db94831
- SSDEEP 24576:/fwvBk9RX6wkyAIY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kMnYIYLNiXicJFFRGNzj3
- TLSH T11495DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 840bba704a65a7ab9e30df9515c3a26ea93a6a157341eb71996a1da6635e3b64
- MD5 7a4ae1e068473a90a6fbba2a5ab80691
- SHA1 ab9c83e135ac09ac5e4473984b3c55fae409f398
- SHA512 285d35b16a5a7141e31377da3673d4eb1db2b0322da308f78bf561542d32c234db0d5acc95659d7d79edd4db8928583bfc10028f40d29e2345658e26d2ed60c0
- SSDEEP 49152:OYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03LNiXicJFFRGN:xySzP/7wRGpj3
- TLSH T17F066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 e9b0d50513fd5955cd17cadae0a0bd6a2258dde588d6d0c862149cd401557f6e
- MD5 ae9b44f8a5eaef1c5d340c4ddd16fae3
- SHA1 a1bef5c20c6315f2c68c18a552964f1e4afa5997
- SHA512 662c50d033ba05b475c29a627355e0aed7a26fe43b77f4fb540edae849ee026331fb7379cb045865fa770cae9a2fe54d58994d38fc58a9da9be619952e78e1ae
- SSDEEP 24576:o47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:o47JUQjqirIhCnDHUPfF/HLNiXicJFFS
- TLSH T10665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 830e0e560fc46178ea0c3b4c7046dc8f500a995a726c886b732799aebedeea45
- MD5 e4465006c496d86ec95230dc6ca56f37
- SHA1 36e032b796315c7004232ad8a8440aa756fd8c22
- SHA512 8c8bd412a56d2126cc5c76dce1329e1e76cb4ef55689169b9a322bc8a873c10b21f80cae38da087899f73bbd94cf30dc9dfb8b71cce81f889f31799255256bfd
- SSDEEP 12288:rksfyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14275F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 996KB
- SHA256 e1076713cb42b975dfa290a829908d94eef1a07d2d6eff13d3b44e89b1b447d2
- MD5 22f207cbf435c680176182e39b15dcae
- SHA1 6e18f054a3ae9afa9573fbd72f84a4156fc4044c
- SHA512 5197ac1b59eb78482dc06ce0bf832b6d83faee05a34c121b309340efb837694d345e1cd5a4efa68f9d6901093d26cf924eeb18550762100f5e9c148fc32ad53b
- SSDEEP 24576:Ryss2UPhPzMHI/uYVbIEMHI/u8uDrxBr0xZU:sV2UpPzMHI/uYV8EMHI/uJDrbr0xZU
- TLSH T1A72516107666D75FCAAD40721E33C1CCAB707D42EE09AB0772C8572FC576658BAF6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 378KB
- SHA256 2f2bb3cf833d6837ffc9240d68c2e3d36fdccda6c35d0ad3b153d1b8e740ea60
- MD5 46dd3c90b62b0b30fd22dbdadf1dc987
- SHA1 c4b633f62dd0c85ec22f7d643bf7018135ce94a0
- SHA512 58024bdd52ae9f236dba062d61f8fe33e57a4ad5d0d8dce201ca88d5f26bdee484aa6dea735e80b97fe8aabfa10a4fb95fd4f25f73dcf8fb2d1bb065750f0c56
- SSDEEP 1536:48AWGs9P6jyFTicwUdwRJ+sGeYYt4C6qyFNebwUdwRJ+sGqpkIv5v8Q+b4kT4Z6L:VPGeFT+GF1dKE
- TLSH T1AC84C812B714B32EC4BA40B34871D5DF9B3CB5129F5253023BD80D99DCB319A76BABA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 e29865a6ec6c8a500ecc06631aff1979d6c16e6ddc8c9ae6eec681f36b729d0d
- MD5 192796cbf0765085492ccabf7c8cef21
- SHA1 b311bff2682a5cd592309fdc34b2e283cb474b39
- SHA512 9040f48a2f5aa05d51a7fcd15076ab38ed64f7e434e2cb373339e38c2c9eb73688302bf5aa7ce6f0c731d71abeb4790f744df06b1408a5fb08ed48abf117816b
- SSDEEP 12288:ec7KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E4652393468D59B1FAFD1039857A8434B54C7E2C9F1598E3E2043A5EA238FDACF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 120b291f115c9b8e260edd564b8cca650f7c96a2a9d024197afb865011d1b9de
- MD5 7f34040e7c9c0b6280d314c93c1a2446
- SHA1 fad5a0772151a1a044db22d81c2e405b4e1c6854
- SHA512 0fdaee280b105d91332e52370000a1f61912c89c3a9e9936f52f9481398566fa4acba06933f919da9be3f8bd98329e11d6c21b160b9f7fad7f886c75b4e3cdc3
- SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fgb4mBIBhGFFLNiXicJFFRGNzj3
- TLSH T10965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 57359455b896f0bbff5770c45974b477f445a7028fffeaf98bb9464e96a93a0d
- MD5 f31a35d4bd868ff4d4839adc2a7c573f
- SHA1 6c1f045e222f778070ddcfeae2a29bd0c25066e3
- SHA512 7a06d2a823a1d61e3f6062790a154d60fbac9a2dbf9560119ea4da4877adfe0c61e52b4d51c271d986568f73d7fef9768e6f1e714a1350867793bdd2ca370989
- SSDEEP 24576:lG88u8FpJqH1Izria7/m1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I7ZFPqV3a7/SLNiXicJFFRGNzj3
- TLSH T14495F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 e18c644d7b5a12e60e2008e44f152cf36003daaab406c32ccc4b55d324ddb01d
- MD5 833f2798596ee5c539f5d63ac0d85c9b
- SHA1 ffe195ada00ec173fd2fdf22fe90e9e8768e849e
- SHA512 0dd71ec575638c2ae6d7d48d4f9b2f0bdb3fd79284522af66498aef10900bf156987c0754309784b10f6af55123fd4df6333c71ec4ae0d7f0c56d605243336d4
- SSDEEP 24576:OPUr+NQh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OJQhLNiXicJFFRGNzj3
- TLSH T1F475F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 1a71138542705a56d5f502855f3d155e0c41ad4f8dbae9053661f686f2916326
- MD5 669af01d43e0272c0519bd1be272f06e
- SHA1 84e9feb7fb3c8036abf25d6c0fa505fb2e3dfacd
- SHA512 d2d9bda3db1e2d07786eed62d2d8aedd2aac32cdb153ed5f0090d8b209446c2461db5901dd1f4ebb52214ae6af05e47a20aaaf18c849d686c2d25f2c58ef1d68
- SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRLNiXicJFFRGNzj3:TG05lO43bw7wRGpj3
- TLSH T1AFD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 625f3034967fbf211587c1290694d7ad06586b32a1578b7bb767b94b70d2d7d7
- MD5 374d60e266125b4a255565e4a27c43da
- SHA1 b13425d8d9aa8eb1cb3f4efc6182c013d45ff92b
- SHA512 1776013716ea7b81edd4c3f0d8e95ae01e49e8a279bf8dd2936548c84a3c418ba088d235ad89eb9921caec88683b832b17e9131a72372c286fe7ce94dd77b2be
- SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn3/TwSfVcYG3K/cJHlnFR+IGNe8jg:ea5POZ3lJt2pasx2+mZLNiXicJFFRGNf
- TLSH T1F865BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 929c152a1478e00b9eb8afdd3999653403d008ac3c3fab9c3622e9c3f32dc94a
- MD5 046b9c11b3010e22100c18be388de65f
- SHA1 a20962457dc0001a03236fb99781f15a3f724f67
- SHA512 4d0cfaa0beed4d0f1d5a57319f3218cf8905b4246e7e22a1d092d125cb2c50b3d4c05f95f3885e7a4fb2ea32bdb68f9eec76a6d4a683bdb893f3dc6071ce56d5
- SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fkd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FNc/zEOVHFyLNiXicJFFRGNzj3
- TLSH T12D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 377be5a54bbb3e6d2c2179ff043d32a4948d197e172bcbbab44287d6c9f055a8
- MD5 e1b63064bff624589fd30d05164a969e
- SHA1 4a840574054ecf2f60dc006b4152ac9dca66b22c
- SHA512 6c097b4621fda1ab864e3600bc4b82c2f7a0725984198384899c904332532e90ebfa9d929191c1f24447f55d6e5b1cf7f21ec8b78cdacd3500c50eefad9d798e
- SSDEEP 24576:TzkNvNnaFeYhJNtmZBmc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TzMwBtOmcLNiXicJFFRGNzj3
- TLSH T1F455AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 7a11f0d71f7e334a342d419e6450dfd454da2d419c34e825e323d37f8ccd0a9f
- MD5 e8afab29397b0bcd7885f509eea7fde8
- SHA1 ffca4532b9918f98d838f621e6a442727c86e56d
- SHA512 12e7ed5b5216319127b3a254f718de9a0783fcb85913b9bc6ae3484cdff9e4945744fc3b67139afc69ec296cf0bf8581fa93518e9e35d4fdd17b0351840e7aea
- SSDEEP 24576:GD3FHshBIYQgAA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GDVHeBIAAALNiXicJFFRGNzj3
- TLSH T1D685E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH