Analysis
- max time kernel
118s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe
- Size 24.9MB
- Sample260709-wcd7xaez3k
- SHA256 5a6577cea18506f62f9c25cc80e802f65f2743e211c0293f749c9623fa7eb5a7
- MD5 32460090346a151da1dde2610aef0d24
- SHA1 fe65a3b18f5e10cfe5cd99f575565436ec7694c6
- SHA512 dd4f746e0877eb8c2329f04bdbb12387b177f068eca5c1565444b56d0338814f8435e054ff35f58e1643a1dcb976adc12c0c151cad550c6cf71f00e3ca6bcd41
- SSDEEP 393216:OoyFIhRufUrxwZJoScWCJawVl6Wxujk8fcnRy++ohu:FRkMl63o8knSo
- TLSH T1E447F7213B9A996DD15AC47083474AB21E7130DF0B35BAFF48D496783F69AF42F39218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 3720 elevation_service.exe 1288 elevation_service.exe 4540 maintenanceservice.exe 2248 OSE.EXE 3168 PerceptionSimulationService.exe 1380 perfhost.exe 2024 ReFsDedupSvc.exe 5412 SensorDataService.exe 5400 ssh-agent.exe 304 AgentService.exe 4792 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 1.0.0.1 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Destination IP 2 1.0.0.1 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Destination IP 3 1.0.0.1 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Destination IP 4 1.0.0.1 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe - Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d592c3a853e17fad.bin elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114359\java.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000999c1dedca0fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034895cedca0fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000553d48eeca0fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086b8b8ecca0fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{0001351B-FC28-413A-9753-4AB650189150} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{D6FF983B-5790-44E4-8FE4-890F95D15195} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe 1368 explorer.exe 1368 explorer.exe 3720 elevation_service.exe 3720 elevation_service.exe 3720 elevation_service.exe 3720 elevation_service.exe 3720 elevation_service.exe 3720 elevation_service.exe 3720 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeShutdownPrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeCreatePagefilePrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeBackupPrivilege 2024 ReFsDedupSvc.exe Token: SeRestorePrivilege 2024 ReFsDedupSvc.exe Token: SeBackupPrivilege 2024 ReFsDedupSvc.exe Token: SeRestorePrivilege 2024 ReFsDedupSvc.exe Token: SeBackupPrivilege 2024 ReFsDedupSvc.exe Token: SeRestorePrivilege 2024 ReFsDedupSvc.exe Token: SeBackupPrivilege 2024 ReFsDedupSvc.exe Token: SeRestorePrivilege 2024 ReFsDedupSvc.exe Token: SeBackupPrivilege 2024 ReFsDedupSvc.exe Token: SeRestorePrivilege 2024 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 304 AgentService.exe Token: 33 4792 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4792 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4792 SearchIndexer.exe Token: SeDebugPrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeDebugPrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeDebugPrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeDebugPrivilege 1620 2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeCreatePagefilePrivilege 1368 explorer.exe Token: SeDebugPrivilege 3720 elevation_service.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4716 sihost.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1340 StartMenuExperienceHost.exe 4760 SearchHost.exe 1368 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4792 wrote to memory of 3556 4792 SearchIndexer.exe 100 PID 4792 wrote to memory of 4888 4792 SearchIndexer.exe 101 PID 4792 wrote to memory of 1468 4792 SearchIndexer.exe 102 PID 4792 wrote to memory of 716 4792 SearchIndexer.exe 103 PID 4716 wrote to memory of 1368 4716 sihost.exe 109 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_32460090346a151da1dde2610aef0d24_akira_cobalt-strike_glassworm_icedid_megazord_satacom_vidar.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1288
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4540
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2248
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3168
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1380
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5412
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5400
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:304
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3556
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4888
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2752 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1468
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2896 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:716
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:1628
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2896 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2696
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2752 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5052
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1368
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d459480f8b3c4d48413ea6c31974dfffaf61e5902c5226e51b4b8e2e70b8db0b
- MD5 1f01c7a196cf40e11d5a7d9201ca39bd
- SHA1 c4e5cdee0de3d8ec00bd2602be656bda8fd5509a
- SHA512 4466a0456246f8ba2aa1411cbb4d9fb8dab6de8a88acd1dc7290d896360691bb3bf901ef098a6a5b495238bc580e67ae033a261515228b75c0893bdc377bb0a7
- SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4iLlBUKubZrX+ld:q3q6sjB5iBSTZL+ld
- TLSH T188D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 9934d758e80e412bd4439b9824bd15351ce2ab3d0a2085c573eda58b0c2a76e0
- MD5 c25e08d343b689bf42ad11bc7af05bcc
- SHA1 2adc42d3f44576146aa07af476c19dda090fbebc
- SHA512 abf428f3cff1259df8a1b641a4cca8cfb27a3035bf048719d1f519d8035d537ea6685030ea6539b10d3f5233f5efede43d9f8146832f134890940ad98f99a26b
- SSDEEP 24576:wXYfDtczABxVirnlBUKZ408vTZrX+lgdW:HtcuiLlBUKubZrX+ld
- TLSH T12465F11973D508F9EC6B827CC8A18501E6737C9647A0E79B03F09A661F336D85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 db76fc37829bd99961231a9c8bb36c849dcc9695de7e62be8025b26166775a8b
- MD5 086a85b6dffa83bfd10e92a714c190b6
- SHA1 708507bcfa365a151ed32218dc5053d2e30fd91f
- SHA512 6890639232a6c3aae7f8600116ae6d7ab70513a575b2e9390386787b658fde63d9c8a7fd96cac9f9b82d6ef2dc29722ddfc54edf7e6631b3752e77d1a5e5c861
- SSDEEP 24576:j0Le5ji0hmxxrM2xVirnlBUKZ408vTZrX+lgdW:jPji0AjfiLlBUKubZrX+ld
- TLSH T12E85AE16F6748735D073C0B9C5D2A68EE97230825B308ACB4296D77C3F67AE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 029bc89ac6de0cebf3d00777ffd7960166ea6502a344a2447a7480d4f0a8cdb7
- MD5 a8476f37370bf670b9a72b692fe2cb21
- SHA1 bdb5cee9c12209ade150e4941ec324f3a32254e4
- SHA512 fd2892f1f87208aa8d82aea197e8a4758fcf44bcf3ace69d1a0bfdb63baff183b929d26fc074db782a7ec821e5e1769a1c4a8bd017de00a95d4932fb6dd09cc9
- SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuAxVirnlBUKZ408vTZrX+lgdW://ezSC6vUzPveHjyriLlBUKubZrX+ld
- TLSH T149756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 acd545cbc766486253ed83f280cd3f1e927848e4b61d77f2cd9ca259eefdddc6
- MD5 919b09e04eb870f44a0ca136767ba3df
- SHA1 69628a6fd9a1d210f6b0df870ce519616308c902
- SHA512 8e9dcc444f71c205120e0ae20eba06977f5376bbdc2fcf8a68b0b9fab7ae607d75ae6f2e1d8beb1d66faec13c1da6dc4145df1be573fa4e250a5dc127a38352b
- SSDEEP 24576:dVbqPb88hv/l+YdxVirnlBUKZ408vTZrX+lgdW:dVO88hXl+miLlBUKubZrX+ld
- TLSH T1DD55AF66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 48c6018f7c8dae7f388ece59198e32a50f79e73906d7678432d703144ec8ca24
- MD5 58bcda8f57daae518bc304fd2e50d960
- SHA1 3513ac51e9e2afa727f086471459b3c165b60394
- SHA512 0a0d77f660d0eb1797f08a33e92503c8db0496ee0e918f72da8a77d33d9e6ff109a53925f6761f60d03e484c2da4e0d37f3b1613d7e5e5a62e684c520eea5664
- SSDEEP 12288:6LSxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:6LSxVirnlBUKZ408vTZrX+lgdW
- TLSH T15F45234622451867F23F4BF1B0B49C01F2EF2C97E8A96D2763B137460D768EDE8122E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 7e5fe1eeb22784350d7dd7576161d2bb8ffcb77b56c0f9a07368ad6784ecf3ea
- MD5 45c8566ee7cbc2b6b5b2048becfc945d
- SHA1 16a5cb22b4da0e0da52b6e681239c3ebd0985bc1
- SHA512 e861f6d2e4341623e28bf68592eccc8cca766723bf6eb85c0eae8c02a3f09bd66560b24ba2a2ec888f69e417afd5a501b303d6e569565e4eda395add3293be61
- SSDEEP 12288:qeBNUbTVO86U1xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:qJIU1xVirnlBUKZ408vTZrX+lgdW
- TLSH T1C965C02BAE28FCD2C27E4DB856918600E7B278714F62A3CBD275830EDE235E45D75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 1f8cba8377d6e015699f27faed86144faf3ec72909e9bee0bda2e964de88250a
- MD5 19f609674d78337c80b93eb0ce5cc309
- SHA1 3fd7c9b5e606cb6558d735d17619b106e0412ac5
- SHA512 0f5df455f2daca07e71fb8d47bfbf8c3e64ca3e75e857f984720ac9d1f2617c8eb1b1587f0a999d47b3623c321e90b84cf9356912236265ab603ce27168d1cea
- SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THW:SQvGAdlCEL8c/DRNw5COiBSTZL+ld
- TLSH T1ED266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 fc96c1cf94c0c6de8bc34dcbbc09213121ca8236940f0b49488aa8061eb591ae
- MD5 df261fb64f3bbae0626ee9416edb7a87
- SHA1 90ddc2c4fb80918e2253f31d49248f9cc4ed0fa8
- SHA512 ff9652ba07d049b00d222d39b769ae657c6ee1f753b6f3b68f9ba0a25381477a7ca21170b3641f8404026179f4da605b0ea17d81a792a57aa73ebc64446ab918
- SSDEEP 12288:MAwSfxL/2Dc3RDLLmt0LDQewsAjvxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:x0ewsAjvxVirnlBUKZ408vTZrX+lgdW
- TLSH T15375E021FA75E436C27F0DB22B35C706647D79604BA12AC3E3F85E8E59301D22776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 ae5c0724d4133b20d32b190cb8006871b4664be1647ded4301e556dd49b4b03b
- MD5 82eb770136e728d3ea0cc6f0b99ad558
- SHA1 f5e9e9683321210f33bd059f981b38d7bdea7591
- SHA512 eece8803e6f6af3e79f2efcd598c1f033025c7089c0b9162b1fa623545babc5fe084c20f5cc71054b1c6685b43abe44a78b16be4e8e4c1aa3399bb7f23fbb340
- SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHJZLud:zUEtQevvqc2W1cpV2tI32/u
- TLSH T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 abb261e1a0707c7b9a54c323d2ca84864edd988d02a260591db4d3d2f97715c6
- MD5 294e3587ba1379c6788e27fe74698275
- SHA1 505f36b37a5cd6799355fa0b553e90e053db5a87
- SHA512 0c0a72e180d247b03638520c305ee240a7a1c355a392bbc22117f8a9219e28dab4e23714cdc7a4f53e7ca5cc59a04fdbd1afbc31fb73f96286b7e6f08d63c4a6
- SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zPiLlBUKubZrX+ld:XoquVjnmaiBSTZL+ld
- TLSH T16DD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 aef320db5c13e849fa43a277538287410b23b105c4760e511289fb0245308d5f
- MD5 b5d67ca07e2401285b7234984b65f7c1
- SHA1 51e9e42cc46596b80e4cce2c3041d079d58f43d9
- SHA512 373b2d789b14f75935ee4dddabd5db3b6b1522713cc883222200769c490762f9ac48902a08896a6583ea930bd9c19a15571b71da9255828e8e83df130c904fe7
- SSDEEP 24576:LAhGL3IFoiwtA5l7S53ExVirnlBUKZ408vTZrX+lgdW:LAMUFoiq5qiLlBUKubZrX+ld
- TLSH T148359E81E7F955D4F5B3AAB899B58570EA76BCA65E31C20F2260D10F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 3d99430d327846c6dee75e28619aca36cf4f0d6cfab2a4370565267f21280ded
- MD5 c399eb3f3557de0ee57cd3abf236fe2d
- SHA1 3c5bff5d8f4018726b3014aff44181e407bf6bba
- SHA512 f14cab348a7007e561602d540973e91104d0f7d8846d44ece1e10b74d842180e34d286edc629faeca0912a053bc53398d3b4c3e4395af7cca4f1f1e033e46352
- SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CgxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:Mwu4OWDxVirnlBUKZ408vTZrX+lgdW
- TLSH T1F365F04A32A50CF9E56782398597C536F7F3BC022A25DB1F1370C65B5F33261AD2AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 52dcb5ceb20ac1ff238d839ef90ecb0f429cbef6b68093ac0c6fdbc6d39ac8e2
- MD5 e306c705fad434ea59c1bfb1df4ef1fb
- SHA1 19803ae46e71b45195c24d62ab3a42397a35478b
- SHA512 8bf4efefed3787a01dfde3d2b4f57119e0208ba55b06bf020177f8e523a7cf2b827e79787ec7694dc6351ccdf2e9749c56e52b8c1358ac96e58fcf7505ffbcfe
- SSDEEP 12288:seZ1Iy/xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:1ZuuxVirnlBUKZ408vTZrX+lgdW
- TLSH T10E55128A329420FAE17B42B9D8F08A05E3B63893A77653CF237112561F339D56D36762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 8f75a2ed3e97f75110bef55640e4fa59f01f79596a5cca6d129ef67e0f57aeb0
- MD5 a2c74f6200b596ab7f5a8cd2836d36be
- SHA1 736c130b7b1f2603701132316f82109c8d8e6939
- SHA512 50f78bd5475a70f93cf3c2c95ac6464c3b656ec2631d15c78448578c8abf63977cc3a81e7d3543b3ab23b9b7d82148fff37f57edd59f80993bf6888df2f1f749
- SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN39iBSTZL+ld:CQyiKa/X+PNTZLud
- TLSH T1F1667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5cdea9357f7f8883f3df77c486ab3c6c1c4a9ecf694f2e4ffad1b7f57e5df087
- MD5 4cd5e093f626384d6ed162b16fae900b
- SHA1 1731dee9fbf6ee408e20f93c5532247f6dcd5f53
- SHA512 01feb134488b4e53118715e1f99c94d657c0f8662ccdafdf9f8f3f3c9642d01a8291a03f39b267104ca3d8e9a08aa78bd89037e35cb89bcab55382d3c4c902fd
- SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN39iBSTZL+ld:oQyiKa/X+PNTZLud
- TLSH T123667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 610c18dd24cb96b587bff5fe6a5047f9dffd4e9077c233e55f4608276bbe3f43
- MD5 2c4f302848bb889c14cd670a1ea5b3f6
- SHA1 1b379bde3643760c01321d1c31f970b9a370e175
- SHA512 928456199e39b1284bb0b52c1030af01127fe8b40114093e23f5f6d4a235e8c52f6d9b546a032aa535ae8106bc389b0acf899cffb0a8900d762a9a24d76b7780
- SSDEEP 49152:368Qg55nhceWu7PNU3/fiLlBUKubZrX+ld:hthLRc/fiBSTZL+ld
- TLSH T157B54A33B2F600A9C05DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3ce51e1ff28f0aa669b37b020a95bf7063157b8c048fe6a4e8a4c117073b68f2
- MD5 31f4594e8bc87263dce3914c22e46e28
- SHA1 810643b8237cb62d56c0f6140412d377cad0fa7c
- SHA512 cee4cabb8c1d3f360eb68a2fc4100c5ff1a821e4e2a7dca3820e2f118d1a28981686e1b2770abf1a3e29487fede40914943a798a1898c30b0333e07c00eb8ae2
- SSDEEP 98304:6y5112gYy5azzVvt69nLKnhZ0iBSTZL+ld:jLIHEWhaZLud
- TLSH T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 5a446868f51bb45deac5289e748e9dc3a39d012c0b2b7d4fc9c1c213564df9bf
- MD5 b9d694fcc44981b20eecc9cf3c4d12fd
- SHA1 12c9a023a89b014922e52e8168eb434c5e796e44
- SHA512 cccf6d57206265d336064cbc9590591fd39b890b62e83975c9eb3570856df72af3c90132d6ffcdefaac154ed79258f07bbbfbeb118263dd6e5c166f3c1d8b2d3
- SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glViLlBUKubZrX+ld:4u6Jmdxd2dViBSTZL+ld
- TLSH T105D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 d0a68f63024a71dcdbdd417eac8c36369b84319344c8a4d758d16f2ec570d4b1
- MD5 49e3eaa64a7866721a09b92295ea6187
- SHA1 c03d8745c191a10a12ce6ad85ad48b6948265238
- SHA512 c4729ac2f737d234ec91dadd05f891b00086f2f8f69e9b67dbb988248464b93aa07afde648813b7b3e5d5328611f0f327b8be3dbbf5f68209039144db560ae91
- SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xBiLlBUKubZrX+ld:4mifPWRaiBSTZL+ld
- TLSH T132B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 31659522ca648a201a7a800133550a51e2451794dca1e455d4292d9857794093
- MD5 75718a6218a33813b5a19f4073ff16a4
- SHA1 62df4ebc2a0781504c07e1267b8dc06e32797cb1
- SHA512 9d242db0cd11429cf72478550b207a0117c7ab3945074d23f44ecb7c65249a0a19ee51e56ee843a650ee6dcd156dd887b494292dadc7e730eee15fedf59cc099
- SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqIiLlBUKubZrX+ld:f5dKii61IiBSTZL+ld
- TLSH T176C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 78f898da40336737e058609d74207d3f5f04b403488dac9c9e5eb210fb565a0f
- MD5 83e65e31bf58a95965fc68ad4423439d
- SHA1 89bd25a3fe9572d72d0e1605b4c1d4e5afaf4461
- SHA512 7170e80787d87b0aea827c177d89b6894202baeabc628cdc89e0caef99ea0462d22f891c3ccf67692d73c35611c4c4fef3bd3d2a9d1987e80b3b51e1f35e14cc
- SSDEEP 49152:rhtSn8EApI0fig3giDn0AP5wliLlBUKubZrX+ld:qX2imph2iBSTZL+ld
- TLSH T14595BE03F2D900E8D06ED174C7568632EA62BC160B35AAEF0A9077561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 e62d39cf82bbbaf81da6393450ad0ca4de71f602e1a515ed1fad294a94c7b15b
- MD5 5b59c8b218bdc0c61b06b93dbd495f0c
- SHA1 3bf83478ebede3664bb3799b5be1a162a185356b
- SHA512 9ff1106acca2c3ed80f561d84ff1b3879c650ee245b45667f7f48983768e25c3cd30a68f8862abd761ec69eed658821bf8ead868762543e345521742c35fdb3c
- SSDEEP 12288:IKxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:IKxVirnlBUKZ408vTZrX+lgdW
- TLSH T17B45234A31860867F13A47F1E0B49905F2EF2C97F8A6656773B236021E738FD78166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 af3d1e58240d348389fd463ee0d57d75db8fe4bc0252910ae7ec5a03a70f0247
- MD5 62059b122e18610b68da01a4d381ba67
- SHA1 98a3a2e551fddf4c7a6c4c0f191d01d9fa6e3a7d
- SHA512 5e058aaaedccbae334ccae389ad1b33307b7f0a5ae7de1a2c08f03147c0ce2412f3a93065af13a122d4fa4d9745cca6885b9219c0be225c26e93adbbaa7d6db5
- SSDEEP 12288:ZLxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:ZLxVirnlBUKZ408vTZrX+lgdW
- TLSH T1C545234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E738FD78166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 43d14dcea670ae3d6249ed58a1b39840c38212b3bee625407167ea2ce47a2cd5
- MD5 ea0135c2a5ebfd37ce06949d2edfced3
- SHA1 ee1c2889e5c2cae0da0495fbb8b6b5ee3991de64
- SHA512 25db25acf10acdc8dd4532531c7a2c9d372661a9c59806453692b8683bad1a04da07ba19a4cdd9a7579dc40bf26cdf3277312a9ae4fa318d9a3ec1e0f23d6a19
- SSDEEP 12288:pNxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:pNxVirnlBUKZ408vTZrX+lgdW
- TLSH T19145234A31860867F13E4BF1A0B49905F6EF2C97F8A6656773B236021E73CED78125E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 9aa6b7da89b45d389384488d32755fe4ffa9316daadf54e4c35ab3322acc87aa
- MD5 36b96789bb99ab92f14b003ac52a8066
- SHA1 272ff7e4caed9760751a7dcd94291b4033276d54
- SHA512 417476ac07968476f4fdfde6686e8d83542eeba61e3f4eb004f44b12332854b62ea66f0cc71f8aad1b98204cada20f71f737708fa69808bc88949eca425b5b7a
- SSDEEP 12288:oVkxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:NxVirnlBUKZ408vTZrX+lgdW
- TLSH T1BC452346329604E7E03A87F5D0B08901F3FB7C97E976666F637126460E729E87C31BA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 5f0f6a214df87aa79a27d33df56fd52db3b7582a3352273e1914574ca829bd24
- MD5 a12b15d2693529c1320efdd1d2c5cb4d
- SHA1 27cad134fcd8bdf9197afac416d754a536986cb9
- SHA512 4faeb058c5137d5caf663a94aefa95a7984e05c48f387823c8534311af2ea4ae0c20deb0baf78106dad9cb9fc3e942f1a522334e7ae7fb3c039945e558efb82f
- SSDEEP 12288:msxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:msxVirnlBUKZ408vTZrX+lgdW
- TLSH T1CE45234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E778FD78126E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 59225a2297d952bb96163392461191ea5a7848dcfd017084a316c16fb2e4a186
- MD5 e7d31ad192d3fea7b3b14fffabb6ef12
- SHA1 47bd1b4b75a7393a4916cdce1c6e26ec44d83e03
- SHA512 5979ab851ef89019b4d2983398de5ae04eb4571b50e26514f1d918a829926f68a9560ae1da93e172db255bd32b4cfcfc1c9ae827307c7dfb08fd8f7eab8b0da4
- SSDEEP 12288:4HxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:4HxVirnlBUKZ408vTZrX+lgdW
- TLSH T17F45234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E738FD78166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 2c9cf9b03717f23a46125315bbc9101d9f091db3e3cf57c4baf95ae8c4666ac0
- MD5 d9025fee2c615af032b79d467f49730e
- SHA1 ca6dcdabac5e4b0c33116a00f0cb858174412bff
- SHA512 871e8d2cfe3cd8f0aab39e8ba7085716383a558ea77935d401e9f0b003d5a9e7a0a30e19b7b758aeb7d725d1a56baa2f5e7a9a1156d5c30e037ca51411de2c89
- SSDEEP 12288:hzxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:hzxVirnlBUKZ408vTZrX+lgdW
- TLSH T17945234A31860867F13E47F1A0B49904F2EF3C97F8AA656773B226421E778FD78125E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 692f86b73e0ec3ad8e9a0c6c8382eb839fe80233485dfa8c0e6ca7c1da48fec9
- MD5 30ed96ecd6e1ccbbaca8a0c4c98c2285
- SHA1 b1cb1acee0ac8a97baad22073f1dd0c40db9261a
- SHA512 8cdf709e4ca5123f5c415d8e732f62f0336d5fba7416a41bd2b0664408de99f28018c39edd0875f65c39c90860bf2cfe1514a01134dfae31df762a09a7e80bc8
- SSDEEP 24576:sZMRzFVSOrxVirnlBUKZ408vTZrX+lgdW:sZMRzfXiLlBUKubZrX+ld
- TLSH T10565F185739018F9EC77827EC8658906E2B27C5A5A70CA1F13B436571F337A11C3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 ae4543adddfa9169840b915388a356407f48ae582ad1fc7e98d3d18b7eda294c
- MD5 207d9054b6b730d21209ce8fbf1e0100
- SHA1 a918f9904c6f1910449c0b5e118c4cbf6d6c58ca
- SHA512 b7927f9b397c855f2861abbf4db1b65be58541cded838191cd837c13728de7730d0cf66dca6da4895962bd9be033ced414e06d3a190af9bf7f0c93d3f6abfcb0
- SSDEEP 12288:z+xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:z+xVirnlBUKZ408vTZrX+lgdW
- TLSH T12E45234A31860867F13E47F1A0B49904F2EF2C97F8A6656773B236021E73CED68126E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 02c1a84d29b9602eb39c9c393c342684a5c2b7489666e28eaf51311d12200adf
- MD5 cedcafe262337fc87dfc6a1b74b86ed2
- SHA1 84cbf0861fe75fe6986fe78872f704c0724de289
- SHA512 f393af322fdcdb80d9a0df863d95a5fb2de71498c9badee9aec55d31f0a02131ee6cd0c099d990289ac608dec4703d5cfe99a888fde38c5948c3e847194391ac
- SSDEEP 12288:TixqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:TixVirnlBUKZ408vTZrX+lgdW
- TLSH T1BE45234A31860867F13E47F1A0B49904F2EF3C97F8A6656773B226021E738FD78166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 b5eb6da9947500a0b640877788b4bd349c3c70783d54ccab6ade16fa0c8b4dd7
- MD5 f77c999cc6a65aff22ae0b946513ac20
- SHA1 f977d4ac2a5fe180bdd3c50fa4de9497271ca492
- SHA512 a03faaa78ddebb871e0310bf98b7d0da28792382e359b1198953ded2cf90a9418ed52e473620c11a7a25d583c21f93abecba9adfa9dbcb81603010da9402e0af
- SSDEEP 12288:WyPz5L8/xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:rzy/xVirnlBUKZ408vTZrX+lgdW
- TLSH T10E550247329120F9E13A8275C8A11A01F3B67C775B649AAF13B017761F336E5AD3AB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 52b4f8afd62ecc85e599d3b2a98b969becb6c6c396762618f5e8b53f211583f9
- MD5 5ffca022bb6154cafee28a22b21c9af0
- SHA1 09179b27cfe0b01ad7a4f72508ca5598bf931899
- SHA512 e02d9f9efd726a6216e878069c9d677f5f8b7e5cb033a2d7193acf203b8890527775fa553f9772d16df00f354b5689732c689e0837646c9d9911bc305a1d7ec8
- SSDEEP 12288:i+xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:i+xVirnlBUKZ408vTZrX+lgdW
- TLSH T1E745234A31860867F13E47F1A0B49904F2EF2C97F8A6656773B236021E73CFD68166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 2fac445a675178120cfcd347eb93db766317dbc36dd866159638fc0bc0541d23
- MD5 5f6cf6a1153da7bc8eb2e94fc0f5dd7c
- SHA1 6e39a581c4599ddbed81726603903ad61e7986aa
- SHA512 239f4f7a2e48ec99f2edf1a881a79ae04fa70eaf69a3b7510ba7b00155c61aab7d08c9a83470a1a2c8375c0c7800bb32b2aa86257dfd75750c50ef1911c3e886
- SSDEEP 12288:Z+xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:Z+xVirnlBUKZ408vTZrX+lgdW
- TLSH T16845238A31860867F13E47F1A0B49905F6EF2C97F8A6656773B226021E73CFD68125E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 cc68d4f47a00f57d4953ec4b98c3a79f77883bf13e1e7117eb0ba572cfe73286
- MD5 5cc319b211273a2391e32a2ebd4d88d1
- SHA1 b33842a013fdc1bb0581c330133fd0aee5412643
- SHA512 675dfb5ac057c9a354395e0fb9dc470ae4e2ab9aa1819767289a31910322b8ce125f393726e19ad3cfd9d8daeeac655576ec11bfe9a1be0c71e574a8837995c0
- SSDEEP 12288:dyPz5L8/xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:Uzy/xVirnlBUKZ408vTZrX+lgdW
- TLSH T1D4550247329120F9E13A8275C8A11A01F3B67C775B649AAF13B017661F336E5AD3AB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.4MB
- SHA256 b4bf00106e3012972e887a0968dcf984c9627ffbca5962d040d8fef01a511824
- MD5 cbe6b200ed0c4c1e57cfe8e20f494668
- SHA1 5b4dce505f3ca97f728b440f26083fd1d378f19d
- SHA512 952c2c3096fd7e5e411ec08f249b447bf8c35225bc472318dec900e80167da2172c58833940d1a3df417efdbbb00f2dda30633aaeedc66df13fef072d384e840
- SSDEEP 24576:YTDaLl3z0zD9xVirnlBUKZ408vTZrX+lgdW:YTuLlj+iLlBUKubZrX+ld
- TLSH T13165F185739018F9EC77827EC8658906E2F27C5A4A70CA1F13B436575F337A11C2EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.6MB
- SHA256 53b56bc54d774baa5980d6ad7294cd8fd07afdd23bec5ff1d8672e4e0fafaa94
- MD5 40b4d0404e59a171eb9726824ae68169
- SHA1 af317ad2e2627896451134c9d450802c4cee6c31
- SHA512 7c8fa17f6f531a600263867bd0b541c8c2aeb6fd99401e069ebeca5c99e6bd240e7ca5d16fd2642b3bcd416f5f1d08e655bb3f27b53e585ecb218af59a989ff0
- SSDEEP 24576:O3vd9CHKy7GZ5xVirnlBUKZ408vTZrX+lgdW:Qvd9CHKyaXiLlBUKubZrX+ld
- TLSH T1FF75CF80F3E414E9F0B78A75C9764511DAB67C9A5B31DE8F03A4261A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 a4d9ce66e6e0c5e13a688640c5d6ed5ab54e03e65054b06713dd40444f5835f1
- MD5 9ebc3c8d7cc63b6ed939c7ea9f6ec88b
- SHA1 f8110d1aef5d4caa6462c62249433eba25f7917a
- SHA512 95cb037c9c078dc0aeddf2cfc8070b72c5646ccea507833b7f8ebaa3e03ba37c39305a6bb676f89bcce38983288ae5b378b6e1d0ff111bb07bca3aa006f42c64
- SSDEEP 12288:AtxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:AtxVirnlBUKZ408vTZrX+lgdW
- TLSH T1FB45234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E738FD78166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 73a567132c3cf81391b95de34c30ebda0d4e55d0163776082cd0de57be78b4a3
- MD5 a5842879d6f38965b15e69ea51ec60f5
- SHA1 0a3d2ae11e7e2ce426f9b99652dea17b632752e0
- SHA512 8f6fe7ee8b0800d840f926f28144b520e08f4b9ccb511dafd338c142698d0677869cd9ce42eb4a04d4d99ca34ef4b71ddbd1a18b5074b45d8fbea0eca71e6dfe
- SSDEEP 12288:GfxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:GfxVirnlBUKZ408vTZrX+lgdW
- TLSH T10B45234A318608B7F13E47F1A0B49905F2EF3C97F8A6656773B226021E77CED68125E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 753443ada280c6ed06a307059dea23fe8c2d8f13f70d720d22eda45deb756f52
- MD5 53d0c40a84c4a6e3b778fe89f0c59b88
- SHA1 83b7beadc83eda59507f5bee950654f719fafb65
- SHA512 d4200b2e73102a364cdc6085989fb57d4ef1d3eaefadd21f4d6addc96d4b54b456bba67ff6d594ab5f762c48c5ad7b874f9161585e2f79c99eadbdd157632867
- SSDEEP 12288:HIxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:HIxVirnlBUKZ408vTZrX+lgdW
- TLSH T1DC45238A31860867F13E47F1A0B49904F6EF2C97F8A6656773B226021E77CFD78125E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 4c023b3248e25c275da746af08b4f7146cc4742efac73ec7ffcbc321af1fa075
- MD5 5f912c8f0abe2860c08cc760beb4f084
- SHA1 52dc29e803d294abbc0a69931126f8ed854174b4
- SHA512 5c5e284fc2831921119213d55b7d7c47e4113b3d22bb22672778347e4456ecf2bf073b5b15a7a347addfb92f60f54837a122ffb634c38691f6b3d4bf61c61400
- SSDEEP 12288:I+xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:I+xVirnlBUKZ408vTZrX+lgdW
- TLSH T1F645234A31860867F13E47F1A0B49904F6EF2C97F8A66567B3B236011E738FD78126E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 b679c34eecb8fcb49433913115687bccc097e9c30d1ee17bfb1f56bb5143c07d
- MD5 40dcd5694541ef380c341874159b6f73
- SHA1 b48398cdf8a564a5722925cb31f490cce185689d
- SHA512 9ebdf671fdbb44fbd7e8a73eae61e5e41814df6023bd8e489c6f2c160e8c6480d28136a41fc2c06671d3adc4ef95696f6c570076c16f5b6463111cbdf6b264d9
- SSDEEP 12288:ZtxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:ZtxVirnlBUKZ408vTZrX+lgdW
- TLSH T1A245234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E738FD78166E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 4b68ab30f8be79c32e571905ec386380505a3ea39566f8dbe6a208f574bc656d
- MD5 33b3e5975cd1133b169c4b9af67bb50c
- SHA1 ac7d5b1541941c6bd2b4d351f142ab95ad9c24cc
- SHA512 bda6e5c0da15356ca8c011188c45a693c78e91cfa9edfba03a6e116554638e4f2a2641eb1dd653a84ee0c1c7054c1e23736938de5b3d34e817383164b13bf448
- SSDEEP 12288:0mxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:0mxVirnlBUKZ408vTZrX+lgdW
- TLSH T1D245234A31860867F13E47F1A0B49901F6EF2C97F8AA656773B237021E778FD68125E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 51ab7317f8c25b2604d0c45b7dde70995aa5768a3c703168d1ab544f77de35ce
- MD5 1dc5fd28817fa29980616c81f42c108a
- SHA1 166012f5b342482f66f6cdbae77b6c9ac1385f37
- SHA512 7e05260b99f17a6179768b1f857a97960cca158894d778c2f46477c0626baa43563d33ceba19552d9513209c3b6d16e4d79a633207b90b873cdf349c9bf1c358
- SSDEEP 12288:BsxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:BsxVirnlBUKZ408vTZrX+lgdW
- TLSH T1A145234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E738FD78126E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 b0fdb988dfd50adebdc39ce6e4405c14030f62fd9b903b7013c32c700d0c5ffa
- MD5 49f675f5656b9292d4ebc513aa5e7108
- SHA1 c40eb4da07580727120ff558161060b696350476
- SHA512 78b7fe0e6836fbf70ba492ed37ca39135833cdcb1fca3d64f34b47b3a6d8619930bfea96f474926160e9b9bcf0c1c488a34536ad09a5db0d06d6bb3606a7d0a4
- SSDEEP 24576:HfwvUk9RX6wkyAIyxVirnlBUKZ408vTZrX+lgdW:VMnYIUiLlBUKubZrX+ld
- TLSH T17785D029EBDC04E5E177927C99B3460AF2B178591B31C6CF12A6536D0E33ED46D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a0aba5474789ad4b2e083f7be719d996bb1b621c584bc17009e2a52e7e40420b
- MD5 8faf359063e55f480e5dec4e48a654b0
- SHA1 7f1abad9f2c6cdabe324c30e344dc369c397e78e
- SHA512 8e69f3f01d5fa842b1bb2ddc0aee37a30e5ab4a5553ffaddf8b990faf33932b6832b8b1920c648676dfee13bcad4925ef51640e488fb238edb0635924fbdaa2f
- SSDEEP 49152:JYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FiLlBUKubZrXw:EySzPdiBSTZL+ld
- TLSH T102067C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 b6e6357c0e5f6b2371fde3941adbb0d78d4608d80e3ed829cd65b6798e42f2e6
- MD5 326e2645acad586c04442e7a2e269efe
- SHA1 64c9550b4f968a23ef497acd5149c79fb2c20491
- SHA512 2a27f341b6fb50edeba7ec81fa743b7d335b601052914cdafa85d41d55ced20a7e4fd100d3b2605ccc0b81f038a2aac6a338bec7d35731020e75b74773275a3b
- SSDEEP 24576:447Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7xVirnlBUKZ408vTZrX+lgdW:447JUQjTirIhCnDHUPfF/ViLlBUKubZs
- TLSH T14D65AE1EA3EC01E5E1BA927885154A1AEA71782E5F31CACF2270437D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 e16c893956a80bab907035845476306f5e440c96fc6d7bf9fea1dd2815ba5708
- MD5 135ed50fd8269cef12afaa3750b177e6
- SHA1 3617966fdb2fdc53a5fab7bb03e17060c4563871
- SHA512 d50c76ae2c917f815599d32e94a363262dd854e83f89291ef7568fb46a8521f083b4436af5bb00f1bc40309b2659c4babfd5c2d03c16fbbc2a09979bf57005b0
- SSDEEP 12288:PbsfuxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:iuxVirnlBUKZ408vTZrX+lgdW
- TLSH T1CB55F00AD28801E9D02E62B5C7654A00F3773C6696E193CB63E0F53E0F765D4ADEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 bcf2f574a25b11403069a4b414979627becb2e24345bc418d942705b0069191a
- MD5 d078965e6b79eca9397fec75cba11ca6
- SHA1 3dcc670f5daf645f75b51491c22cf35e3bd8975e
- SHA512 e6a8a269163cb0391f523f515bb17cd488d1324a0fecfffe88a3eb87163b27d9854d76f3a18861b6347a5467c957475a48a08c3ec9f7fccaef01560ebfdc296b
- SSDEEP 12288:oPtL6U3fvoZfxYnGU32+3GoZLkOlKvbhEif5k8MEk+OVV:oPtGUPvoZfxYGU3hZLkIKvtRfq8rk+O
- TLSH T1C345F6007626D78FC6A940721E36D6CCAB70BD41EE04AF0773C8873FD576659BAB5282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.0MB
- SHA256 7e96fe517a83e555eb2749f6abf47d2db2aa7b12de421ca4a5d36a6c90d69c3c
- MD5 bd28b9f32013ab0b29545b1d71831b46
- SHA1 8a4d05214c74a22bc5ffa3e3819479aeb8e75c9d
- SHA512 ffec825cdb1ca338a217c7fe6ee849894dc615c5458bc40eee2d726c47dd445dd20887d7e3df738af82b406e092c5c937ee716cf5431fe86ffa7414f2a0d1de2
- SSDEEP 12288:gfc/3J+9PTkP7zipxqvWnsKnGP9HZDRedo8nnkgbZDGir+x2:gU/IJgjOpsvWNnecnTZi2
- TLSH T1AD35394575B7E34FC5BA4073023186CEBB74AC16BA493F1673884C39C86AA2DB5E17D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 526693643629f4c059baeb7cba593879ef8b06758186ef9fc39692a09ad3ec30
- MD5 3f68f5c7d64d2e3406334a3d4e2fc7b8
- SHA1 b504800ac94aa6f21e28ab71a12604481a5f81c0
- SHA512 099100ba38be492b265f2dfce1f49c8c3fe83296beb3e3968ac67b58b350a2c6c90838dff0210170bb7ab983ea6f6b326caa3008804c4c106dc15e5cfdfd2071
- SSDEEP 12288:Z07WxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:KWxVirnlBUKZ408vTZrX+lgdW
- TLSH T10E45234622890867F03E57F0A0B88510F2AF7CA7EF6594E7B37133451D72CE9AC326A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 a062dd8cdfb53de9f02d27b8df3673ce8d2ab55c88399905c95463aebbdaf45c
- MD5 c087687d60929591dd2044b059a72211
- SHA1 4a631fd2c275cc42b19830eddd189079737d7aaa
- SHA512 9584c6b6d893d8d5a1b64978c0bf8a474657dc9550388184d41d84336a9fa91d4c82ce870a4f15013a82902aca06d72403bacbd91d87bec80eddf86c9489c865
- SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYAxVirnlBUKZ408vTZrX+lgdW:vgb4mBIBhGFDiLlBUKubZrX+ld
- TLSH T11F65AE1E22E802F5E0FAD2B8DDAA4417D6B378161731D2DF1251422D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 1490a9fa8ae0748e5fdd657f27a87ecc186e4cbe6f76d5db83ebec7b76f05e61
- MD5 931826f037ca0523127faebac41f625a
- SHA1 485caff852f9e6f1f303acd02260e9077e9dacb3
- SHA512 d9ce11285b589b53866167e3ccd877b6f75f307d1c7492a5cfa7ddee2238bb64a0f7b7d7f24aa79cf18f05c221a7e3c57963462d14fb5b632bac4827b4fb834c
- SSDEEP 24576:3G88u8FpJqH1bzria7/mrxVirnlBUKZ408vTZrX+lgdW:27ZFPqVea7/miLlBUKubZrX+ld
- TLSH T1B985F15572E101F1D07BD13889964663F6B2B8261364EFDF07A88B521F33AE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 efc2c6de4e67aea90b8608aae24d5163c5e4daf894b231ccb92e0471723ae9ef
- MD5 10eda416fbe6bb9f2c18fd0e9e0e334b
- SHA1 a2939d6cb1d73c3e02bfa09cee66a9dc4b77c8b8
- SHA512 1433d018af08701e9cf1f09e9ece9aeda676342c64c9abc601661c902e190c2168c2e6a88ad1d83241e715322391d74209fe0eb23f31d2d629fb0df458fa8b2b
- SSDEEP 12288:rHvUrBFrEjwaQXxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:rPUr+NQXxVirnlBUKZ408vTZrX+lgdW
- TLSH T16065E11F22991CE5E67AA17D85928609F7727863171292DF03E1417E4F73DE8BC3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 d0904d96bbbf65a22922d4135f58a3afe5c353bd86a4b50ced2e077dc88ee3ab
- MD5 3e4dd899f3283e4838a0dec497571f60
- SHA1 f1aabc443e7f1c5f9b0ce9c420c8c9924437738f
- SHA512 9806151890d06975c4701aa2a23fb14682bbe1d442c83ef4f818d0f112bea02df02990bbdd5e46d49a15fb09b211144f7ef6cecfea7de8bccb448933492d7bd1
- SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHiLlBUKubZrX+ld:IG05lO43b8iBSTZL+ld
- TLSH T169D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4697E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 7c1e20fd0b694ed41c86fb28dad0ea80cdda7a7d0a66311b5486d72f65d7f60b
- MD5 4f9ab963cd0fde2158ea24400a7504c8
- SHA1 79ac3e1d3e591fb8c30485ba0216176a58675e1e
- SHA512 7e915f1a38bbf82535bed113d9e5ddbbb50acab12b8b719f53dff315cd28c3efb286dfad139db2a0ffac8b5ecd7412d164bfaf8a2c39599d3960ff1a5883de55
- SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhxVirnlBUKZ408vTZrX+lgdW:ha5POZ3BJt2pasx2+mfiLlBUKubZrX+v
- TLSH T1BB65AF4EA6FC01D5D179D17DC583861AF5B2342653329BCB122182BE3F27EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 0ae07da48858537d600924f9ef7d73b847edffa40c61b98cb4dfe0966771ba87
- MD5 b977199b872a3315acd1d98558654d3e
- SHA1 02de7c75ac0fc40ace745596f97f5c7bf0c04f74
- SHA512 085bc2a92c3a8d993ce22047d12077214d3f70f1ce6a03bb48c732949948ebf53ff5cb5f0f7d6fe00322fb3aae0f7b0d323cfb636c74c3dcef1db81f23b89ffd
- SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkjxVirnlBUKZ408vTZrX+lgdW:SNc/zEOVHFGiLlBUKubZrX+ld
- TLSH T135858C1623E901E4F1BBE1BE89779546FAB1786557308ACF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 f1a05f9dd8de4b1e9d58991bbbfe6827ba8902473baaa63a9a6053799dc13b2f
- MD5 3ebb2bdd597ef6d381a698082f83d62f
- SHA1 9622a20b295af8e692d6feb361aaae289c9801c7
- SHA512 e999f1d716362e70491b63509fbfb7f96e914e8760b9154ec8b0eab6aa8b8bb90dac482f631de7dc58959c2505410cc09cfeec744faf90937fe5bf9b67e2a741
- SSDEEP 24576:3TkNvNnaFeYhJNtmZBmFxVirnlBUKZ408vTZrX+lgdW:3TMwBtOmxiLlBUKubZrX+ld
- TLSH T16855AF6EB6B805E4E1BEC6B5CD238512F6727861173293CB5390C13E0E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 bd7ad4a5f60c95177c6f5be7f07479ffbd48dcfc3878dd613edc1d9458c4087a
- MD5 42644b6e6082149c167675492ab69380
- SHA1 80c32225220b59072a4f189b96fe66424e99223d
- SHA512 372a854ae8e50dd87bd2f61c853cdd9acc166e3dbf7eb2269aa8178e7e7d2553d31b35f5e24d996afbf6d5f99653ddbf294b0d0040415962a32068ec5dafec1e
- SSDEEP 24576:TD3FHshBIYQgAqxVirnlBUKZ408vTZrX+lgdW:TDVHeBIAAMiLlBUKubZrX+ld
- TLSH T10375E16EE69C04E4E47BC1BCD6638906E77238A9033265DB12D081B61F6BEE47D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH