Analysis
- max time kernel
105s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 14:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 4.4MB
- Sample260709-rs4ehsbz8r
- SHA256 68a914a2bb35aa0dc491fccf1a4bd166d48d76aea8df6c8d8c97cf9cd1d0468a
- MD5 d5d9577385aa22df0253b7076f7958d5
- SHA1 2454942ddfcd3c24618b7d1ed72e6b9959ede3c8
- SHA512 088f6e80e0420fc98e59d9ac3013124f0044c2143e11b6e3379bdbb0f9c0ca4178c2cab6b1f2ae8da2122c07879276212174d4935f7d2188fead4bca028ee163
- SSDEEP 49152:1UwAhazupak4uxg3gOfAnYLcQoVH5TLRi+Wr+8RGtsxcf8yphzhjuTGiGebcFvVM:oCUs4KjbAvVa3w6QA0dMJz6
- TLSH T1EB267B0BE6B940F5C0BAD1798A57951BFAB27859873297CB4790474A4F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 3736 elevation_service.exe 5508 elevation_service.exe 5972 maintenanceservice.exe 2916 OSE.EXE 2700 PerceptionSimulationService.exe 5988 perfhost.exe 5052 ReFsDedupSvc.exe 6076 SensorDataService.exe 1800 ssh-agent.exe 248 AgentService.exe 5176 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1e219ffe635dbbe1.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-07-09.1428.5832.1.aodl 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113609\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113609\javaw.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008d50fd3eaf0fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014a7553eaf0fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083e8843eaf0fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efeaa03eaf0fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce60933eaf0fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe - Modifies registry class 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{57759167-0082-4FAD-8852-2DACF9D163B3} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{1DE9E33A-24C8-47F9-9912-E02AFDAAACE2} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3736 elevation_service.exe 3736 elevation_service.exe 3736 elevation_service.exe 3736 elevation_service.exe 3736 elevation_service.exe 3736 elevation_service.exe 3736 elevation_service.exe 1536 explorer.exe 1536 explorer.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5832 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeTakeOwnershipPrivilege 3736 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 248 AgentService.exe Token: 33 5176 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5176 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5176 SearchIndexer.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeDebugPrivilege 3736 elevation_service.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeCreatePagefilePrivilege 1536 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4696 sihost.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3448 StartMenuExperienceHost.exe 1016 SearchHost.exe 1536 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5832 wrote to memory of 2224 5832 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 88 PID 5176 wrote to memory of 5292 5176 SearchIndexer.exe 101 PID 5176 wrote to memory of 1896 5176 SearchIndexer.exe 102 PID 5176 wrote to memory of 2908 5176 SearchIndexer.exe 103 PID 5176 wrote to memory of 3288 5176 SearchIndexer.exe 104 PID 4696 wrote to memory of 1536 4696 sihost.exe 109 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection 2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5832 -
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5832" "1436" "1320" "1452" "0" "0" "0" "0" "0" "0" "0" "0"2⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5508
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5972
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2916
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2700
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5988
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6076
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1800
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:248
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5292
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2699128254-3633964024-152949075-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2699128254-3633964024-152949075-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1896
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2908
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3032 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3288
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:3372
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3032 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:6008
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4152
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1016
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3448
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d04f423ab5e742ae435b29c58898be69c18890af83ec9d6407d9d7a295f0328f
- MD5 621abc8ac734270536be0fdbc2b7b9f3
- SHA1 1aca601d6b3c933ba194b8757b3681c136a812b6
- SHA512 d50b51619036d86192b4476a772c790f204d46e21ddb7b1072bbc164740891567ff9f0f26c1249dec1ec63f563ff353f7c2fced07598de85a3ee77d936f6e45f
- SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2ebcFvVa4eZw6QAhukeMJz66:N3q6sjB+bAvVa3w6QA0dMJz6
- TLSH T163D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 f148aa55c1f59f89ebf13e24d03ec7746086949dca3b2bfb65ab77d0821535a3
- MD5 a2e538ac9d531286a56161bc050868b6
- SHA1 d57cff3e07d6966bfe7daa990693330016738625
- SHA512 454d177f4755c91c2acbb3dbc44ce42f9e4d074dfe74e9837da0e5bc5b69246488c5c03f642ea541a942de786273a58d76e7736938ae88c0f015f03dc3bf5ea2
- SSDEEP 24576:VXYfDtczAzebc46vVa4eZwq86QAhhUkXuMDtz6Blg:AtcMebcFvVa4eZw6QAhukeMJz66
- TLSH T13B75012873A40CF9ECA74279C9A1C411EA73BC954360E7DB03E4A9695F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 47c15cedfe8ce478805ac4edceb1073dff78f360453f551ee12f849db70e53e6
- MD5 717b9b10e2a941d9f211b6e1993265e1
- SHA1 7f7fa6e51ea4d7d3afebb7e2959426e78c6ce525
- SHA512 b880974236180aca67d6e0e02f2d26bf2407453156e4ca6bcccad6cd2f4b23eb26781bf76e7cecdb62225390e5df7c10aa351d329d6f58121105b63616de636d
- SSDEEP 24576:20Le5ji0hmxxrMOebc46vVa4eZwq86QAhhUkXuMDtz6Blg:2Pji0AjNebcFvVa4eZw6QAhukeMJz66
- TLSH T133859E26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE68A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 dbe4a095f981fbf4e6d26d4cd2b845f3b328a008062d482a1fc4ea652ec9cc46
- MD5 ecdc4b0f881420d0a9ff2e3e76314755
- SHA1 a8b2fd28e460d55414e7f7e9ab9bc951273cdac5
- SHA512 5d4cddad334aa28a303ed07ae908fedab8dc917b036357d74b402c9f9f3d8ece0b22f2485af7367721a44087e6dbfe9507b84ad24530b4e4afbc582c233f0533
- SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyu8ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:a/ezSC6vUzPveHjyJebcFvVa4eZw6QA9
- TLSH T1A0756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ac4a9548f51163064a8d660eaa94ab5aba4f543b55008ea401df9b2d50341072
- MD5 7e9dd356958ab1847161c0d4949f39fe
- SHA1 cc0dfc477db9123b01fa1d515a70e695000ee1af
- SHA512 3fc5b3b4c7c9419fb1b308a123c07f7849adea263c28297623549d27429701d3fb4ba49e28d42f0f3dd26a95c832b0641b212d19c5232e703610565bb546d01a
- SSDEEP 24576:zVbqPb88hv/l+Y3ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:zVO88hXl+kebcFvVa4eZw6QAhukeMJzJ
- TLSH T11A55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E776E6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 d12b42005a4783efdd1fa490f32bfc879a9f16e12c7385441bdeed46d1866b3a
- MD5 e039a9494b7acc3c9169a49f05e1a958
- SHA1 78868b131e97e2685332d1be6529f35fc7a276cd
- SHA512 a02cdbe3643308d7ce2aa8257b78bdf420c2d8bb32464318254b68cc59142bf86fa315c2ff96eb547d4bd87e6638ad078458b6ffeaea2a6eee0a3fc5f9f687b2
- SSDEEP 24576:qLyebc46vVa4eZwq86QAhhUkXuMDtz6Blg:DebcFvVa4eZw6QAhukeMJz66
- TLSH T1BB55231584190DAAFFE202F2F6DCF85589959C94B14B256E32A6BCDD9DFC0F8CC8121E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 70baea248be1413c064a02d54e0024f82e9897435097914ee454f52422c0a854
- MD5 30c1ac3bc5ea1c511b376972528c2587
- SHA1 9d81065861b1a1a2874a272eb602c770ae7b87be
- SHA512 799466991695bf03c0f683b58e1021228a8fd0bb6a058ebbd6294b81fa865c816e147cc8ddd4ac0cb7124367a78518eceeb9da0da7c1dbf3d9c0b58345f7f369
- SSDEEP 24576:3JIUvebc46vVa4eZwq86QAhhUkXuMDtz6Blg:3JIUvebcFvVa4eZw6QAhukeMJz66
- TLSH T1CA75CF3BEE28FCE2C67A4DB95A91C600D77278704B62A3CBE175820EDE235E05D75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 3c481c0277285ac32c201ee811d988434148bd7794b827311c3744dbb1597766
- MD5 a0645abf516f74f67702adec8d8f981b
- SHA1 bcc3c1da13e12ae083396a01f99abe04d3465722
- SHA512 ffac7b7a620d45d0ee36744c7f255c1fe78c28aeffbb7c5b23abc0a6318a6acfd7d4aa77345c99799ef8bc9e9c68cd6c3050a2d519e5df2ff8545521d9794909
- SSDEEP 98304:uQvGAdlCEL8c/DRNw5CxbAvVa3w6QA0dMJz6:/vyEYc/D3w8uNa3wpXdCz
- TLSH T1B3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 a7baafd99dd17827362818c799dea9276f671be4a66ce701abd21def8393a177
- MD5 404f6a5ec7505c50954e26ed9795b9da
- SHA1 d0fa34260d75d123b2a02bfbfbd24b61b897329e
- SHA512 33b0e535d06a33d5df5d243dab3c2bf9fd6c38d0c23327a41e77da8a0595014f873b671ae46733693ee898dff83d131aea1578d8d68fe8118d38b730be242507
- SSDEEP 24576:e0ewsAj9ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:flj9ebcFvVa4eZw6QAhukeMJz66
- TLSH T11275F031FE34E436D7BB0DB22B25D706183CB9204B522AC3E3E89D9D59741D22776A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 411e11e9ea30c10e2aa9676dad69f576ee973dd05e34733ba5fc47d28c7b7db6
- MD5 65040459fb5bee9e10838679e7c7a0f8
- SHA1 4983e6f439036302a7a551a032acfc2ef8bf5443
- SHA512 07f9d9a5577bb73ad50563e3bc45414cddc74b743f14bbfec2c8cb4ef541331b5e899184929929f1cb5c3878a5c4db035865cb52d875e19937d0ca4ecd7987bd
- SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHnNa3wpXdCz:7UEtQevvqc2W1cpV2tI32NSOo
- TLSH T1AD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 04e6f38c00a2921ccf73a8abd2d2047e04fcb9acbf51d413458a9ae8c55ea097
- MD5 58285388723c0059656682c2ceedb9d1
- SHA1 74eb83a5c4736331cbbd4723b7df1e91f7f2fa7f
- SHA512 d9ac39b54f2206a39554174808c289380c34ec1fdb5d617e05437475aea4cf2453a42512b65e9e17df65ab67fde9fb549fada4a35a65081a5628283c78fb370d
- SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zdebcFvVa4eZw6QAhukeMJz66:ioq2VjnmdbAvVa3w6QA0dMJz6
- TLSH T154D58E0976B8C1E4D1F6C37896A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 4b254a09365ffde3af22271ac46ed8de1fd9320110a680b7db4c3a67f6811395
- MD5 002fc6d31c1926b0afd354ca3514ee28
- SHA1 5494d8d93ad159ac198ea99bf8fa743ee538de9e
- SHA512 54e29bb84f9260377953ae267c0a20c4aafddd59eb2069f494ce48701dacc0f4c3b024725b0ee22275e348199741ce014a21ade08cdf7327d3968e94ee2e9295
- SSDEEP 24576:vAhGL3IFoiwtA5l7S53oebc46vVa4eZwq86QAhhUkXuMDtz6Blg:vAMUFoiq54ebcFvVa4eZw6QAhukeMJzJ
- TLSH T14B359D81E7F955D4F5F3AAB8A9B69070EA76BCA55E31C20F2160D11F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 2b8516a6cd2a498eded8c3fdbfebe5c86f0df666a1f292a89e24b62e7863c6c0
- MD5 047f460c7913e4eeafa0bce544ab646e
- SHA1 474b424a00c42615a665a853661b5c20c26e3c79
- SHA512 607936c83a1b00656413045f6ded37bcdd0514d56ab9599516465d48ca50d2c614c9980c989941733e4096ebbd92ce419ca32683ce4da181745ca7747939b4e2
- SSDEEP 24576:ewu4OWpebc46vVa4eZwq86QAhhUkXuMDtz6Blg:ewvO0ebcFvVa4eZw6QAhukeMJz66
- TLSH T1CD65F14A72A90CF9F9A34239C697D436F7F2BC012625DB1F1360C65B6F37261AD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 54b7047f4d4d87520071ae56041094397132495accf8ef65f6ad8f9b030d2770
- MD5 b5cdccba646860da28089a78f2ff0c65
- SHA1 f2e684f1e5d824851aca0d29eff0f510a4de3b5b
- SHA512 bb5a7c0de327248ee942955137b86f04628dcf94b45580d9f5dc2332273b4c1c5c7fda42ad79e47f40e1931f15d070892768f8da84cc04c3972e963b6d7062a1
- SSDEEP 24576:6Zumebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uebcFvVa4eZw6QAhukeMJz66
- TLSH T15A55234A32A824F9F9E30279E9E49405C7B27C92733743CF226566AE5F768E14D35332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 95994c8a2cf11a02d4c826c7aa6c679dcb0cb144d4cf41fe1a6f9c42b71255b3
- MD5 d8d729a135f43af453c98da78b6d8b2a
- SHA1 ea93aacbf6bbcf35c697376c31b218507b47dfb8
- SHA512 a9d46ef68d1153a3f2324e5e5264e1c89d6a582ca7ce69c2d40f54aec80a4a3e8a352b44577f130e045c03a4da9f21323698abaa829ab86694dfe9b6f2b056d9
- SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3ibAvVa3w6QA0dMJz6:XQyiKa/X+PN9Na3wpXdCz
- TLSH T146667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 e32c3c49c4b84c6ec77a4f6aedb69019e4a2369d7c31c89bf57dc40d93b65dfe
- MD5 ab3eb518772f0c433dbeb2b037a21ea6
- SHA1 aed0f0d07a3d2ace1e68d0f08274847e64aecb11
- SHA512 7639aab826aa831678b0cb58d13ab40e6f0fbe1020550cf2144b8b97fa73cf82b186cf1c2f2e784d943ecf80c452764891e9cb9d6d0d183e895f1858f1aad85d
- SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3ibAvVa3w6QA0dMJz6:aQyiKa/X+PN9Na3wpXdCz
- TLSH T106667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4d3af083e7a7c34ce4b9d9f0bd1601e192d90480c3bb8ad6863a0dc2f2d8e833
- MD5 2a3022e2b757ab119f406349333c3272
- SHA1 bd737f2003888b4ce234fcf8b6cbcc190d888370
- SHA512 03fc3ba5f02d0520e1ed130e6fa3ce5d039a9ef043731dd1223373756e145f54a8d6bb74d306d5e3634f7784e10a5d7aa84c746b3b23d3878cc620497e6d752a
- SSDEEP 49152:E68Qg55nhceWu7PNU3/NebcFvVa4eZw6QAhukeMJz66:uthLRc/sbAvVa3w6QA0dMJz6
- TLSH T129B55933B2F600A9D44DE1769F4A972196D17C718FE1E3DB8111720A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 75ee6e7c96b749a8b227d83d75b9b787861ed1c5c73e8872352f329023736c16
- MD5 c9a5d97387fc7ff764a2ede9340ced9d
- SHA1 724e1b44110b1a76c57f893a8a50253b45774cf1
- SHA512 f14b1338b804db7c2a8bbfee56ba8f08ef5c872a1883e2b4fc8132f59e7e2b79737a63187fab69cce2618e845cf18f4923096402d22acd0738145645e5741475
- SSDEEP 98304:vy5112gYy5azzVvt69nLKnhZfbAvVa3w6QA0dMJz6:iLIHEWhCNa3wpXdCz
- TLSH T147167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 4fc99f42cfede33adcfaf769ca50fb00e87390f9c3424f730d69c21375d4877c
- MD5 9c4e5d35e647c722ae6ea4a1009ceabb
- SHA1 525e08b500bc964ae80beec7af8f8709ea6b05cd
- SHA512 90f560f56a36cfcd98f22addde68aa10f85dcb3a9d84b647cbcb64eb6a330ff53da464ec36c9eb12393ac7202fb9737d1bdb648bccb400acf56ce3d8eff9373d
- SSDEEP 49152:xB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnebcFvVa4eZw6QAhukeMJz66:nu6Jmdxd2debAvVa3w6QA0dMJz6
- TLSH T16FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 97481376b76556605e674aba3cdeb8caba2afd1b837d5a52a38ed54ed68b5709
- MD5 675cf17eeeb561d60366bf85accb7661
- SHA1 319cb5f5dfbd3e9a1581fe30b40e1f945620d05e
- SHA512 c96f1cded41cadfea668318b77aa672020c929ccbfd3151daf7e14efbe2cc2ab758e3e3ad25c04d513ee653566a538c0fe7080da22494ab95871d9a9cd944473
- SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xPebcFvVa4eZw6QAhukeMJz66:WmifPWRdbAvVa3w6QA0dMJz6
- TLSH T172B5BE13F2D901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 41cd05b2c0e1762ae2606dbe6a2d70b4c71c6ac9c72af34836fa2e13754b6850
- MD5 04d6f819bca5067d1f8af40e38d6be7c
- SHA1 d09b7687285a637769f68d2e29157cfbebe60959
- SHA512 bd6bb166fbee535d0f6134c490e6e64a41a98b6c23eea3579965f64f004ba94d506c4164a1bfbea2cffcf99c9fec35069b5e478904e6f73974a564f2ef57f2bf
- SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHqmebcFvVa4eZw6QAhukeMJz66:m5dKii61DbAvVa3w6QA0dMJz6
- TLSH T13AC5BE03F2E941E8E0BED674C7669232EA72BC464B34A6DF064072591E77EE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 1cf907e0cdfc1cc38a87bf36f091cf05cddbe4f37485f2dc148e38f9b03faf72
- MD5 6b252f58eabe9c2e7c55b1e04d1e8435
- SHA1 fa792cfa95d31f288b65e0bab2aae801f928651b
- SHA512 2c4ec55fa3c542a205da144e08a368e0e2d560f1b1635a288932dd6593363b083790c586fad2dd2ff097e8b320acbc7de033075d9722fcf18b719c5f8de6d7ef
- SSDEEP 49152:WhtSn8EApI0fig3giDn0AP5wzebcFvVa4eZw6QAhukeMJz66:3X2imph5bAvVa3w6QA0dMJz6
- TLSH T1E695BE13F2D901E8D05ED174C7468632EA62BC150B39BAEF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 8d9e5ed2145f1038d5945fc5138a7a0288e8520767614162a6e9b014fa445461
- MD5 5a2dfd935954cf345b069ed0efb8e52c
- SHA1 ca0965ae3cfc36706410d5abb3f43e71882dc28f
- SHA512 49519c6dc56c798979931a7fcbdb42838ac15e6c5dbc7ffc8cbda649594356814ef01bbf4d9ee6632faba7e72f02ba1458ab98e9fb8c2a7876eacb4ad85d51d6
- SSDEEP 24576:Mqebc46vVa4eZwq86QAhhUkXuMDtz6Blg:hebcFvVa4eZw6QAhukeMJz66
- TLSH T114552319941A0EAEFDD102F2F6D8F485C9986C95B24B216E33AFB8599FFC4F80C8115D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 cd25771dbcb4d96b6781c633d079ae2300555c2c167c416b4bcb7850db1e5fed
- MD5 44e4d210a300f8506144c185d0e29d90
- SHA1 fc9c4ce56363cf03f72c136a95d181129a9c44a7
- SHA512 dfae0dd8316f849333dc3a40e4e7f31a83f32c92acab04288fda5bfbfc876bec3a510b6ed1ae8a3b67688e4a1083db0947c6b079ce6c0a96f94d19c97415332a
- SSDEEP 24576:vRebc46vVa4eZwq86QAhhUkXuMDtz6Blg:ZebcFvVa4eZw6QAhukeMJz66
- TLSH T19F552319941A0D9AFDD102F2F6D8F485C998AC96B25B216E33AFBC599FFC0F80C8115D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 def74c33a11bfffa76338c51e93971957525358b6c62f501a1a6d3a33ac2ff80
- MD5 209078865e118c6c18f459a446979397
- SHA1 5fbea1d4bfac4923dc992034c7e85b1c41ca4c55
- SHA512 0e52733532deceb717806e04d13b136a9d3221a12bab7d44e07cd5853dd508664858db3514dc2919364708b1c3ac5e0928aa60122cb3ed717f7a959e50138030
- SSDEEP 24576:uHebc46vVa4eZwq86QAhhUkXuMDtz6Blg:aebcFvVa4eZw6QAhukeMJz66
- TLSH T1C7552319941A0D9EFDD102F2F6D8F495C9989C96B24B216E33AFB859AFFC4F80C8115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 8fa01cbb4147402d3c37dc427984892d50231bb2804c63f7ddf5703e7a593f26
- MD5 70c5c4678c4db2d5edf55a4b25f95668
- SHA1 1c79dc2ecc6fab0ed1d301f2f958716491281d98
- SHA512 67576f4ad5e9e20171a718de5cb504a4b9312f67bc421d7c751441cde7c9497a8244f8923c6b752579b8c814e0e7545295552a90ffe55e29a0d4788485dc802c
- SSDEEP 24576:Sebc46vVa4eZwq86QAhhUkXuMDtz6Blg:SebcFvVa4eZw6QAhukeMJz66
- TLSH T16855230A652A0DDAFCE202F1E6A4E455D6F4BCD5B32722AF33567C994FB40F85C60B18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 d58bbad71b50b18e0f8c5488bf472e0d5a0d22fa8634abd3ec30915b83d522f1
- MD5 3ef90bfd7f152a22884e4480f76bfd8e
- SHA1 9e7a6a1120d4a6c46eb54db6e9a4a764472e490a
- SHA512 4449acd6b257593be198e66cbe24071c7abe022838cd957fa3dcad377bf2c68d61c3215879c0c1b6ad7ad4f403b62ff73a0a378e65c90933e28a1106e44e6c01
- SSDEEP 24576:tQebc46vVa4eZwq86QAhhUkXuMDtz6Blg:qebcFvVa4eZw6QAhukeMJz66
- TLSH T1E0552319941A0D9EFDD102F2F6D8F495C998AC96B25B216E33AFB8599FFC0F80C8115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 225b1a70b6bce41a41e1a6f9abe0fbe8fca1ea7f6f26e434b854314dc3f65a75
- MD5 cb29d4a5e8e8bc14fdfa2f3b69fb2114
- SHA1 cc8037b367dc4890fdd6b0913f1c3a504654e470
- SHA512 ce35b3102a7e3c99ad5ac7d60070393323e056a1dce5fe29136ba1b485266f6c3539182b593fdc962fdbf32b2dc1faea28c15cdd1ffdb078f352b0d1d3201e7e
- SSDEEP 24576:eVebc46vVa4eZwq86QAhhUkXuMDtz6Blg:eebcFvVa4eZw6QAhukeMJz66
- TLSH T108552319941A0DAEFDD102F2F6D8F485C9986C96B25B216E339FB8599FFC0F80C8015D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 0891949995e0c4548e3f7a1bc864efc6b995cb0c6860c8d2e7b79a48b2213222
- MD5 c323adbfc6a15af83fb86835f1590810
- SHA1 0739dd3d7af9545c6706a5e6103cb90aecb51d06
- SHA512 a0c650e6c5c78a5efd679f4ebe164f0ce7600835e1d57813ebcc7208c7e41872705bb902c1bdcd77a6a0fe530172b7e8e49cb19d1ad710ffc190989e01658a7a
- SSDEEP 24576:D5ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:tebcFvVa4eZw6QAhukeMJz66
- TLSH T19A552319941A0EAAFDD102F2F6D8F495C998AC95F15B216E33AFB859AFFC0F80C4015D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 3d03a5ec59c07609b26ebd6d02b03a38a42a75adb766360ba2bb50cf0cd770c8
- MD5 2086aa01f8d1bd2f06ae6959cd734b5d
- SHA1 77fe3f6ac0c727f6298277d6b0ef73e008d0b984
- SHA512 934fe4f6707379ddbe23c66bf95e18e85a14d5301f4953eb61cb56fe873584f64a36828c52498e4dee752355b2312235cad19a3b276a72653d1e92ad554016e6
- SSDEEP 24576:HZMRzFVSOxebc46vVa4eZwq86QAhhUkXuMDtz6Blg:HZMRzfFebcFvVa4eZw6QAhukeMJz66
- TLSH T1AB750195B3501CF8ECA3427EC9559806D6B27C5A1770C61F13F8366B5F732A10C2EBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 b2d9f3591a10cd6fc96b0baf77742745064d527b5da9bf30b7eae7dee1764acb
- MD5 38f5dcbd143ed64f82979d18017a50ba
- SHA1 938c108d1ccd4459f1bd9c0761a6bec682c0afd1
- SHA512 1646bca5e4552694e9b0c40e6b431775c406c33eeecee7865869f8e998913c3efb580df3623be7aab5ab1740dff4a675a11a6e21c0800f3976a0c6a8b01e4103
- SSDEEP 24576:eWebc46vVa4eZwq86QAhhUkXuMDtz6Blg:NebcFvVa4eZw6QAhukeMJz66
- TLSH T1E4552319941A0D9AFDD102F2F6D8F495C998ACD6B24B216E33AFB8599FFC4F80C8115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 210585e8d6f5473d5388b2a09893f365b6266a6d79d0aa912180c0135c58f891
- MD5 c12b5192d1b0d746e79c58be0fec1827
- SHA1 3bcecae4a098cffc8656c8e3db1bcc72c147d86d
- SHA512 56009b87d34e7a5355dec318e8c83c666e0f5301d46b2bbadc9ad79dfac8e75da5b94cef0693101f41e66edc5e2a8e1dfcec6333a6b0c217225ed92b9eb923eb
- SSDEEP 24576:riebc46vVa4eZwq86QAhhUkXuMDtz6Blg:eebcFvVa4eZw6QAhukeMJz66
- TLSH T19A552319941A0DAAFDD102F2F6D8F495C998AC96B14B216E336FBC59AFFC0F80C8015D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 64b5093f680a380bd39c427cadb3bf62d2187019093c69a36bfc1db23333661a
- MD5 878f200d8bc47f7d188ebfb3fef91224
- SHA1 0b9858aa0012c37bc89a8da5920745be38c3d61c
- SHA512 d6617899e89e8448222ff61abf4315eeaedcc939c5917d0473096299e4585a8ed783c9292f486072d372f2f29075b716dec9824df1cc5cd3168e3a0e6ca3b33e
- SSDEEP 24576:Ozytebc46vVa4eZwq86QAhhUkXuMDtz6Blg:OUebcFvVa4eZw6QAhukeMJz66
- TLSH T13F65120772A530FDE5B34275C8A15902F7B1BC3253259AAF23A4567A2F771F09D3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 0a5fc5f1170163403c39c83017f76b8e603c9dba0b469d2eba1659fefa6f08f3
- MD5 50b31fbd3721f7b114f4fcc40a6eb037
- SHA1 db3b7b47b13994fe042c74794a9c45ae76e1df14
- SHA512 045dcee277e32a4200824b86374297f46bb76f62a8c917714533d055f08215d9c4df7c7c513c01ebf4f9528ce7d4521f186fda139abd83cdab9e0ff43699fb6e
- SSDEEP 24576:KWebc46vVa4eZwq86QAhhUkXuMDtz6Blg:BebcFvVa4eZw6QAhukeMJz66
- TLSH T18C552319941A0D9EFDD102F2F6D8F495C998AC96B14B216E33AFB859AFFC0F80C8115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 27b3cf78213dda13f408aa37f335e2c6678085e71122dd73ccfb2f2576f88af9
- MD5 e405ab677f965fb0613ca072ef997bae
- SHA1 1ae59ebedc0e5fe7d44667189bea0cb025e216e5
- SHA512 ae17b78c9b57ae509838615abb525bb46b76e19d194ab2c35e85b7150594a7709b425e503c1467f5a36961bd81abc8b5bddc6d855e6250fa583022dd19cb75e3
- SSDEEP 24576:2Webc46vVa4eZwq86QAhhUkXuMDtz6Blg:1ebcFvVa4eZw6QAhukeMJz66
- TLSH T1A3552319941A0DAAFDD102F2F6D8F495C998AC96B14B216E33AFB8599FFC0F80C4115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 f6a93cfaae14a6e36fd9c50b2676d3fc6f6bec70889847c621d0f1984d114904
- MD5 7d43cc225258ff85d90df7decdc36d79
- SHA1 0cf0c4ebc6b4dff4ba6fffcd73db89ab593bacdd
- SHA512 a3867ee2840f202fd6acd0258e8508c12fb2c3345894b3b93680fe1c1e7e47849dce05b874540bdda5141b69fe2c8204bad242ca785a5fef9809481aea8150b3
- SSDEEP 24576:3zytebc46vVa4eZwq86QAhhUkXuMDtz6Blg:3UebcFvVa4eZw6QAhukeMJz66
- TLSH T1C665120772A530FDE5B34275C8A15902F7B1BC3253259AAF23A4567A2F771E09D3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 097413d673a32a666059939f9bf1f3fd770500b8e8c9287e7bd788e9480ff6f8
- MD5 be2622a17cbca85ee8b69b5da1e4b5a4
- SHA1 7520c8ad4e928bd930f241108f0fa79cd543937b
- SHA512 3c5b7b218f383ec9484f25bb3118e06e6d9862ef0b53e9b4ce056eabd0702841a71e86c5bfc9af396d9af216747719256ae8baf0c85271b27322d3952f0c5328
- SSDEEP 24576:mTDaLl3z0zDXebc46vVa4eZwq86QAhhUkXuMDtz6Blg:mTuLlj8ebcFvVa4eZw6QAhukeMJz66
- TLSH T16D7502A5B3501CF8ECA3427EC9559806D6B27C5A0770C61F13F8366B5F732A11C2EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 5eb3b83e9aec0e77a5e3be9a66fe46358304740f32e164c67f0518b6eea787cc
- MD5 6c9acbb54e0eae942174f0b681a4983a
- SHA1 52e913aff4f0d6f638867451042f62f22a2b33bc
- SHA512 f87532cf4d44a103d0a20e8c90f10117f5c6e527bb690f2afc797e563f0d5be95f4005a563e3e4ea1bf6256458f6e75c4eebc0691a67fd1a118452593de9393a
- SSDEEP 49152:wvd9CHKyaFebcFvVa4eZw6QAhukeMJz66:eCqkbAvVa3w6QA0dMJz6
- TLSH T18785CF90F3E414E8F0B38A35C9759511DAB67C9A1B31DE8F03A8655A1F336E18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 60105662d121a2c58c76b5f7a08aa4bb27e58c8ac40ec44463dec306755844a2
- MD5 5a5f5c4886d7be07676be7ae9fe85af7
- SHA1 692b9eaf79de8abcbfef65a9d20c4f6fa382465a
- SHA512 c204f1413afc0acc4af93dd9e144d4cda0bd351f52ff026471bb9b458f665bb3042294bf780ddc2627fcc8e27c60b6849ef3037b26c32736bf7e468120a6ecd9
- SSDEEP 24576:7nebc46vVa4eZwq86QAhhUkXuMDtz6Blg:LebcFvVa4eZw6QAhukeMJz66
- TLSH T180552319941A0D9EFDD102F2F6D8F495C9989C96B24B216E33AFB8599FFC0F80C8115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 e405dfbd7c41fdf868075ad273d26a05fe0987c904e0bf05706a83eaf185d96e
- MD5 c700420579ccfa8469a916172d58cb37
- SHA1 902fdb2626748a3a195ab58e1e7e48a3686ef706
- SHA512 cdfdf54ff13c32b5cf89c7a423fb905a85596f64c843c7b07710f5509d4d74b9f0461bbaa4a00d0a3d62d11e39d33bde7e7ea9336e7ff57dd0003cae203df8b4
- SSDEEP 24576:zNebc46vVa4eZwq86QAhhUkXuMDtz6Blg:JebcFvVa4eZw6QAhukeMJz66
- TLSH T193552319942A0DAEFDD102F2F6D8F485C998AC95B15B216E33ABBC599FFC4F80C8015D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 8c2efe720b99f8027c6596507cc53ae0c93ed3c29a54950fbd26b21e8831418c
- MD5 141157b8e655928041f5688fa8c27f5a
- SHA1 292400f0bc5a61c68f984d80324044ba3a2326a5
- SHA512 fead3adef8d59f9274e90fa8e196d6df5bf541f032e19caa2fc746419af7b3598f9c9291b3a6f05b0c2bda0d3548d969a2caf3b87cff266ff6a74788dc86159d
- SSDEEP 24576:LEebc46vVa4eZwq86QAhhUkXuMDtz6Blg:YebcFvVa4eZw6QAhukeMJz66
- TLSH T12A552319941A0DAAFDD102F2F6D8F495C998AC96B14B216E33AFBC59AFFC4F80C4015C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 ea4ee8bf51d8f6c56351c2d23ae1d0f90fa00e1b44e32610e23c8a0a82bed845
- MD5 76bf6a2fefcfefe3e67ac08496b5605d
- SHA1 86bb3f1fee8e3549deff3a48d8164ac9402f89e1
- SHA512 d9e02365b53a8f94081bf58e8a4746dd1e4ea806c829a0e3013584e1af241952b2de68949357fa86d90a7a0cd8140360b6d909665e8fc9a76c9e4df88072960c
- SSDEEP 24576:yWebc46vVa4eZwq86QAhhUkXuMDtz6Blg:ZebcFvVa4eZw6QAhukeMJz66
- TLSH T160552319941A0DAEFDD102F2F6D8F495C998AC96B14B216E33AFB859AFFC4F80C4115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 1e9dc68ad3c2228fac340c49dc1f1e6c1245bd94e33ef7e9ec495de9ffadab31
- MD5 823fe47d6993d6a81a4790e99a8dd441
- SHA1 d0f7420013c98725c81204c4f0972ec9ca6787a4
- SHA512 6c56bd4ebc200816ab0c937fd3e0e56aae5dbae48980eb837c1afa57c0de161dbb6af934c859db46a5522fb4dfd85c5ee79f3f14517ef54b0bb0730f1e5fd11e
- SSDEEP 24576:Pnebc46vVa4eZwq86QAhhUkXuMDtz6Blg:PebcFvVa4eZw6QAhukeMJz66
- TLSH T166552319941A0DAAFDD102F2F6D8F495C9986C96B25B216E33AFB8599FFC0F80C8115C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 4a00c69c937d1b71c3ac55971141301a71b009c7fc7eec2e7021aba6697e86b1
- MD5 fd3f396e841ad1a4579943cfcab7fb5e
- SHA1 a3af0e3b538fae2bc3a8047c0a67d1f1ef6499ac
- SHA512 510b85f75d24f3f6ed06c3b26458a707f90b83028bafb6b9a544bae0943406651597850f7655ee1df48d225ab77ce72e73ca50af0c8ead3075167b0dad7ec561
- SSDEEP 24576:leebc46vVa4eZwq86QAhhUkXuMDtz6Blg:QebcFvVa4eZw6QAhukeMJz66
- TLSH T141552319941A0EAEFDD102F2F6D8F495C998AC95B14B216E33ABB8599FFC0F80C8115D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-09_142823_5832-1652.log
- Size 1KB
- SHA256 76871d1016fb93b94f2b310064f5d7b94f3fd7a7268966222b8ae1963a49f16c
- MD5 3f74ca93100d9ade8302dbc44b1f305e
- SHA1 7c0c1a082f5ed8cb1df6bc33e6f212da159a3a16
- SHA512 cea4875d406bb86857ab5bfaeea94e21c9c71143c4befcfd83f57be3b9a296eb10585b6a62de9c6766820b913de8cab3229de4e5fe269284f71d83ea51c82dc1
- TLSH T18121A21A2FD45A05FBFADE82D8FA15539E3979912C31C54C40A4434D0972F42FDB4367
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 05fdd1f2061dcf602e1af432ac9292cba560bbbb1d128ef7712717d2779cfd8e
- MD5 bb2c4a15907aede594b49f8bb449107f
- SHA1 da55a450af69d4c599ac020266a60027428cf2a2
- SHA512 c8db460d0653b2b3bd87cc8e5001a561bb8b49c6f96136b302275ff445868bc6388e0e1ac14ce2ba93d1fcc2d0bc54536879c2958323b4d34ad6d443536e5901
- SSDEEP 24576:ffwvUk9RX6wkyAISebc46vVa4eZwq86QAhhUkXuMDtz6Blg:NMnYISebcFvVa4eZw6QAhukeMJz66
- TLSH T10285D029EBDC08E5E1B7823C99B7460AF6B178591B31C2CF129A536D0E37EE45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 888aa78fdea288aec6d78574d882db1a828bcc90c4adf25b4f87b6e622b40f3c
- MD5 5ed62560743d427d7cce7e11d3e0eece
- SHA1 8f31ca92f5804dc03e66e6e2b014c1ebee7b2dc9
- SHA512 bf293dc8e78efa65eaef9a55b5a529f600f09543a99019d5e4570d5cbc17dbd5af0dd420141b30ff4b549e943234a557055be83a4239aefad19ba63d37108fc7
- SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TebcFvVa4eZw6:dySzPCbAvVa3w6QA0dMJz6
- TLSH T131066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 2718911f2c633189c7c2a40bd476b7d2eea75764afb4bcb5c67ee1d5dbe4ddaf
- MD5 51402306dabdcabd2f8ab2abee530676
- SHA1 9ad0111df6cac03da4af2bf6ed46a00e9ac56d7f
- SHA512 dd8566cdc18b19b7a7769b3ca242a3c794e79fafa8e9d96976e2b68a4bf6fb4a707d815d97568901f19943893b9870cb872feebc740f52dd4a1804134bec485e
- SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhebc46vVa4eZwq86QAhhUkXuMDtz6w:a47JUQjTirIhCnDHUPfF/DebcFvVa4eV
- TLSH T15865AF1DA3EC01E5E1BA827885158A5AEA71782D1F31CACF2270837D6F63ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 be7781e92e5524c693298cbf57e3d7ae3a4b072093cb866f050d48bf845c0204
- MD5 5f8708e6fff85a9ab74ee0b00b738b03
- SHA1 c062631fbacaf9db5562b35bacf3f6ed11ae16e9
- SHA512 b9a8ae828befe0bdd54707c2725e2abc644727507dfb81668c745dbb83fddd818b72be84f93bde79386ece6e7bf6c1280690b5d86014e38f210ea6d78dfebf61
- SSDEEP 24576:Zmebc46vVa4eZwq86QAhhUkXuMDtz6Blg:8ebcFvVa4eZw6QAhukeMJz66
- TLSH T14465F00AD25806E8E4AE12B5D7959941F3737C6593E2A3CB23D0F83E1F794A05DEA703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.0MB
- SHA256 0cb4a01530d61d51a7a3ecfb7db6b09ab5d9b71cb6de04f4d528bcc6290176c5
- MD5 baa0512c1adbfa67dcc47a9594643c3a
- SHA1 64d85073d1d0dc0a3deabf079fcc56691db845b1
- SHA512 fc8c3c30976f861cc6a2d8893d8fc83ab9e94fda02cf16f44716399a2069944640707776c5b6fd5cde7857a189ea95b33689beafb5145149d784e60be97b7122
- SSDEEP 6144:JsBC2na6DvC2pAAuQSotMxyKPcmsW3n5llXIfhQCbmmh7x2b2LSY8vl7D8pqgspl:e79ubDn4hQCS6YD8pBspzYOR3o4D
- TLSH T1F7351710766AC75FC6AD40721E73C5CCAB707D41EE49AB0772C8873FC576658BAB2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 7add9d6f475bf5b06d847cec86f879282eebe5d5bd82f4c5d64c093d588f2527
- MD5 95455d2b6f9a0e36c72d0feb80ad5b1a
- SHA1 70fec90b6a8a5ab7964e7ae07d55fbf692591b40
- SHA512 7dc0841067b086f6a0a71701c9e18f56f37b4c6c05b3878a52d1afb80dc48cd295912d9bcffaf8bc87d9d0cdbdb4f661cae0d5f0475df91d9e37e033e9d571a4
- SSDEEP 6144:WQotMxyKFe6DvC3vCygCF0tW3zXL5v/TgCtF6236lgY63q3xT683bqtMxyK6tMxr:nvC0tWLL5q2KlgY63qhGCgBHy
- TLSH T1A555B541A436A3CBD1F761B1072A5F4DA764EC07B349AF276388053ED86B712A0BD3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 93d9620eb38776f58c73571b6de93e117eabb724aa77f13dbcc32f9bef61b2d3
- MD5 b803e009ccb9cf62138773ece7fb4793
- SHA1 455e2f963093b02251f3da20ea8decc7eb2536d9
- SHA512 4f659a3944bc86ecb76b686915d6cec207421e7edb044a51cbb5726655d8b7224a7e7dc4701e72c97ff8c072bfbdb56f3b3986914abca53cde580e45ba2a33c4
- SSDEEP 24576:guebc46vVa4eZwq86QAhhUkXuMDtz6Blg:guebcFvVa4eZw6QAhukeMJz66
- TLSH T180552315911D0D9AFCF202F1B1DCF424995DBCA4B30661EF725A7999AEB84F88CB130E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 fc396e2155bb67095cac4fd90fadd5ddcb17d8e2136a0822ba47b54c2c6186f4
- MD5 ce217fc244fd0022f22be9b5bbd8c7e7
- SHA1 3f0f75cc85a4e758a24b94a6e6c0d76b71c03cb7
- SHA512 b94ccab46fab5b4a8f869200a74ef2dacca707ac206f2131a7f3864afdb09fc02804204909e017e91d8899154e65ca2a86bfd2d6db2b5908fc367d1efab95de3
- SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bY8ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:ygb4mBIBhGFhebcFvVa4eZw6QAhukeMz
- TLSH T1D765AE1E22EC02F5E0F6D2B8DDAA4417D6B278161332D2DF1251426D2F3BDE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 179647f536506c24b5fbfde507d1015285530dda8a632f0101260bd3f0bfe282
- MD5 586a23924c7967bc26937615fb7c1c46
- SHA1 ba25fd4ab130a6415e0c783ad36a8ef4442ab1b6
- SHA512 f5fd432fae1edb6ade0752275d349bcc59d8a881101d13d345bd97fc5a1e2c676818b1e039e42d61f3623d1621a27ad5fd803289447ee65abbf275992af6ccdf
- SSDEEP 49152:p7ZFPqVea7/kebcFvVa4eZw6QAhukeMJz66:ptFza7/JbAvVa3w6QA0dMJz6
- TLSH T1D985016576E101F0E4B7D1388A864663F6B1B8251364EBDF07AC8A551F33AE40F7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 30d070e44601699ca74396817673fb5425d9b72b59474ab4d69413ec04632a41
- MD5 2838c89fcb6254cbd76aac8ad4cb9d36
- SHA1 941a7d582562e6075b8a6bbf2f9cb2e63808b8bb
- SHA512 e144e7465d8192bc50eed5ab5e42166d1343b287f4085eda8f656a754f45cb32dc193cb055cf3387d2409a4ab7975c1e73f6db58f4dfe5716b83fe9a93ec81c0
- SSDEEP 24576:1PUr+NQFebc46vVa4eZwq86QAhhUkXuMDtz6Blg:1JQFebcFvVa4eZw6QAhukeMJz66
- TLSH T15F65F22F22AD1CE5F676A17DC5868609E771B862131292CF02E1917E4F77DE8BC39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 3b56fc794579b3a490fbf2fc5eaab624f616dc099b303801b9c98c8b8608d95c
- MD5 98f9ff7a8cd0677113140157d62f9c3f
- SHA1 3ae1307cf4dc1433ffd5e3e1f66c07f5428b1a63
- SHA512 33c58d6f38208b8b4826e2061235c04d0b7318fab66b7846155147bc6d3b84b4a6a144b8280728e2c80d26f2974691aad8bdcfdb4aefd47e068dedad2613a7f9
- SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVebcFvVa4eZw6QAhz:MG05lO43bnbAvVa3w6QA0dMJz6
- TLSH T16CD5BF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 0bf686972ac4984ba792f9d938b43289a47b64d5ac42459fdadede5badc337a5
- MD5 445fccfcd505fb933b372b71552cb026
- SHA1 0369d154627f26e01ada0f4eb4b0a8e19b4c44ef
- SHA512 ced0fe5b6ff78be89c645eb9f9f035139163ee9d106f70151ecfe37dae63a1a1f02860c9dfd148f79c15b99e6e11e9ad366ff164eb1e150cfc5e76d33a7539bf
- SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnTebc46vVa4eZwq86QAhhUkXuMDtF:Ia5POZ3BJt2pasx2+mNebcFvVa4eZw6p
- TLSH T1C565AF5EA2FC01D5E5B5D17DC583861AE5B1342153329ACF122182BE3F37EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 8d44d3745830b509c3de7fad450177a6f2ccdf11fd74e61cc604b6743f17f11d
- MD5 22f3135e12372d22dbc174e4003f0d93
- SHA1 f54b2dfd1d3df5dad2becaf32a7bbf9bfa729acd
- SHA512 6b5e9820b93c11c6f118efd3173dbe3adf8426e2f8b5a08ec2a26dcaa45df0b700da598f2d0ff32b5c3dc387d727c70225599772bb3d6a85d3e437f85eac7e2b
- SSDEEP 49152:KNc/zEOVHFEebcFvVa4eZw6QAhukeMJz66:7IALbAvVa3w6QA0dMJz6
- TLSH T1A0858B1622E901E4F5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7d8b525c7c081cd0edad08a85fa1c4263d79373bbcb86a4f404c3c99eeaaeaa1
- MD5 bde2943a624b5d2e3680c252511d65fb
- SHA1 55beb6177f49b77cf736e81a9b939ae54d673551
- SHA512 662f586adcbbefd36408a7468a2b676caea29f9d603f1d9bf35b50673eec24cb58ff8f539055de299a46b8d16bf38c5859fae4b57a376338f71f9c1ff6fe2efc
- SSDEEP 24576:9TkNvNnaFeYhJNtmZBmzebc46vVa4eZwq86QAhhUkXuMDtz6Blg:9TMwBtOmzebcFvVa4eZw6QAhukeMJz66
- TLSH T10555AF2EB6B806E4E1FAC6B5DD238512EA727861133253CB5390C13F0E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 23427a8eea2fb7165f3890efef36d8d0c3c18454f5d84286015f13c083c6beff
- MD5 991aa200bf753bfd55e8b78419c5e13d
- SHA1 6d15b6751e23650e87aa7d4edb05b502d40ddd56
- SHA512 bed46c781d5119055c05f2ae829938926b5452fea8c8b7f18a5eb7dcbc801d064e5b4c5537b19c552bd84ab0a197381e5d7e49b53df4c574502f582b9fbd6d43
- SSDEEP 49152:QDVHeBIAAKebcFvVa4eZw6QAhukeMJz66:gbAvVa3w6QA0dMJz6
- TLSH T15375E13EE65C04E4E47BC1BCD6638906E77138A9032266DB12D491BA5F7BEE42D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH