Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 00:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 23.7MB
- Sample260715-adlsgsfx2m
- SHA256 aeaf6e0b8ca10a7d047c148c0b89e6e4f4c5d62b54518d7ca76142c0631e3c00
- MD5 ec8f15190d73268793614f49560d6737
- SHA1 fc79c94593a08f491b5378bd2ddac8b5fa329983
- SHA512 75a84f53cc7f15fce0166a028300632e8e63ec0f6738abe2e8e1cb8bc3d9a0d0e132b97523ef92867f923c4b7b1fec71a78dff02a270270d533d5ee3570a955a
- SSDEEP 393216:Ia/poVXFQYxpEgNiNP+VyjH62bdgReLlGxe66OiZmMz0Azq06qJfZOtEcIacV8gb:+VXFp3GGVy7/baQ8x/6HZmMz0AuqJxA/
- TLSH T15147332F66436AF1DD9E46F05DC41EF199B3FC9653008ABFA1A4D0D29F322E4CB19164
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 3216 elevation_service.exe 2652 elevation_service.exe 2216 maintenanceservice.exe 2664 OSE.EXE 2896 PerceptionSimulationService.exe 5984 perfhost.exe 4652 ReFsDedupSvc.exe 5592 SensorDataService.exe 4392 ssh-agent.exe 2712 AgentService.exe 5904 SearchIndexer.exe 2856 ideviceproxy.exe - Loads dropped DLL 57 IoCs
pid Process 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe 2856 ideviceproxy.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe - Drops file in System32 directory 57 IoCs
description ioc Process File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\906be53d83806d8d.bin elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\PushMeasure.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x000d00000001c535-350.dat embeds_openssl - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc395fc4ed13dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000704f4bc4ed13dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a5647c4ed13dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d677ce03ee13dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057589cc3ed13dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 3216 elevation_service.exe 2652 elevation_service.exe 2652 elevation_service.exe 2652 elevation_service.exe 2652 elevation_service.exe 2652 elevation_service.exe 2652 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2276 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeBackupPrivilege 4652 ReFsDedupSvc.exe Token: SeRestorePrivilege 4652 ReFsDedupSvc.exe Token: SeBackupPrivilege 4652 ReFsDedupSvc.exe Token: SeRestorePrivilege 4652 ReFsDedupSvc.exe Token: SeBackupPrivilege 4652 ReFsDedupSvc.exe Token: SeRestorePrivilege 4652 ReFsDedupSvc.exe Token: SeBackupPrivilege 4652 ReFsDedupSvc.exe Token: SeRestorePrivilege 4652 ReFsDedupSvc.exe Token: SeBackupPrivilege 4652 ReFsDedupSvc.exe Token: SeRestorePrivilege 4652 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2712 AgentService.exe Token: 33 5904 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5904 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5904 SearchIndexer.exe Token: SeDebugPrivilege 2856 ideviceproxy.exe Token: SeDebugPrivilege 3216 elevation_service.exe Token: SeDebugPrivilege 2652 elevation_service.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2856 2276 2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe 99 PID 2856 wrote to memory of 3336 2856 ideviceproxy.exe 100 PID 5904 wrote to memory of 1836 5904 SearchIndexer.exe 101 PID 5904 wrote to memory of 5364 5904 SearchIndexer.exe 102 PID 5904 wrote to memory of 5884 5904 SearchIndexer.exe 103 PID 5904 wrote to memory of 4476 5904 SearchIndexer.exe 104 PID 5904 wrote to memory of 3552 5904 SearchIndexer.exe 110 PID 5904 wrote to memory of 3408 5904 SearchIndexer.exe 111 PID 5904 wrote to memory of 5840 5904 SearchIndexer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\ideviceproxy\ideviceproxy.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_ec8f15190d73268793614f49560d6737_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:3336
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2216
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2664
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5984
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5592
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4392
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1836
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5364
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5884
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4476
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3552
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:3408
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5840
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 0b0b77c563f1c67214e66233536d238d527d51157e93efafa2346f333a15cb59
- MD5 bb80a70fa1988205536250575e6d75e0
- SHA1 d4729bc0c905516dba7bbc63779b17cb0165075b
- SHA512 d689dde2c7bf5c951ad9041efd1a85f3d023d150b6f2fbfc419b402a2384fb633a9080e4111102ce2b4856073b68867ca4da444a56b248c34ad578ff59a08afb
- SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3oVvxtJW:43q6sjB/3W
- TLSH T15AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 c821a871b5e28b64230e7078f4abcbec79672c0733997089096e95060226e904
- MD5 9ed8dbc900b9dd4050fb002ae11d494d
- SHA1 980caf2ab95616a121be6607d1fbd8aed379c4ab
- SHA512 530611cbfe0242b318bfaf411cd429b60bd3bab3c4c7bdac13db4d9c4aec9804009a451f0d805972225c535235489b878b60c68e818ecaadec1d790535562314
- SSDEEP 12288:21XLsswWkxy2lRq2czABZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMu4:0XYfDtczAK1W3SEt7vRuy15V/emW
- TLSH T18E05F129A3D048F9ED678278CCA28515EA737C5547A0E7DB03E49A255F333C84E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 ff11d2b93ea3a723d5cf12bfc93d682a8743d52d40421764a3134724077d26b7
- MD5 c27c4c80c4558b23f6e6839483e3d620
- SHA1 683e730f8accb3aa98d2e0bffebd71a5faa4c519
- SHA512 8f43e9aaa715b3121464fc9d764a68abea1cbad5eed02e3196a5789a74d56e15cae6e4c61e2b0026b497c59052540965bca291a71684cb54fc5b3f8aafcbf4c9
- SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CAZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbk:Owu4OWo1W3SEt7vRuy15V/emW
- TLSH T1B805F14672A41CF9E9A7423889578635E7F3BC162A21D71F13A0C75B5F37321AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 aa8d831f7b93ab0301ad71c345e3bd317605ccc1c29ffd1a0d530b24201d0ca8
- MD5 9f295074a00683c1784ce065a1804d4d
- SHA1 fb09e7601e03089dba050eb22dcd2447a54c9d2a
- SHA512 6f5f296a9092eaeb93c5f8e9577782774ede394ec526ebd7286a64aaad22dfce12f6b386902652126e5117e976e348de3d7087d884eae8a9052585d37bc24ab8
- SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glaoVvxtJW:Bu6Jmdxd2dD3W
- TLSH T11AD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1016KB
- SHA256 e7b1be65422d3b9e3ee68d7d8b35736270d825c22848a2039d2b7d56b1739de3
- MD5 64cd8a46312489c17cc24dfc3cf0f758
- SHA1 57cfbcfdad46ee876bdb08c3051de4068c5bcbe6
- SHA512 0b6dfa8f75177eb72fc5826b69854cf577511e788fbf7c4aa9a8204d82c6f2ecf0297add39c975dc5e834c6fe3a33dbe49ce9641da9a6f78e7049049c3d9eaee
- SSDEEP 12288:elqrU3fzuidc4LK4RWFeOF4UOoqKvB24ZGSKyt:elsUP3lW4o+UyxmGS
- TLSH T12E253810766BC75FC6A940325E77C2CCA7707D41EE45AB0372C9972FC476668BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 d34aa9b8b2b4d309881fda3c40a196f970d6dedd8ead7fe7bb8aaf2be2eda012
- MD5 0b1b0753ec422a93d2ee560cded72b33
- SHA1 ea07c6d4839479c8a6e4a9f93246716c2272b630
- SHA512 8591825e2cbb2f83a7ca9ed468d10543374761e2fb76035edf53d708461ce2705975cff208d1e74a9ac6ad8c9ccef817cb721f64b6d73d84bf0a749f2b785e18
- SSDEEP 6144:iR3jyvpUp86+MZbKbIRbIL1D/cbVtMx/sQ8SIcbVtMxjAVbD2ro5xWayM8qG3yz:6oao5QFJK
- TLSH T10F55B6816537A38FD1FB6131072A5B4C7B64EC42B3496F267388153ED82BB65A0BC3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_asyncio.pyd
- Size 63KB
- SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
- MD5 07a6e6dcc30e1c4c7e0cdc41a457a887
- SHA1 53bc820b63d88cbe889944e242b50662b4b2cb42
- SHA512 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d
- SSDEEP 1536:/0f8MOytWQazE6XWpkJONIYOnsO7SyLzx1z:cf8X2sE6XWpkJONIYOndx
- TLSH T174538D83E2808595D957A074D8B30F56E771F6500B0403DE62A8D29E2F733229BFFB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_bz2.pyd
- Size 82KB
- SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
- MD5 aa1083bde6d21cabfc630a18f51b1926
- SHA1 e40e61dba19301817a48fd66ceeaade79a934389
- SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
- SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
- TLSH T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_cffi_backend.pyd
- Size 177KB
- SHA256 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf
- MD5 210def84bb2c35115a2b2ac25e3ffd8f
- SHA1 0376b275c81c25d4df2be4789c875b31f106bd09
- SHA512 cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f
- SSDEEP 3072:nmHfhrWGYV6sewRdFRId6PBNKcqDn/C1j/UyS7viSTLkKxalPu//ay/i:nmprWX6sPRNPBAn/0/dCiSTLL0P2/ay
- TLSH T15C046B56329C12B2D69751788D675B47E3B3B8201750D7CF01A0C6B22F27BE27A7EB84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_ctypes.pyd
- Size 121KB
- SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
- MD5 565d011ce1cee4d48e722c7421300090
- SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
- SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
- SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
- TLSH T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_lzma.pyd
- Size 155KB
- SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
- MD5 b86b9f292af12006187ebe6c606a377d
- SHA1 604224e12514c21ab6db4c285365b0996c7f2139
- SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
- SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
- TLSH T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_socket.pyd
- Size 77KB
- SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
- MD5 b77017baa2004833ef3847a3a3141280
- SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
- SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
- SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
- TLSH T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_uuid.pyd
- Size 24KB
- SHA256 e6aa7f1637e211251c9d6f467203b2b6d85e5bc2d901699f2a55af637fa89250
- MD5 cc2fc10d528ec8eac403f3955a214d5b
- SHA1 3eefd8e449532c13ae160aa631fdb0ad8f6f2ea4
- SHA512 bf18089bd0b3a880930827d2035302060ea9db529ad1020879e5be6de42693bd0a01b40270b4e93ceaea3cfed20dad1e2942d983cde8bb2c99159b32209b34bb
- SSDEEP 384:8ZL2/LE/t8Cfi/1VIYZwXmHQIYiSy1pCQgyaxPAM+o/8E9VF0Ny8/r:8qLadI1VIYZws5YiSyvXaxPAMxkEq
- TLSH T1B0B26C92DA605C55EC2789B1A4E54F1AE935FB824B90C3CB330CC2555F613C37AAA3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\cryptography\hazmat\bindings\_rust.pyd
- Size 6.9MB
- SHA256 7e22d579ac503b959268964102c03d4e96c8a9b74186158b8c82fdc8cf9d9522
- MD5 12a7c0d35ccbd002150bb29ddd7e8440
- SHA1 f16d9a4654dc76b3cfada387ff7bdddb0b18b79a
- SHA512 c9e5e68de8f51f91cbba839b4fece1db4da7480890a6c7318a78deaa30191fcb8913ba447f45d4ae93b986f3246f09f8cc721e781ce020110a3bb5628b3ef9f7
- SSDEEP 98304:1CPfKk+AGdmA+xiIfIBE7S2ohqc/3J2y:gPfr3GdmAwjABE7S2ogiJ
- TLSH T1D4766C69B6B8016DD82AC0B8C3475223EB71749A177066EB19D496F82F73FE4273E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\libcrypto-3.dll
- Size 5.0MB
- SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
- MD5 e547cf6d296a88f5b1c352c116df7c0c
- SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
- SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
- SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
- TLSH T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\libssl-3.dll
- Size 768KB
- SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
- MD5 19a2aba25456181d5fb572d88ac0e73e
- SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
- SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
- SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
- TLSH T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\win32security.pyd
- Size 133KB
- SHA256 10882e7945becf3e8f574b61d0209dd7442efd18ab33e95dceececc34148ab32
- MD5 0007e4004ee357b3242e446aad090d27
- SHA1 4a26e091ca095699e6d7ecc6a6bfbb52e8135059
- SHA512 170fa5971f201a18183437fc9e97dcd5b11546909d2e47860a62c10bff513e2509cb4082b728e762f1357145df84dcee1797133225536bd15fc87b2345659858
- SSDEEP 1536:wsEpYpxfj4qSvXig4F1UhrbLaXcGKpwjr8LnCUA4RPdaZYQ0HgqFUdPEmU:JEp8L4qSvjaXZiC4RPdaz0HgqFU9fU
- TLSH T137D3399333C480D4E56A92BDC9B28A13D772B45407D0E3CF0556CA968F532DABE3AF91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\zeroconf\_cache.pyd
- Size 196KB
- SHA256 606951b63c631d15293309baf5a30c19f029caf3df7fb455f3d0b84000522f0e
- MD5 f73919563061664c146e3bee2c70097b
- SHA1 b9a31df2ce99f7d8560a845f54c084097ea5db89
- SHA512 1346ba79edc8170cd0199b0dda5434349d69caf5910f40b413f4717d2183ce21244051b0e94b20800a0de8740a902193118a2a0ae0532317c5a1e4591d6c0793
- SSDEEP 3072:RV/Gs8BplSs4UWpHUCGEudNRqSrORn6X5+meSP7VHqXWZWf15ENVFRD43hZg:Rtl8HlzWpUORn6X0SPBKXWg4dK3hZg
- TLSH T19814081523AC1099E9B78178CC23A613FB7374462B246BCF1160C6A53F62BD5B7BD712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\zeroconf\_protocol\incoming.pyd
- Size 212KB
- SHA256 0f1b588e348587c1a60ee3768a6b4b12080d6419cff175a451a42a9ebdf16657
- MD5 823b2e5da61fd056781fbbf5f5cf22f2
- SHA1 302400b1cc6a6032e6f1469851b149def331cf99
- SHA512 10d1e147c3aff88945cae0ea232b150e72a104373defcdf8debb03c88247403c02abac7e03b3e61ec92067db51bbbf528e681e22f0b9ce497e96463b0dfbe8aa
- SSDEEP 3072:NQG3DiMgJBN9pbRSUVdA0ZSk+xFI15Ljs2cY4YeGuPqYFB5Vol+YXJ:NV3DMJRpV/A0OTSJs2c+RuiY7vY5
- TLSH T17F24291663AC0899FA6B8078C833E917DB72B4462724BBCF11A0C6552F63BD6B77D701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\VCRUNTIME140.dll
- Size 116KB
- SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
- MD5 be8dbe2dc77ebe7f88f910c61aec691a
- SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
- SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
- SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
- TLSH T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_hashlib.pyd
- Size 63KB
- SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
- MD5 b4ff25b1aca23d48897fc616e102e9b6
- SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
- SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
- SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
- TLSH T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_overlapped.pyd
- Size 50KB
- SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
- MD5 78e8049e26df6fd3a4011562ff8e74a0
- SHA1 d5a91c720e4672c40e1dd6d54b3197b4a1f8b633
- SHA512 ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac
- SSDEEP 768:OiqKtLpqCvqlB1QIb1D1N+gpOUpEkCZ9hIYXth5YiSyveAMxkEs:+KzqC/A1hNekCZ9hIYXtP7SyExA
- TLSH T193337B02670404DADD67C2BDD8735F16EA71B4D2470183AF52A8CA4A0F737C16BEEB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_ssl.pyd
- Size 174KB
- SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
- MD5 0f02eccd7933b7a7c2bdedca2a72aab6
- SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
- SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
- SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
- TLSH T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\pyexpat.pyd
- Size 194KB
- SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
- MD5 79561bc9f70383f8ae073802a321adfb
- SHA1 5f378f47888e5092598c20c56827419d9f480fa7
- SHA512 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c
- SSDEEP 6144:VK/lLDYZL1p13eiG7eDT9AmNfLVuOgOgOgOgOgOgNltwZSm:VglkZHLVuOgOgOgOgOgOgN0sm
- TLSH T131146C5BB1A2C0EBD8838038D6D34A0BDBB1B865039197CF52C4EB7D5F277523A69319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\python3.dll
- Size 65KB
- SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
- MD5 7e07c63636a01df77cd31cfca9a5c745
- SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
- SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
- SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
- TLSH T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\python311.dll
- Size 5.5MB
- SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
- MD5 387bb2c1e40bde1517f06b46313766be
- SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
- SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
- SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
- TLSH T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\pywintypes311.dll
- Size 131KB
- SHA256 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
- MD5 90b786dc6795d8ad0870e290349b5b52
- SHA1 592c54e67cf5d2d884339e7a8d7a21e003e6482f
- SHA512 c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72
- SSDEEP 3072:luJ2G0a2fYrFceQaVK756Y/r06trRjEKQze7KN9eJKVKG6j1J:luJ2faiYrFceQaVfY/rx1eze7KbewVrk
- TLSH T1CFD33A47374684CAE936D37ECDA71A02D3A2B0110715E3CF46A0C29B5F63BD66E3A746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\select.pyd
- Size 29KB
- SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
- MD5 e4ab524f78a4cf31099b43b35d2faec3
- SHA1 a9702669ef49b3a043ca5550383826d075167291
- SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
- SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
- TLSH T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\vcruntime140_1.dll
- Size 48KB
- SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
- MD5 f8dfa78045620cf8a732e67d1b1eb53d
- SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
- SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
- SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
- TLSH T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 ff1b383796b6f571682b6217f0d2144e1d6a80c53d3a9d6fd226beee8933221f
- MD5 b2ec7fbcd5564aab1e5360b5d54e77a1
- SHA1 640e81125d2dc9a09c40f3d4e9c0f099441aa19c
- SHA512 4adce2d19e169305f8d4dc39cb8884db92c75f250e84116bf539b763542cff9e767a397c7dd15360bbe2bc0ad89749afa5ea5629286c9d3a70d86aa928326e9c
- SSDEEP 12288:8M7CZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:dP1W3SEt7vRuy15V/emW
- TLSH T1BAD42302D254E813F5780B704C2A5B28D45FBE6D2F80A3D7B787334899792C9CEB665B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 fad5dacaec9873837ab8c2894c9999a334d55264f38b13dcc115bf116d6351d9
- MD5 ae74c624797f1d3cf7c544c0ea6661e4
- SHA1 bb0982a54cc04d4518737792ce2694f98a067cb3
- SHA512 f9e5e72fe7bf3f73205125e31a128f0db1a4a6a3b4d8e32f730cd3de31ee04ebad963d5ffa7e42b1b55e71a4ccfa2f97a0af743397969af90a1a1ef46ae9b277
- SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYd1W3SEt7vRuy15V/emW:Ogb4mBIBhGFgoVvxtJW
- TLSH T1A465AE1E22E802F5E0F9D2B8DDAA4417D6B378161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 722dd701319ac39702875abab35aeb97b61b2f254538e2a09ed9d076d56d46f4
- MD5 b5a3b88912b22c70e62f711bab783a12
- SHA1 e53b2df0eabb2a021cb79f29ef87c15d34ce9b11
- SHA512 63bbc92f191fb71b3d1a4ac6d6867b2fe35d08969e243e5506e477efda421314fae67605f01d55743b1820455436b6d2c2476032de4c1632fede2d6f56784182
- SSDEEP 24576:kG88u8FpJqH1bzria7/mw1W3SEt7vRuy15V/emW:X7ZFPqVea7/FoVvxtJW
- TLSH T16835F165B2E001F1D47BD13889824A67F6B2B8250364FBDF07A88B551F33AD54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 260c3815366234ebc15c61be0f31ad2e7a6804b691a6ef959ac6a384f79c654d
- MD5 c1881053e95875adaa334d9f87ffdd86
- SHA1 0e0272fa4ae007dcacda217030fe465e30d0e4a8
- SHA512 d8f334e0866c2c21df5a77ac526d7a6495671ed9c964a7118654080ae49b5378ad09dc5f1ab859cc13bf400ff0d62708b000a9160b6b7d593bf2c75622fe081c
- SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8oVvxtJW:wG05lO43bY3W
- TLSH T19CD5BF6A62EC11F5D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c44bbd29fab99465ccf21eb6672ae1a0d049605e239c471911caa68d8f529700
- MD5 7d76dadbf110de6ef68bc1b9d1de79a4
- SHA1 fab913afad1434e7cb795638d05040c023c9a005
- SHA512 16c20220b55294d561cdab248bd543c86cf838e23dc1eecbd2e37efeb7751c0ab6cc8b8dcd5a57f514554a3e5c1e12663c8c1b86e61d55d031071f9ef4822fc1
- SSDEEP 24576:tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnq1W3SEt7vRuy15V/emW:da5POZ3BJt2pasx2+mUoVvxtJW
- TLSH T17565BF5EA6F800D5D179D17DC583461AE5B2342653329BCF122182BE3F37EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 4c9f98ede68c2a957523b7ee14f3e50279c512a4168d3ed176e57a52ffccfba9
- MD5 c4d60d229b80600156d4bd88ca31eedb
- SHA1 81d58ff321c7e99676d55d4164a48e7f6897cb07
- SHA512 748cd59f2cd3e9d728a25dd0dc9fef5507d27b5bb6b759d3c9795ca8ea7624d4d6922c0ed581af538748bfd147bf0ac4c405f3eab4da991787a3024b35f60f4f
- SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkI1W3SEt7vRuy15V/emW:1Nc/zEOVHFloVvxtJW
- TLSH T1A4857B1663E901E4F1BBE1BE89779546FAB17869173086CF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 e013d5e33245ffe1a6871708a9da1a47ac706cf6ce784973d65e60c50ced5ef8
- MD5 98a515c60981095fd2347fbe19b22894
- SHA1 f188aa40b26115078dbbe854c9b39365753b4f97
- SHA512 e5ed3a2a8299039963879a1a19aa6336a864c781d3e76f2d5ebee27a4b063360f85238d64bd7c09975d654e0f43cb571196d93ed7603688ccaf1d49da4b4fa99
- SSDEEP 12288:8HvUrBFrEjwaQTZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:8PUr+NQs1W3SEt7vRuy15V/emW
- TLSH T11805F11F62A818E5E67A917C8942470DE772B8661712E3CF03D1817E4F77AD8AD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH