Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 1.3MB
- Sample260730-vbamnasdnf
- SHA256 27f425b9446051aa1de93b218c06bd5b94f546f75f8973b55c8ef421ac9fb49f
- MD5 ea505e5f5336311ea2172f22dcf99503
- SHA1 d80980a7acff0772d7ff7d8758cdf8197261b2bb
- SHA512 5a7a9279b7b9fb89c651a275758eba4d6a271c6943aeb23350818d4888b4316ab99a268f2653dd16e7fbe7e8ef728efa350112231f08f3288c0fa8634e30e384
- SSDEEP 24576:5+8TJ3p8xpZzS3z1AulmC3V6mctvE/BT76+1NCE:1OxmBlmo6mGvKVO+n1
- TLSH T12755AD646A0509FCEAF1B638DBDA521293A13D51037755CF13D07F8A3E33AD2AE7A211
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4960 elevation_service.exe 4136 elevation_service.exe 5624 maintenanceservice.exe 1484 OSE.EXE 4300 PerceptionSimulationService.exe 1664 perfhost.exe 4268 ReFsDedupSvc.exe 2880 SensorDataService.exe 5148 ssh-agent.exe 5988 AgentService.exe 2420 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\11207874e62f061e.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b9d4f04f4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aede94f4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a20ec0514320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6c8008d4320dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1346e4f4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b87dd98c4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ab3824e4320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000664176514320dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4960 elevation_service.exe 4960 elevation_service.exe 4960 elevation_service.exe 4960 elevation_service.exe 4960 elevation_service.exe 4960 elevation_service.exe 4960 elevation_service.exe 4136 elevation_service.exe 4136 elevation_service.exe 4136 elevation_service.exe 4136 elevation_service.exe 4136 elevation_service.exe 4136 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4364 2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeAssignPrimaryTokenPrivilege 5988 AgentService.exe Token: SeBackupPrivilege 4268 ReFsDedupSvc.exe Token: SeRestorePrivilege 4268 ReFsDedupSvc.exe Token: SeBackupPrivilege 4268 ReFsDedupSvc.exe Token: SeRestorePrivilege 4268 ReFsDedupSvc.exe Token: SeBackupPrivilege 4268 ReFsDedupSvc.exe Token: SeRestorePrivilege 4268 ReFsDedupSvc.exe Token: SeBackupPrivilege 4268 ReFsDedupSvc.exe Token: SeRestorePrivilege 4268 ReFsDedupSvc.exe Token: SeBackupPrivilege 4268 ReFsDedupSvc.exe Token: SeRestorePrivilege 4268 ReFsDedupSvc.exe Token: 33 2420 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2420 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2420 SearchIndexer.exe Token: SeDebugPrivilege 4960 elevation_service.exe Token: SeDebugPrivilege 4136 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2420 wrote to memory of 5020 2420 SearchIndexer.exe 100 PID 2420 wrote to memory of 6052 2420 SearchIndexer.exe 101 PID 2420 wrote to memory of 6132 2420 SearchIndexer.exe 102 PID 2420 wrote to memory of 4668 2420 SearchIndexer.exe 103 PID 2420 wrote to memory of 1384 2420 SearchIndexer.exe 105 PID 2420 wrote to memory of 696 2420 SearchIndexer.exe 106 PID 2420 wrote to memory of 1892 2420 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ea505e5f5336311ea2172f22dcf99503_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5624
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1484
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4300
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1664
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2880
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5148
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5988
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5020
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:6052
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:6132
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2916 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4668
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1384
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:696
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2916 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1892
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 7f1da47e4228fb76bddd84b071bd26f38366fb23d84a5d1f23df9842c9584727
- MD5 bda5352e84b9c71eb9ed0bf2ff44cf0a
- SHA1 ce41d7e98c911c71a8d97d7d0cb2a559c057071a
- SHA512 b52f12071bd5130619e5d0d5a9e9c4c02ff69267bc4b29914fbe1f6b763685caccfd7ae8270134069e68a9988e96c310dd219188a8dd7fcbaf03cc118d35d575
- SSDEEP 49152:Ib+632BuPkFKRrdE6ohrstBhuXjfS4LWxnJ6mGvKVO+n1:i3q60jBeXeN+1
- TLSH T1D3D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 528c2f4526593e53bd3dccb841e49887036c4f7baf52964c4982e18384d09b7d
- MD5 da4747fcb23a70b2be86c387894deaa5
- SHA1 4d497ddf16575063c106666c84d5ee407432b349
- SHA512 2efb788bb0a7e542e5ee456eb997524e2b7b36c62eb2c956abbdfce162b8dfe9c45f5c2884c8f56414b7755a69e3d52dc5024406c3442bf934ad1627190f8b64
- SSDEEP 12288:n1XLsswWkxy2lRq2czAKtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:1XYfDtczAK6mctvE/BT76+1NCE
- TLSH T1F6850224779504F9ED6B4278C9A2C111EA337C9547A4E7CB03E4892A5F333D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 c39e5fcc9e465492bc4ce39e770d523beb5dd9cc097d096dcb7ab423ade6cc9b
- MD5 b2f607f7660e97641cd2d91d26f21a65
- SHA1 9f97125c3b671326f81d40c19536da4239083b63
- SHA512 5c0c7ca90b4f57d5ed9a8be83467b1c109acc4f98a99af4bef52a9322114e96f24cfb2369d9aa13dd14d7dc1f321a2946ff617391571d58daf5b67459466c9b6
- SSDEEP 12288:sXZNYVLeyUji0h90ZD0wxpGZIVutrHsBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:c0Le5ji0hmxqrMB6mctvE/BT76+1NCE
- TLSH T1C5959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 5270fe0975bcb651b6ee2d9e6558056d2450373d61e5edfbeaf82cd526f345e5
- MD5 d0273cd45caa4c7849305ad1dde12f9d
- SHA1 2dfcb017dadbd490218475d462380d26d2008df6
- SHA512 d4a8035311235f260fdda65b66c341f000797e1b3e13fa5627632d8173bb8d72b0480abc25026441d8fc6b4e9e066d05a109c741146b6b4f3ff432166687eeb2
- SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWr6q8wyu36mctvE/BT76+1NCE:N/ezSC6vUzPviHjyY6mGvKVO+n1
- TLSH T1B0755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 fbf0afe0d6bc0f05f3620f0ee936124a1e3015a9e1ee7e346d476d156de44c5e
- MD5 f064ff87c5599f1b9596412528eeb998
- SHA1 f0c51f090e1a7a8651cb9f5773e9985f11746fbb
- SHA512 c7cf915a34875e801c7cbd114a338e1035d7bee5c159900996639433897e53366b8da95042a891751a0651d8adc464e21c77118920755c09753dcaefdbb10337
- SSDEEP 12288:uVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98utM6hct28uP18WR/FW2Gb8JTCMx:uVbqPb88hv/l+bu6mctvE/BT76+1NCE
- TLSH T1A455AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB0246D72C3E677E6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 8143b150566369b48e57c8e3165bfcc89ec6baf2a1f224bdaaf37418e9a686bc
- MD5 ebc47e88ea3b12800b5fa7948c9f39be
- SHA1 3dc6fb64abbaac1d3cf42970b416827ea4a09072
- SHA512 6d0f7be2f1e2ab5be25b43c2fea0ea0350e66f8c429f26c08c3564e5f19d776985c933a2a5f46ffcfd93fb11786459768cfa41471fa64f7b09f41246866f2174
- SSDEEP 12288:CMVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:CMV6mctvE/BT76+1NCE
- TLSH T154652382981B11D0EFFF07F06395E296E8516EF934DA1C81D322991F9D30162FD4BAA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 9679f8d90d5a58e24aa03f2c035425769369511ef2fce6a53624f68bea798d3f
- MD5 344f238b2a62ccd82acfe204fab844a9
- SHA1 75ea857a110f6216aa7c1a043c132ec97b79571a
- SHA512 52ed8710001d593f9da9033cf0c6943fe144f0cda1de81833e8b4976a75d0010912841b5494607a7e944f2f94edec0d23f831d85b8a79f4de382510d19076247
- SSDEEP 12288:ceBNUbTVO86UGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:cJIUG6mctvE/BT76+1NCE
- TLSH T12D85CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 237715c956fa0d3fdee4a1411f68e8ae9b3e98a5cf39e00807fe300b0bb882e2
- MD5 7c277a2f244bb05e384c00fdde54186d
- SHA1 4ac901a50d29f9395119da5e0d220bfbcdd8230d
- SHA512 be50bcf1094c2f6600d0975131aad9d57d09b02e1437cc0ac45de28ce14968b793b9313b5b96f5a589df70f3969ba8e690be8ed358e8118d71f2962e362f9ae2
- SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THo:bQvGAdlCEL8c/RRNw5CHXeN+1
- TLSH T1A9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 422726b2b119b4e7efaa889a760f1e590bf8ddc7e47bd0fa4f68df22e0dc8091
- MD5 33efcfbf721f24106e9510b3952edffd
- SHA1 f5c807467ee64a36c13f4577e57ff3679f40dfbc
- SHA512 1ff002cd12186b222699a1637ce937780dedb6f687a507ac6c1b37821d1279f7402752dc21f88a3f3500f6b4efac5fd838e40a4b012890045d1b40b4ae68354e
- SSDEEP 12288:+AwSfxL/2Dc3+DLLmt0LDQewsAjMtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:jrewsAjM6mctvE/BT76+1NCE
- TLSH T17285E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 eb02d81182ce4185b6ade03486da0c2781c33064750d76c0ebde0056b68fde90
- MD5 af5d8134df99574052c42de5d002403a
- SHA1 544737d8f4c375cdcfabc9629d5f0b933c3483d7
- SHA512 b88c67f272b579e426857c2b0063ba4050d0a90d999c78780cb365e51e95c55741e9cac37884ea6f5e03539b59d21323fafed253a76c926e420d2aaed1ba9fe0
- SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHUXeN:kUEtQevvqc2W1cpV2RI32ae
- TLSH T17A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f16da223f2c995d460c538b79210f857b6f407965a6b2790b5f51c26f1eb6795
- MD5 143dbcc3a325d6eebfc89e34b2ecec27
- SHA1 35f19bf5bf080aa1ae1eddf49d041ec0d6b886e0
- SHA512 44d7f7755d518a632f801eeef568bb1db0cdc304237c8ff0d1af9328299c19aba3ba0a16d39d6c74e066c343770ca6a9f46c0c0556f77d3f6247c10d4f1d466c
- SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zs6mGvKVO+n1:2oqtVjnmjXeN+1
- TLSH T15FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b07cf9d2ff11895862a40824aa71e6d3c1501a1401c32897b3bb3e85c7840abc
- MD5 dd64f12c6a3a78e01d6b2d20a22992f0
- SHA1 6b3846eb94e935dc8963c9fee95647ff26d0dcc2
- SHA512 9d36834101021341ac3d8a4eee968dd88bc9abfd39fb3129d4351382cf8e3d1aeeb229b0b13a6a7238241e33b01cf29425d7e46e2921c5880f6406e61e7f531e
- SSDEEP 24576:FAhGL2IFoiwtA5l7S53D6mctvE/BT76+1NCE:FAM1Foiq5z6mGvKVO+n1
- TLSH T127359E81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 93860feaa9a4af3dd09929dff9e55ea3a7b4d1d7229cc1408abb476088b826c9
- MD5 8963d2c0db59572adf72180e97ad7f0a
- SHA1 ffa3a52ee9c61a862a140a80167568b5740405af
- SHA512 6d9b21ec7765230ba05bb2dcc74edd94792a50d8bec37d340aaf7a114791c4d04069ec2fcec6cb6ba2f566dabd1afaf2177d48e8c5a2bd765037913ba5db493e
- SSDEEP 12288:Mmw5HEjsChNDBFgl0WDm+CXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:pwu2OW46mctvE/BT76+1NCE
- TLSH T1AA75F14676A508F8E9A742788657C136F7F2BC512A25DB1F1360C61B6F33261BD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 0d4dbf8347b4c3c66db02b1caae46b03ea27d2fc0a7d461a05c251893186b771
- MD5 cf0da369b1b0ba436cf2b943bb54cac9
- SHA1 8e7d543f5ec82ac6a690522acca7ee5424e7428d
- SHA512 ccf2ca7eca573c061060d206b34276f21207f6752975a71ea2e3a05d0777f1c12ed06540d04e4f04f491c8140ad3771ce8fab3e7ce3b8d6af65858b95197f0b0
- SSDEEP 12288:vMZ1IyctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kZuZ6mctvE/BT76+1NCE
- TLSH T127651286226520F5E5E702B8C9E19245E77138E6377603CF5221466F6F33AD26D3AB33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 5f19c268d13ca2512ee6dc5ebd13d962511546744b65f25fdb7968bb87ab94a8
- MD5 9d01ab4280f06fdcbeab3865e090cad2
- SHA1 bc76e5d2d38439c4e7ee473ecfe1390fe8ff91ec
- SHA512 a5e55446a87c2524862bad153b6a6eebeb6676b95f3f9a55ee17417ae8f3b2e3c5d612de51cf41f29b7b54c6071941f4160d5019f5b1750bcbec75dde6cccde1
- SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U8:QQRQyi36YOcPhLvw2gAf+PN3iXeN+1
- TLSH T140667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a3968e1523f85fde610cc28c63345c1234ea44f73d876ccf08058be3921f61af
- MD5 4b3768cc652528c9cc0825ddf33fe7b8
- SHA1 c3992c9732a7023b33d39bab0ea9e14a35a5587e
- SHA512 e0d856856afd5ca8bfdf0603722a0458a76067a9053c62a1c1783d259660e9d909f42dff8d4abcbf1687645655c12e75602622644eba9d7fd669bd88197c341f
- SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U8:LQRQyi36YOcPhLvw2gAf+PN3iXeN+1
- TLSH T106667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 3d136876696da46eea46fc45bc5494b6bb3c14f9c519f7df0591121335a9c27e
- MD5 32be0e4199846ed091dd652b1cdfe771
- SHA1 25e715204e046fc03536478fbd53642ba724e9ed
- SHA512 b65ad8adb87f49ae0578a12f9cf3e5b00a173fd7c0150d269924653a38163088af60f36350f5ecedd5ee2200cc8319e03221994e3dec2a825396f99b737cac28
- SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0J6mctvE/BT76+13:768Qg55nhceWu7PNU3/86mGvKVO+n1
- TLSH T152B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 d3fca056a78f6c509686c5605ac30b110ea162d9fddd5861a10f732b0a245fad
- MD5 e5c27226ce92c6bcc96d6a1ca11a99c8
- SHA1 5aa7a5e4823dff677ee9e81c453008f92403f202
- SHA512 f12bb34f5a0dc028a6f46c838b4a1e759d8d73299b4b51c84cdceba0639f12c7eed83ee95de73742a5d46abf11afc8be0cbf70aaa25396c57244918429b4768a
- SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99m:fy5112gYy5azzVva69nLKnhZVXeN+1
- TLSH T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a782bbbc56ad28997b8b42c208f500ab3393be081472d95c32953078fb690100
- MD5 449748cc23dd2b1d5b6f4e79e6401204
- SHA1 7a8b06db3500a0751d1c4b448e67c765d56a2d68
- SHA512 79b90179c83e02b3d692db2277636e988f2342627fa201bd31883214905ec7e5b900c4cb0143d17411faca7e7c02555519a0020e5e9a0dfd17626b3edea7c4fb
- SSDEEP 49152:JB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl66mGvKVO+n1:fu6JmUxd2d6XeN+1
- TLSH T186D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 a6bae370d4189086ed20f5d1e63a9fc659c24d0208c79043b6b714f5aa4357eb
- MD5 2b5efc3018f1d441d1b0833b85488a2a
- SHA1 2db3326c97223bb40f490dd56ade760cf33d906e
- SHA512 6f78aadcdc2b5405662980b2344db86e127ee239351c849b90b9c5b702b7e6b05b692b9da15544be1765e6f90a871b6f2d42b85bad864e78b8cf19e8b9fe3af5
- SSDEEP 49152:81hpsNoJpF1A6BU44CwH7R4xm6mGvKVO+n1:8mifPkRjXeN+1
- TLSH T1F0B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 1f16a414d700406f49f21fee9aea15d749838effb7cc9a8d92a3df00e6fb850e
- MD5 3d62f06a4cf5d91cf591830da12a9c98
- SHA1 75d961ced523e4efa5a2207f0b944ab044437a06
- SHA512 bd753d5336754a4537685cf24aeea1bf1555b1b11a79554c160533a0e5ec60bd664541264d7dca09b831edfcc73a55d803c2cb28f4695de4372f948a72a5a1ac
- SSDEEP 49152:YSuZQIY0Be2KNRVtOnks6NMHqZ6mGvKVO+n1:C5dKvi61ZXeN+1
- TLSH T14FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 2614f0968af235a487061b6d62a423104b358ed50fd1516bed3a1e43200a994b
- MD5 8671559f18b7dfa1d8c5b10ab38191c3
- SHA1 f9b05424f1f52ccca9bfa9c391bc3462c5647b0b
- SHA512 68a74ee3cf7cbcb16d19f27c13b1e1ccc9d534521ec8f957a7efefa816d96d9b7cc6bab6a97c91d670de99b496aa01704a4427bee80463ad531b7d5701976b4d
- SSDEEP 49152:shtSn8EApI0figXgiDn0AP5wK6mGvKVO+n1:NX2iyphPXeN+1
- TLSH T11A95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 018f557e39b9ef8f4eb80a2d4625e07ae9bd218f8c4a1eda200099268a1bc642
- MD5 784ef8416a426c59b41ea5c624a9fe86
- SHA1 3c6508e9ba08063f698b691771e176768a1393f0
- SHA512 f1ab814f7227816869d26823954ba5b0d46aa7387f38292d843c9faac3eed0d9b6112a296c1fc38a63f70b61f8cfbe25a9dbb88d9590bda49f2091469ad8e1b0
- SSDEEP 12288:CNtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:CN6mctvE/BT76+1NCE
- TLSH T1F4652381981B01D5E9DF07F09395E29AE8502EFE74DB1481F326841FAE705A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 679650f4303c0cc7f945e6882b7f2d7320370b7644099095809e5e3003f39afa
- MD5 f1f3efd236d5761aced112ce19c0b8e6
- SHA1 97e83c13951be95b26a1725c3f9df5858bdc4501
- SHA512 b907fbc8074b52f31fe9ab5d2dc7a00efb5f2eb5b006b30b9c0af6cad8aef838ee4adf58055a4d1a6eebbda86e7c4f648bc1e17014d7d06284d983a12fdb54fd
- SSDEEP 12288:kAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kA6mctvE/BT76+1NCE
- TLSH T1ED652381981B01D5E9DF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 5fa1c276a8644984c6a51510220156e7d729f94afe1e253f38643730070a38e9
- MD5 f48556be42cf4eae8374175f5917aac5
- SHA1 37309480b8ce4c609a997a96f0671d065b4588df
- SHA512 46e07cdbc25a6011366640a4fea4e16bc15b648b0bd5ed8e99b2d6f06d9f5672eddf11501143a2c262cf96b33b19bbf71222fb1b1aef5e2307f2fdace4520b0c
- SSDEEP 12288:5etM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:5e6mctvE/BT76+1NCE
- TLSH T147652381981B01C5E9DF07F19355E29AE8502EFE74DB1881F326841FAE305A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 53ecf440693d9c3e26e44f28a3c1d0b05d9680132248a2b1f07a295a9481f220
- MD5 fbe88295ffb267c15a88c8cc8e69957d
- SHA1 8d7dbc19e34239ebfcea7b5c57c63f24a65b4e16
- SHA512 9d3080897494e1232e63eb0dfe80e9947d45267d6e16eb7449bedf8f4b334940f33431523205d65b4f1e476d94658e2b0c230068156278cbe6f08c18cf45a8fe
- SSDEEP 12288:4VjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:u6mctvE/BT76+1NCE
- TLSH T1DA652382692B01C0D8EB47F0C6A2D256E5B07DF975A719CBE311481F5E303A17D2AFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 2c9fa937c06dfc033ee3d2cc117b8a9b394d4ec10fec4313f4981311f8e9fdc6
- MD5 a262347590825810b7a5f5a5318ba5c8
- SHA1 dac8b1c8e36a63ed2ad8ce44622efa340e1694b0
- SHA512 a10a18076d3c968775a8d82178e0275edff14f2020ecd90f30b292db17c3cf88d02144613a7647be24ba37f1d5635b0e6d5b579bbbe6bbd9f55fc16f2c38027a
- SSDEEP 12288:zLtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:zL6mctvE/BT76+1NCE
- TLSH T17E652381981B01D5E9DF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 95c008f128a6340534cdd351d0472193725d4d91ec3dd0b5728b482407d3051e
- MD5 0a01003b7980a392c1ff2262f389b046
- SHA1 4f7795b3fa08e964ba5ab5cfc57764231ed95dcd
- SHA512 7c22f0ab21f3cbcb791dbd18638a0cdf7dcd7db35c813ef7eebdeb98842171aaecf56bf4d6c00f2817c04e00c7f5a81105ce35e6a999b7ee23e761dd7d66be52
- SSDEEP 12288:vktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:vk6mctvE/BT76+1NCE
- TLSH T17D652381981B01D5E9EF07F09355E29AE8502EFE74DB1881F326841FAE705627D0BDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 ada46afaccbce9b13149ac94bdb81d3c60cceb95e2e08665f466fd3c7e7dab4d
- MD5 2fca5d6f33102632027da1ed7df62e2f
- SHA1 127dc95a919b8d58613cb8ab111a0b912e71e7f0
- SHA512 be852d01f35035a729428bc3be82ff09d7eda9db1ef8990c56b2e5b2d1369ebb15df5dd33def9f2cf7e3419414d85d33c22afd15922b86a670598e7e39aca3d7
- SSDEEP 12288:iotM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:io6mctvE/BT76+1NCE
- TLSH T1B7652381981B01D5E9EF06F05355E29AE8502EFE74DB1881F326841FAE701627D0BDFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 95b9d11818147ffa46421f1c6db015d52228d6e19178defe605028a7c9be139c
- MD5 0b13633ef039a3bb0a853535ad79ff8c
- SHA1 17d99380db24d4900fb377b0052731e664fd1340
- SHA512 8ac241c1d53a08ed006c55f7a10ed02692c7a577963ceff696d0cc822c0741903262bed79118324742081a5b0093b23d9127009e33f2b3a281fa67177cf5de1f
- SSDEEP 12288:riZwbrzzFEoS2cPvygtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:WZM/zFVSOg6mctvE/BT76+1NCE
- TLSH T189850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 4076407bd4fb8a8cf3c03914c194f798597e51db176566bf711ad8926d654e62
- MD5 171c6e65b3daeba4861b08548638d608
- SHA1 a6bdc6f7e42c0f1a1ffbf6e3b3a769e4dd022cf2
- SHA512 78378a601efda512e31780d0a7273b0ecbe25f1c2251d5a2bf4c6bcdb6f9f91bcc64540270919e0a38a8e2a82b63db604e30cadfd5b2439bd7e7d325bf01eb8b
- SSDEEP 12288:vptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:vp6mctvE/BT76+1NCE
- TLSH T1F4652382981B01D4E9EF07F05355E29AE8502EFE74DB1881E326851FAE705627D0FDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 53ea86db889b1a679ed185eb266fe3510e8dc10d8c694ecbc74ee5b0056c7b97
- MD5 25a20d728625030fbaa977e162604e6e
- SHA1 43a59cb08a8d90e31ca2858c2bfec16d7268ca4f
- SHA512 e00be11c19c00d82648be96cc079ddd7ac33ebd85122d3fcec1945290030a61fc4fcbc35c368142957d2a9fc48d89bb8279822aacb9e3c525ab0d18a5dcb9856
- SSDEEP 12288:kltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kl6mctvE/BT76+1NCE
- TLSH T14E652382981B01D4E9EF06F05395E29AE8502FFE74DB1481F326851FAE705627D0BDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 0bdbf15aa07719d9b97b3c01c4669d8c76b0610f139a9b501ddebbb5ddc9fc73
- MD5 5e03d65598fedeef0a98134182199996
- SHA1 5d19727a7215ddacd9820cafaad5173e6c5f65fe
- SHA512 6f60b9469e87a418944e97150c295d4d23277f35edde76151a07a6b0993d4962471ab50dc33c92fc0af9bf4c0e5a852a81e12ffc6a5ba5b96f008ad78a8f8d32
- SSDEEP 12288:JyPz5L8ctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ozyc6mctvE/BT76+1NCE
- TLSH T181751143726630F8D57B4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 6962c2aa782fa6f7aed0854561d939b4160869c46f39d894900df76ea0a7d723
- MD5 219339999d423806ba671bc9176b0054
- SHA1 fcd7f2b364a5e7f4a7890a04823a80d8a56e9212
- SHA512 d69c1dd9c08efb9d72f35011cc06132bd2a15df7a2e57cdd07526d60ffbdfa14844aa24ec676626a24e9068cc3229a24552224307fba7cfa83108aaaaf403c74
- SSDEEP 12288:TptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Tp6mctvE/BT76+1NCE
- TLSH T108652382981B01D4E9EF07F15355E29AE8502EFE74DB1881E326851FAE305627D0FDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 4d3e1177a64aa25001b879818af8b38bff21aeeed88733ea015649cc9c767344
- MD5 a5b414790a5091ae2f37231e0f75548e
- SHA1 c43e7f0624077bb6a45edf1fddeb8f16bf9a92ae
- SHA512 59f53946eaae4dab915a40f7833a241889576e29a8d7f51d1d0cbe5e798f197162e43d2ce3054cde9a5ef43ccfe5c90dee6bb8cc2e17a7c6ccc57baf95fadf94
- SSDEEP 12288:uptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:up6mctvE/BT76+1NCE
- TLSH T1DF652382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326841FAE705627D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 2b7fe02f78ee6c58c84858cb423adff2627618a32ca47568eed7782ab2bfc6ac
- MD5 53db7206445434789d8b3b0a822dda02
- SHA1 99d55c6369447edfa51e2e915462273a0e6b833a
- SHA512 58d318fcd1c776a2d074d023195360fc03afb951ce53c005c53fd73f6501683b2c88c68386b4acff3755b880ea281899cb795ce144d41b24e64bd99b0fd400ba
- SSDEEP 12288:LyPz5L8ctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:mzyc6mctvE/BT76+1NCE
- TLSH T1BB751243726630F8D57B4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 76c3a45c5e7c2155173f2d6646765459676d4558a9c72678bc58f6f0ed4f2b24
- MD5 34028b8d19e5e0963ebb6ee0c77a33de
- SHA1 05307803ce7b95c25a14e5a4de63bd2eb250c429
- SHA512 76f3cae5459ca74b5ea2ea42ca9e63de42b1641c0690f9936a7eced1265a2ec05f90beac19237a2d478cf9e87870b31705e838534be824bc7ff6e3e64cb778cb
- SSDEEP 12288:rCd9NWYoaLHF3z0z04PDvhOtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:GT0aLl3z0zDO6mctvE/BT76+1NCE
- TLSH T11A850295B35118F8ECA7427EC9558506D6B27CAA1770C64F03B4362B5F333A11C2EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 7265c667361c0cac0534b120bfcc76126dcd0cff7d616f81567885ad47594e56
- MD5 bb0c7cdd8d44f74586f31022a7c6e5d9
- SHA1 423b90f5fbacfd6355649e782a01cdc4ac79f2aa
- SHA512 88aeafd25f8ce2abd20cb596105b5fd261c24fdf410cf3de91683c4b0ce306d52c4344d5118e5c3232855200434be324c1f6c35f8f0775d4fa41dbd3c49b563f
- SSDEEP 12288:Ti4e7PRdTfgwCHKy7GLbbdIvftM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:T3Id9CHKy7GZC6mctvE/BT76+1NCE
- TLSH T19195CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 a775557954ed31bc1e15988931985f49c30fd6368ced9936be43e08b228c2f10
- MD5 e0f35a2babb4fc6fc493fd04901084dd
- SHA1 ba46597e6c6f4858b731a5e0712a5e8bee9463c2
- SHA512 9f1fcb8942716e7d0afaf1eee1c23ef5b18892b2bcc57e1f893daba1affce70b1373141ed8a989cf0bf79ae9189165ec0164acd40b1c42ad73f546553dca07cd
- SSDEEP 12288:l+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:l+6mctvE/BT76+1NCE
- TLSH T147652381981B01C5E9DF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 42d040bba6f17bd9d7958cd399d0b842a2785c759eebed9b95661c2f2115a120
- MD5 ff28b4d465f7720cd66af9cd8a32dc2e
- SHA1 6da632e6d219e807d22edb1d24a842d258cca19a
- SHA512 dadd9d81e8870655c093d4832f9bc3bcb568e123e7e5e7ad59fa9e6a85fb29593f6ee4734b07d047b74f844b279af16fb61cb342f5a6bf6103daffa7b9bf7b58
- SSDEEP 12288:L8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:L86mctvE/BT76+1NCE
- TLSH T11D652381981B01D5E9EF07F05395E29AE8502EFE74DB1881F326841FAE705627D0BDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 7863af2c42c88b816410567a013b0d8de7efea4331c258767a780d9b749b13ed
- MD5 fa16131ec4bd09f10abbf6e24222890c
- SHA1 ed731362a1f81daca907221b815b944854bf8b76
- SHA512 a79b44725e86cfba16f78fc1b28abadc6799ae6a181c2f29fb42d67f1e9d136c3bf6a8956a118a4989de9b4be5b7148a8a7ab22bf7f3a11d3e8edc97ef1026d6
- SSDEEP 12288:YftM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Yf6mctvE/BT76+1NCE
- TLSH T1F2652382981B01D4E9DF07F05355E29AE8502EFE74DB1881F366851FAE305627D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 baa41185d0d1bec8e415a29bb271c2615cca9dbd8428574d95a25391cb51654d
- MD5 b4c1872467e554596b828f45df500c4a
- SHA1 a0b6c65748fc9b7ce9339ba6344798ac2e7161dd
- SHA512 e9ec6d199e2323dc3d2d25d2e432ad1af28a11568151ef89be11accfa66a115d37a1fc0d5f419de94eb0b06de824ec90a941016f11042b21ff6b108d68c8634b
- SSDEEP 12288:WptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Wp6mctvE/BT76+1NCE
- TLSH T18A652382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326841FAE305627D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 825dca1cb9dcf8a28d0d93beaf90115c22975fd8c802121745c9ed991c975779
- MD5 f5dd8bb8135aa5abbb510f83133d4373
- SHA1 14f329ff32f643c8b2785f38558d453c1bc7683a
- SHA512 e68d6ff5378d500dd60cc12ca32e9f303132319b3e7c648987fa277650783727410fb89d6755f4eee52b01f01a9791e88e7f8bdc6484b6609e1771937335c4ff
- SSDEEP 12288:O+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:O+6mctvE/BT76+1NCE
- TLSH T193652382981B01C5E9DF07F09355E29AE8502EFE74DB1881F366841FAE305627D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 087f0658facab582992e4413725d6e6e8e3fb3a006f6deabec03146cf33fcd40
- MD5 8c9af25c5c757bafc7f94e3d342365d2
- SHA1 59388dbcd6a8e2bf08fa11818bcda5e67fcaeceb
- SHA512 53b1920c63edc6f121c6251789b27b06c1a80feb47d088502c4a5198b9e596669efda596e11be2a76b7036e546009ae03fc1ac78074de460e493b5883eedb861
- SSDEEP 12288:zxtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:zx6mctvE/BT76+1NCE
- TLSH T12A652381981B01D4E9EF07F19395E296E8502FFE74DB1881F326851FAE305627D0BDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 6f1b7e3aa2100ec58ccbab7d51f6d4e3b180338e1c476047abd62847c5691487
- MD5 74b81f2c30f02a2df38175c65b209662
- SHA1 001a8d8df5aa9cc4c8032434c96f348e1e295773
- SHA512 823e8b35c07dc272914b3f9b0e49035437f4bfa50553f05c21d10686784840c7b4ea3b7f730d72e9f8f146ff8d83781c072c0df5939c631248294f0b3b916676
- SSDEEP 12288:oLtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:oL6mctvE/BT76+1NCE
- TLSH T112652381981B01C5E9DF07F09355E29AE8502EFE74DB1881F366841FAE305A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 69180ae0e4abffde3573fc5d7724c14b4565d3102401f8b08d926dcdc8cf23b9
- MD5 bcaf15b2b9c5a877d5e3aab3a841c65d
- SHA1 f6f8884c9aa9df02a7977fb6d87f2d3d5d0d79b5
- SHA512 348ae9ccda306d2db671d892e3b529755d9e75a406fa03b044a3ac4d4885d4649cb024c297825310f58497c6a4542fb510688999e38e70e9fc1fbc9217ee9033
- SSDEEP 12288:5WtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:5W6mctvE/BT76+1NCE
- TLSH T1D8652381981B01C4D9EF07F19395E296E8502FFE74DB1881F326851FAE305627D0BDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.4MB
- SHA256 48f1036a51256d7ce8c4a45b7d114c4573de41f8eca01812b2e30c5bbfc277af
- MD5 4e40778edbc79562b45683853c5d10d9
- SHA1 00e1fb43ce9ed9c683ae4905fec67d1be840c505
- SHA512 9fe809bf2130205b6946560c0bff1c71d1e2c19ec2564d7a9788a37065dd686c6c48d23e636fead96e965eacd020d4f6948e0f542413e75a077819fde42059f5
- SSDEEP 12288:gLtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:gL6mctvE/BT76+1NCE
- TLSH T1ED652381981B01D5E9DF07F09355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 e1010a9be86c3fb98672caee711e4f2e977abb4da3ee5ecaeae43d440e341e4b
- MD5 28f406c767f41efc4072b240476c1448
- SHA1 5fd405e5789df5ae8368dfd146ea2030088f7cff
- SHA512 0c27bd9162ec45dd752701b0bf30a241d3bbb410bd7b6d232cc6f1788a8c8be25d3b614d729bb299baf95f17478589563af7a20fb24fa750ffa1076e3aac44a0
- SSDEEP 24576:wfwvik9RX6wkyAI16mctvE/BT76+1NCE:SMnYI16mGvKVO+n1
- TLSH T13C95D129EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED45D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 cf54f6ecd001c6dba0766436f3e6e4c2ae01afd28c09359db889a20bb1ac763d
- MD5 d6d852c794e48f8b24f52a549c988d4d
- SHA1 92deda4bbe32c87e7fb72f4fea435245849ad125
- SHA512 34e55f42d6d92b6855a6221962caa2a294fbb964775a8df0e7e86c061d091ea37e673e1a3e682b8830d370ffc14cd5a051523f2eb02c52eb90eea440a5d396ac
- SSDEEP 49152:6YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0q6mGvKVO+n1:GySzPCXeN+1
- TLSH T115067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 d9117be970709feacf5cf646441047a5559aa83c487e9a6f6f8cf42f37865751
- MD5 ffb28350e6e1ac162c067c745ed93a94
- SHA1 b0ef160e9bbcdc57d4d821aef8f3a4444af86ef5
- SHA512 930037a7bd95e40f4dbb0fc363958cd8bfa3cc72ea3c5840f57257a7a870114a34a938445e2621aad9c03a93a77f7342c81f2ba5fb04944a2ef4c860b6f4bd3b
- SSDEEP 24576:d47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYw6mctvE/BT76+1NCE:d47JUQj4irIhCnDHUPfF/66mGvKVO+n1
- TLSH T13465AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 eeb8d3667ac965a73e4082a371338b515a773f24fddfda4d7a4ef5b2c28b6a91
- MD5 36e0f8d2434936cd49bc38db7e8a6931
- SHA1 d06c0967363cceb350b2d19f09dedf0547cd8d6d
- SHA512 8f29de6eac57393ac6b98b8d9e1e317e6c6d38f0d49a0eb254f835aa0e6f64ac2d706c61e4456c0740180799e5997f77560f8b837c6f0d0f70ae87314c2c0143
- SSDEEP 12288:w1sfZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4o:BZ6mctvE/BT76+1NCE
- TLSH T1F575F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F326906DEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.3MB
- SHA256 ed49e31b4884ae2e7026d0a4f904beaad836a14a228af173744af69c015ef1d9
- MD5 445176e3fe184e0d57398b8c607b1987
- SHA1 aba98721bcbb51feb38cebb1271d82031efe37ca
- SHA512 89e1ba759240a1440cba705774b4c6f596dcc3b1f36f6180d1604e9b5d1d68354d7edf97a96a3da507a3da53bb91b56209605f8725640f529d42308bfa12523f
- SSDEEP 24576:1hrZUPfxKUTOVeMZmTAi6O2yvTQThLaiu:XZUXfyeMZmTB6O2GTkhO1
- TLSH T1425538417626D78FC6A940321E36D6CCAB707D01FE456F0773C9873F9476668BAB2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 18e7c936969a33ff1625beed5a39c4b1879d1c3869bb37bc3cf2617403d933e9
- MD5 ba4245d3b36e4b98421f1ea5cda38288
- SHA1 8a589637e706d3349b63dffb5c765119f4e6aa41
- SHA512 8e91d3d243f19b406e2d357efe87f578010bc87d141db427a1137d2c97eba3a4c2ab288ffbaafeaafd2f05c1abb975d4fe96a710153803ef6a841116dd690548
- SSDEEP 12288:ge4aXzZlAeK602T63uYo8D//vnTvG8Y6dTEJ2:ge4aXtWjVeanDGL6N22
- TLSH T1C7552A01A5ABE75FC9FE50370332C6CDAB745C07BB46270573448A2C9877A7EB5E2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 33100a4c27a9623d12f7e367c807c0bb5bdd3de763ce345ea16375233a331355
- MD5 69b5e0b42fcb779fb6a8fc6d47fb78cc
- SHA1 08ad99e5b143a7ad689d9bff8fc6e95e816fd1d9
- SHA512 3e2c4f964a264d2264b3221382b6d47bc499440a6bc1e3f84667b809cebc1ef0f904ce013ef89b58723d061a64c03b3e1e0873afef1f5d49ba6dd47f870a18fc
- SSDEEP 12288:av7htM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Yh6mctvE/BT76+1NCE
- TLSH T180652382991F1184E9FF07F0529AE225E4157EF93B8608C3F212851FA9305D1BD3BE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 3aa5fc96f12a54747961dedcb0f082a000629fdc2bedc62326583b0d7870c877
- MD5 6a6247245793d92e6050655bf16382cd
- SHA1 cc5dbd10cda582c006b83fa84f82ebef2f2e9796
- SHA512 348822f7481b9384d9338880805a1bc45579fbb8690bc5d2205fbb21ef91f0259afead4e3c5dd4d0b725ed76c2b2d104e58adef82031ffc749583bf5804e04f6
- SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bY36mctvE/BT76+1NCE:zgb4mBIBhGFw6mGvKVO+n1
- TLSH T146659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 c41ddd68f7a0dfe5e4074f41a1718420b80f83aaf6e26f269fd67845e8d08c74
- MD5 5f05f46808eaa5fd4d6fa2e6f9228dd1
- SHA1 508abce79d97914bb7bdeb7ecc777b719c0d109c
- SHA512 d43c147121ccb63edb0980788191803ad13ca407289949792435dbd10063c41e0a57bba049d1c6f86d11698d537cc9e0d72372844d97f2b04668721536a0b2e6
- SSDEEP 24576:kG88u8FpJqH1jzria7/mg6mctvE/BT76+1NCE:X7ZFPqV2a7//6mGvKVO+n1
- TLSH T12095F16576E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 2748e292297c0aefa57e89119ec4cf6582449867ed960b35442aa3adc3d3930f
- MD5 2d28fae3344773a0d25a57f21a1f40da
- SHA1 f50a5d3882785b1ff236836259a48bfa653bdb97
- SHA512 0ebc3cab0a42d6617d50511274782ce38fed6647d892b55d0bfcc7a03e12c84a05fa8a81e7998043ba9df774cb850c519e1b131a10898c97206befefcaf9ff9b
- SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjk6mGvKVO+n1:TG05lO43bdXeN+1
- TLSH T15BD5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c982f093bea679be48595175ec343be4f6cf306504ff94d0cdb283ab442c8c28
- MD5 7737df38119761a96db8c4fa1b2965f8
- SHA1 81f3b15e43d269522953c04e3aeecdb9406fe642
- SHA512 4c5ab8d92db41160b35bcceb290d456c7dff8c0ad209d391bc91c1646fff2d1f8e3f2be8721f95aaec0e89c514d8c8a0831ae59fb2bab3759fb82aa7d3c3e52a
- SSDEEP 24576:/fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnq6mctvE/BT76+1NCE:Ha5POZ39Jt2pasx2+m86mGvKVO+n1
- TLSH T1F365BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 c42f0c35107b710d5cde9803c6c9760011055e9355ccfcd83ea1730744a88c8a
- MD5 3de2f34a63a5b532a807cd568895ef13
- SHA1 6816022de88d78814284842922522b4aa5409695
- SHA512 d64fb989e5dd9e931bd6d09e96e178345d7aaeccfbff8f67af943a79c8e41e7ee851d69d04f4490c5686cf71cbe61e4bbf6eff918fd6f4bd536edd753e135513
- SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkY6mctvE/BT76+1NCE:VNc/zEOVHFf6mGvKVO+n1
- TLSH T1AA858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3323af49835e41fcb8ab5948437afd079b298fbbe835247f1d361a84a545abe7
- MD5 44b2d9c6130fac26b4c7fb57cd0a29ce
- SHA1 f56a60dd4ca54de04dca762767170c897c81a10f
- SHA512 a478804743c70584428a77e41633276322dd27c86102974487dfd3fae19eb0588f67559c4c1e5e154f23378177ec360853ff7ee58bc3149ef55d4e3e2e015e31
- SSDEEP 24576:NtkNvNnaFeYhJNtmZBmW6mctvE/BT76+1NCE:NtMwBtOmW6mGvKVO+n1
- TLSH T14C55AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 35087992f371c422adbbaa43318aa5412caff1b1563593673959545e61a64198
- MD5 71db0a89d79992092685e1a9001bc3fd
- SHA1 49ea820016790db2456d5e3ffb7f79e4a5608f6e
- SHA512 ba04daa49152e660b9ce6b56effe614fb670e5c6ff8e8dbc6e16f6040ad3943c02c184144381617e2ea7f6f832fb8dfc0e7c2a6212e9cc55aaa3cf50b6457c9e
- SSDEEP 12288:AHvUrBFrEjwaQ0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:APUr+NQ06mctvE/BT76+1NCE
- TLSH T13575F21F65AD18E4E67AA17C85828319F77178A2175292CF02A1813F5F33DE8BD3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 8d3c683ec55d0223e3303e5f30d237a2b41119d04537ad31c510fdb38f67390a
- MD5 3bb65043eb76a19adf4d12e659d4cae1
- SHA1 2c72aa3f18aec70d87e8c651158997d26dde8c09
- SHA512 19a5fce2230944e040249fe5e8511c79f6270f9aaec317fd7812483d821a53bc766884426a752aee7fa38414b2895495ddf70741a6e525a9d338f6a642f1c3e7
- SSDEEP 12288:SQcMxWDXN1Dp/fshBItT1IQgAttM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:wD3FHshBIYQgAt6mctvE/BT76+1NCE
- TLSH T13985E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
- MD5 SHA1 SHA512 SSDEEP TLSH