4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 365KB
Sample260808-dxsxpasthy
SHA256 4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537
MD5 6fe3306248c933240d34f9e0b7e4c012
SHA1 bece26b9cf43cd4a0d3863c48dba7072155de7ba
SHA512 b221714ab268ed39e5cfb66abed30385f78abafdacb3bdbc1488d6e2d88a0252db783b8a5a1a18e573b3fbf8085e4b6bd110fa5a31341755149f4ff1aa37963b
SSDEEP 6144:6xEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXQZbdsanl6N:6TECjOZQbhd6C8acRgJ6anlo
TLSH
T1D5847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : EPSYDAFZ IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Signatures

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\npsvctrig.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\TsUsbFlt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vmstorfl.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pcmcia.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\HidTelephony.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\errdev.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\P9WOEB~1.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rfcomm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\scsiport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storufs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usb8023.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\scfilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\IddCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fvevol.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hwpolicy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\NDKPing.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SleepStudyHelper.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rhproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dam.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bowser.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\lltdio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdpvideominiport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sdbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\umpass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Dmpusbstor.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mountmgr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\monitor.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netvsc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\processr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\refsv1.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tbs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tcpipreg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdmCompanionFilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\smbdirect.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\storqosflt.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UevAgentDriver.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\IddCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidbatt.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndiscap.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BthMini.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\drmkaud.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpsdport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\MbbCx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\PEAuth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\stream.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\SensorsCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\appid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\partmgr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rassstp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelide.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cimfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\npfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rasacd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\refs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UcmUcsiAcpiClient.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\hidscanner.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdpdr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sfloppy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\UcmCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\xinputhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mup.sys	cmd.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	cmd.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C4N0F.exe	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C4N0F.exe	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	discord.com

Drops desktop.ini file(s) 18 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\My Music\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~2\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM82AF~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\WinSxS\AMA114~1.423\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\WinSxS\AM3CA2~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Documents\My Videos\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\WinSxS\AMBE63~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	api.ipify.org
3	api.ipify.org

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BITLOC~1\autorun.inf	cmd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\en-US\recover.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\sppc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\w32time.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\srrstr.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\prnms008.inf	cmd.exe
File opened for modification	C:\Windows\System32\spp\tokens\skus\PROFES~1\Professional-Retail-1-ul-oob-rtm.xrm-ms	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\wlanui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\jscript.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\iaLPSS2i_I2C_GLK.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\image.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\bcdedit.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\cngcredui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\gamingtcui.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReporting.psd1	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\NETwtw04.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\spool\tools\Microsoft XPS Document Writer\mxdwdui.dll	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\smbwmiv2.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\WebcamUi.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\wmitomi.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\Kds.psd1	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\CPU~1.INF\intelppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\EnterpriseDesktopAppMgmtCSP.dll	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\msctf.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\hbaapi.mfl	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\netmsg.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\auditcse.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ifsutilx.dll	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\ESENT.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\grb.rs.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\ProximityUxHost.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\pifmgr.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\wimgapi.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\netl1e64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\AboutSettingsHandlers.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\mfsrcsnk.dll	cmd.exe
File opened for modification	C:\Windows\System32\sort.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\dbgcore.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\PR060F~1.INF\Amd64\FXSAPI.DLL	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\Windows.ApplicationModel.Store.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\pnrpnsp.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\eventcls.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\en-US\MSFT_WindowsOptionalFeature.strings.psd1	cmd.exe
File opened for modification	C:\Windows\System32\@WindowsUpdateToastIcon.png	cmd.exe
File opened for modification	C:\Windows\System32\DynamicLong.bin	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\MsDtc\en\Microsoft.Dtc.PowerShell.Resources.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\LanguageComponentsInstallerComHandler.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\spp\tokens\skus\PROFES~1\Professional-OEM-DM-1-ul-phn-rtm.xrm-ms	cmd.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\iernonce.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\spp\tokens\skus\PROFES~1\Professional-Volume-CSVLK-3-ul-phn-rtm.xrm-ms	cmd.exe
File opened for modification	C:\Windows\System32\TileDataRepository.dll	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\SystemSettingsRemoveDevice.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\Windows.UI.Internal.Input.ExpressiveInput.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\iyuv_32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\MP4SDECD.DLL	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\fr-FR\MSFT_LogResource.schema.mfl	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\NTPRIN~3.INF\Amd64\PCL5URES.DLL	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\sdiagschd.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\reseteng.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\wshrm.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WsmSvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\ManageCI.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\PCPKsp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\shutdownext.dll	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ransom_note.bmp"	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-300.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\ONA3EF~1.PNG	cmd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_contrast-black.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\sr.pak	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MIEA2E~1.0_X\ACTIVA~2.LOG	cmd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro_NEUTER.pak	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxBlockMap.xml	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-100.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\fr\UIAutomationProvider.resources.dll	cmd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~1\ON46F4~1.PNG	cmd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\Icons\icon.targetsize-16.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\AppList.targetsize-80.png	cmd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-400.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxManifest.xml	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-256.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\vk_swiftshader_icd.json	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageAppList.targetsize-256_altform-unplated.png	cmd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-16.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageAppList.targetsize-32_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\CONTRA~2\AP8F57~1.PNG	cmd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_8_Loud.m4a	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.ps1	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-200.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI9A8D~1.SCA\APPXBL~1.XML	cmd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI4DF6~1.102\S-1-5-~1.PCK	cmd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-80_altform-unplated.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_contrast-black.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\1527C7~1.102\ACTIVA~1.DAT	cmd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.scale-100.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-300.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI443F~1.SCA\Assets\WINDOW~1\WINDOW~1.PNG	cmd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-125.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Csp.dll	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.19041.264.cat	cmd.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\es-ES\NUSData\M3082Pablo.keyboard.wve	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMCDE7~1.120\APPRAI~1.XML	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\ja\DataSvcUtil.resources.dll	cmd.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsLargeCloudIcon.contrast-white_scale-125.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBA24~1.1_N\calibril.ttf	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBC93~1.1_N\AP58AA~1.DLL	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Device\TS_DriverNotFound.ps1	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\JSC.resources.dll	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\remoteHelpers.js	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM8F01~1.1_E\MTSTOC~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMFB6B~1.1_N\serf1257.fon	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2A16~1.117\f\GPRESU~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1D8D~1.1_N\CommandPrompt-Win8-Replacement.man	cmd.exe
File opened for modification	C:\Windows\INF\netpgm.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5F90~1.126\hololens.css	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB6CF~1.264\r\DIAGNO~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7EE9~1.746\r\DEVICE~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB0E4~1.746\ddisplay.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0FDD~1.1_E\RS_IES~1.PSD	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\memoryAnalyzer\images\i_info.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM870E~1.1_N\PRESET~2.HBA	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB1F6~1.423\f\autoplay.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4296~2.1_I\infocomm.dll.mui	cmd.exe
File opened for modification	C:\Windows\servicing\INBOXF~1\metadata\RSATNE~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MID56A~1.CAT	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM9729~1.153\MouseSystemToastIcon.png	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC56C~1.1_E\DATACO~1.ADM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3369~1.1_E\QUARTZ~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMCD3A~1.1_N\times.ttf	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMFCE1~1.1_E\404.htm	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\MIA3C2~1.CAT	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\WindowsInternal.Shell.Experiences.Calling.winmd	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMAC3F~1.0_E\JSCRES~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM94E0~1.546\r\RESOUR~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMCF3D~1.264\APPVIN~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1F90~1.1_E\wcncsvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5F90~1.126\HOLOLE~3.JS	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4EBF~1.1_I\403-11.htm	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Networking\UtilitySetConstants.ps1	cmd.exe
File opened for modification	C:\Windows\servicing\INBOXF~1\metadata\LAF75C~1.MUM	cmd.exe
File opened for modification	C:\Windows\servicing\INBOXF~1\metadata\OPENSS~2.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA563~1.117\f\CLOUDD~1.WIN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM9C59~1.746\LEGACY~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0E91~1.264\COREME~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM8F28~1.126\TI_DNN~2.TAB	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME1F2~1.1_E\DISKRA~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMFBD0~1.746\UDFS-R~1.MAN	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_perf.dll	cmd.exe
File opened for modification	C:\Windows\PolicyDefinitions\WindowsColorSystem.admx	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5C98~1.128\r\daxexec.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD64_~4.-RS\COMDLG~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF50A~1.844\r\ChxEM.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM290A~1.1_N\SETUPP~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC131~1.264\mf3216.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMCF93~1.1_D\Inetmgr.exe.mui	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.IO.Compression.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\V20~1.507\System.Windows.Forms.tlb	cmd.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.1202.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME387~1.1_N\Netwtw06.sys	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA563~1.117\CONTEN~1.WIN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1D92~1.546\r\DMISO8~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM185F~1.1_E\privacy.rtf	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3684	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{37A9D401-0BF5-4366-9530-C75C6DC23EC9}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - fr-FR Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Vous avez sélectionné %1 comme voix par défaut."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; address=NativeSupported; message=NativeSupported; url=NativeSupported; currency=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\lsr1031.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Julie"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\c1041.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\lsr1041.lxa"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "804"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR Engine (11.0) Text Normalization"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Haruka - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Italian (Italy)"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "16000"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Near"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1041-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Spanish Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Stefan"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\tn3082.bin"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = 4ceb4de51753375e6967fd144fced62b87697270a205fca4961d9e7157eeb830	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{06405088-BC01-4E08-B392-5303E75090C8}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lookup Lexicon"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40A;C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; media=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\MSTTSLocitIT.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "CC"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lts Lexicon"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "en-US"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Elsa"	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeManageVolumePrivilege	756	svchost.exe
Token: SeDebugPrivilege	1704	SearchApp.exe
Token: SeDebugPrivilege	1704	SearchApp.exe
Token: SeDebugPrivilege	1704	SearchApp.exe
Token: SeDebugPrivilege	1704	SearchApp.exe
Token: SeDebugPrivilege	1704	SearchApp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	SearchApp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	SearchApp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3684	4860	2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Creates a file in the Startup directory
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rd C:\ /s /q
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Boot or Logon Autostart Execution: Print Processors
  - Drops desktop.ini file(s)
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes a command shell one-liner
  PID:3684

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VSPCD4M1\microsoft.windows[1].xml
Size 97B
SHA256 5a5c7aed7c50c36525d8de54652f563da39685c53c4488337d38e776d86da24d
MD5 9425ba6d36005ec487ce5351811d60be
SHA1 4e628db953ed31d985516da33530a21ad5176574
SHA512 8ce25293da3489ee03b99f86184c45f712418aee79f5ce96bb9ca45d67e46274f0a334518a5461f08f9d5f2592824070e85d08e9d4b4799f05d9d674b4cf959a
TLSH
T183B0927139458D194A9459A56D1910E021AA00AA520A747924A9B901BAA994AE0158B0
MD5 SHA1 SHA512 TLSH

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe
Size 36KB
SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
MD5 bad093419be1135cfe9694ea77088c78
SHA1 76204c7ca72cf666add9c9931389d635c82e8af0
SHA512 3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
SSDEEP 48:jDlmj1hraax2DvfG+ohTrNAg4eBDAudJ4hKO2I7dQOggBYiiqD1yB72G6nBRz9iz:jDlU1hUol9onbdaa/aarIkb
TLSH
T172F2D25DEB27BCE8E92E53F8757158273F56D543A4FD69AD00A762221C3824210ABCCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{709e29b4-e48e-417d-8ce9-c62de001394f}\0.0.filtertrie.intermediate.txt
Size 30KB
SHA256 8647521c4d2917999d714500fe282692b2093f667dd884f42da384a8dd2a7054
MD5 d86a6263d091d9bf951cec7da528f379
SHA1 a1181df12c2e6cff0f5c82278a3c3d79ab31a564
SHA512 12b478e2217fa0b7721f632f9e0c4c089ddc0d56be6d1565e29a531d4c4c53a0b8d8fccd7f64866721a175398ad5549f8c422fc0515da5163cf6cfc52bb3f9bc
SSDEEP 768:9/sdewc1IEZDgYpkfdb8y0oyPNaFHf1i2P9bBjN:yIBDnk9AoyPN+NdPPjN
TLSH
T1BCE20D35C772A16B70B15AE46F478342BC02C44697C7AA5217EDBCE4E4CA0B18FA727C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{709e29b4-e48e-417d-8ce9-c62de001394f}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{709e29b4-e48e-417d-8ce9-c62de001394f}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{709e29b4-e48e-417d-8ce9-c62de001394f}\Apps.ft
Size 41KB
SHA256 edaee03d967e9f0a4d78a775e0a2f9145cafdb402076c29dfa7d0ab80e2b52c4
MD5 fa83e764def0e638aab209fd4c4e99e7
SHA1 4e570c19b344ca6ba1bf65b163d78c5c8814d311
SHA512 0c6d9fb25dd3eb5c06b2b559086fa72590f3919297ce1a23f80b0dedb2d971b9db1768fe6dc9a1ab953f3880be141d115924192238ae20d533f56eb72982ca43
SSDEEP 768:FfQ9K4phNeU434CLYr23ht6ZVoVPPP87tCsGFfcHM:FfQ9K4phNeUk4CL33hteVoVPPP87t1Gt
TLSH
T154131CD94B39962FF30A1F395282A435DAE427B0A1D9E7C3DCD835A81DCD5620F3C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apps.index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{709e29b4-e48e-417d-8ce9-c62de001394f}\Apps.index
Size 1.0MB
SHA256 7644bc2b40dcb39b407c06ce3bc3e3a563f2fb00f9e8600201e9c5a5a232a642
MD5 e3a9f1d689e7e20433cf19363597c738
SHA1 a0f5aadff366b4c7988936efd91c561467eb0787
SHA512 2cfd43957af1c9f20241bde2e850b815082986834984abefc9510c3fdf2eb6faa53fc9d51f42b6e9d4f1d6dcb4cb01ac370387633112e63fd0ead9044c74f8ab
SSDEEP 24576:AoLr7YfoyFxz8GfoLr7YfoyFxz8GzyHt:AMwf1xz8GfMwf1xz8GW
TLSH
T12135E0096B60662BE4258BB42FC32F117FBBC51993FB13AB9B35413C1CB83457D6942A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apps.csg

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{cd685407-25a2-4217-af4c-671bf6ac4f2e}\apps.csg
Size 444B
SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
MD5 5475132f1c603298967f332dc9ffb864
SHA1 4749174f29f34c7d75979c25f31d79774a49ea46
SHA512 54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff
TLSH
T193F01757FF51C800C8800E7C0E6BCFCDAB10E8848E226307B2B9678E2D7355E5811A25
MD5 SHA1 SHA512 TLSH

Submit Download

apps.schema

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{cd685407-25a2-4217-af4c-671bf6ac4f2e}\apps.schema
Size 150B
SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
MD5 1659677c45c49a78f33551da43494005
SHA1 ae588ef3c9ea7839be032ab4323e04bc260d9387
SHA512 740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030
TLSH
T1C0C04C109C23D21BE56213E4BB7D4BD0C338515953B324A7B822B095574145D52A52C5
MD5 SHA1 SHA512 TLSH

Submit Download

appsconversions.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{cd685407-25a2-4217-af4c-671bf6ac4f2e}\appsconversions.txt
Size 1.4MB
SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
MD5 2bef0e21ceb249ffb5f123c1e5bd0292
SHA1 86877a464a0739114e45242b9d427e368ebcc02c
SHA512 f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b
SSDEEP 24576:A5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMo:AMVD4g
TLSH
T137650F08AFF56A1FCA6C77B6DEF94B8623B707800433F415CA6CEB252E4641B5E6406D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsglobals.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{cd685407-25a2-4217-af4c-671bf6ac4f2e}\appsglobals.txt
Size 343KB
SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
MD5 931b27b3ec2c5e9f29439fba87ec0dc9
SHA1 dd5e78f004c55bbebcd1d66786efc5ca4575c9b4
SHA512 4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd
SSDEEP 3072:+rNHn+auvNDrohmXLI7E8FAtXQkun1907JL6hq65sRQsqbmfEV+1+b:qNH+auvJohmXLIQfhI1YL6hB5PsqCfU
TLSH
T15E74447D064E0AF83160D7EA0CE969DFE39BEF239006A702DBD4D78C4E07D59291AD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appssynonyms.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{cd685407-25a2-4217-af4c-671bf6ac4f2e}\appssynonyms.txt
Size 237KB
SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
MD5 06a69ad411292eca66697dc17898e653
SHA1 fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d
SHA512 ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693
SSDEEP 1536:ek7gHR0SV2zp+MK2MHYAb8hqahIBAgoEA6YoGCmrzzB9C1D48fYMLZB1QMX+Z6pL:RUx2kBFeDb9YiAlP+zCmTXFePKG
TLSH
T11934B70E967739262E5BDBC40C5392E3FF1F0592A48270F578683E09898157FB1DBAB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134306330640250309.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134306330640250309.txt
Size 82KB
SHA256 3ce938ac4f2d5aafd314355e2add349e10274e1eccb49124606c7aaff96b6dda
MD5 54034360ab23b7f847e9ebd0090f63ee
SHA1 72f17d4a9d623e76926766dff2985450d643bebe
SHA512 961faefdebaf597fe087e007da92954a5c62d17b98ab72e15cbee4d40f596fb37bbc5f6e508354f0c68c8ebca5a0cc6077787f343aa2ee74a9bab58c42de9274
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/iX:vYYzoz1r1D
TLSH
T16783A4A53291CBF3317966A0BCD9E435E13926B1E0A88F4561FA9613FC5ADCC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDX_CONTENT_TASKBARHEADLINES.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
Size 304KB
SHA256 5105751a1b4eafb5ada4a1c9e917efaa9739c46dbbbd7627da2e9ac4b7289711
MD5 c02a33a06fe178726db60f2050ef1713
SHA1 f6fa8ce1c626d5d2053f3ac4656f248e635bd24c
SHA512 4fb2f0725907f26581a89186f1b33d32c1d1ed0ed3cedb1ae01c546018eaeede44bda6f1d4f3299f5ae90d0014f9238551ccc553338539bf935cd466ba0859ae
SSDEEP 1536:PCnHEuUFhRUSWY9+jVgDR9hmFGC0tPsGsQAWY2tnJXwrUGufTQB8ZXEwrUGYqc5P:P1fMN0p8Bq5V5TCo9hmzAEr
TLSH
T14B64FA236218E477CF862A8EDC3F3F376596611E49D58C98E79CCE088DA84BC27593C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 16KB
SHA256 6cbc2a45c0e45e6691374903b2d3022e35a506eb9ab7e7865f533f5464f61505
MD5 fa161e5b7cb492b8a621f6098f5b7dff
SHA1 51afe1ba248998b2a16ea13e0718224ad8fb3dcd
SHA512 4ca2b546f9f5ba05b010380fc76fd681a4231a7bf27cc52a0612f9d38b5532505aa67240cc5d13a612c87e94074d251d6a630ed3140948a972726324a10efe40
SSDEEP 384:nJqpJpczkkeZJBAVmApefQOVjeQ8RJoIuyRHDcMXPsQJg+i3+Oc:JapG8Jl8RJPuyRHDcyg+i3+Oc
TLSH
T1C97238742AF50766F3B29A718FF0996AA536B8729C01DB5E016203890637D52CDB1F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 16KB
SHA256 973f261a60c8b6ba89e69dfd47928863d89d9c147612222cc1aa5b65f86f6b9c
MD5 e1a88f7adcc8f5baa0682e2fb99c8de2
SHA1 ac0bb3afb2e5a86ad5c7d9513de7b07a3115efbe
SHA512 34693fa3cf961839b5f7d3bcfce4d4bdcc97217e6a9bb0523eb78406846cdef3730943de943e7e04e0e2a002368c43d7520417e3846897651c82f4ae1fe869a3
SSDEEP 384:zJqpJpczkkeZJBAVmApefQOVjeQ8RJoYuyRHDcMXPsQJg+i3+Oc:FapG8Jl8RJnuyRHDcyg+i3+Oc
TLSH
T1F57238742AF40766F3B29A718FF0996AA536B8729C01DB5E016203890637D52CDB1F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 1KB
SHA256 cae8b9f76db81bc04e02c2a5518ec71009efb55eccd596602bf8727c49e85fc1
MD5 4b7267efa8d09a16e168ebc993886b04
SHA1 ac2a1e582aa4f9bdbfc38dc9e9939548d7aafd80
SHA512 39dd5bd01ea29c050e7d13e66f39795315356d3a3e9f8ae03c404d3a8b82bdb09dd81e49943a50fdbc20887ef210aceb04280af86e3e9bedf36a6631d0073f03
TLSH
T17A21CA421E8B98AC6FA309B006AD33BD4664000C8EE182F542F1071DB5577DCE7BF7A5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_launch.log

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_launch.log
Size 2KB
SHA256 cd3142c15ad38cf21f610cd31a6ea158b58fc794d4ae320a71368ea455b821ad
MD5 00ff1887fc936f53d911f72d144b00a8
SHA1 7217ffb0d91f6a111124a2e517c54f7df4ffca2b
SHA512 31a3e9b25a5dabb5956f6c3147b1dbcf0373b8e783e141289c71677246c753d44e8dc8e0985183cf1cb8d1f2be2008f031483e2ce80a7a13b788f39dc36a3cab
TLSH
T13141C9421E8A986C6ED349B015AD73B94764024C8EE282F242F1071EE5273DCF37F7A5
MD5 SHA1 SHA512 TLSH

Submit Download

C4N0F_~1.LOG

Path C:\Users\Admin\AppData\Local\Temp\C4N0F_~1.LOG
Size 2KB
SHA256 cdf7797dcd50f0f2ffd9213f507b998d922c1ec0a8ed00910037bda53d182286
MD5 a3bb18c6d43c90df966c25e8fc7b38fd
SHA1 4a4da12db1e142bb562bf57159bf03a2b19e6426
SHA512 ac7df9b570bfc2cec37e08a3cc2006d5c06aeefe4a07325a1601cffb2ec0cd54a40e2bc805bd0294c7a2a1a4db17b54374b764f3912dc38c7da7b1ef6e7c64a0
TLSH
T1DC51DE411ECA986C3EE349B112AD73B94764024C4EE282F242F1071DA55A7ECF7BF7A5
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOM~1.BMP

Path C:\Users\Admin\AppData\Local\Temp\RANSOM~1.BMP
Size 5.9MB
SHA256 d43727499ceaa9f55648c01eadf96dd6bbe200f6c35141dd9e2a0e121fc2d4c5
MD5 86076f7a2c45dfaa8f6b7c0bc941433f
SHA1 1e5f39072a43722363b33a7a4401f6822bc0bb6b
SHA512 4784c779f9fd8223dd43ec3d6222bc06a0b02278b312433eefdc4c1633d13cc79da455805728a8222b7f68a9d34c476ea41b394aa4c4bf5fbdd46ea46d3c541c
SSDEEP 192:lxXJlUs9qonn1uRYfFlicOV31Z3XGgch6YQR9wMZ+/InHUBSzbyOSbZ3a92BZRPq:a61HGWrsH7GVm30hJKJeNuR12pjDy
TLSH
T1E156D7783B5D2DF5FB8CD03060E25551CBB146FBA8A021D0AB6E83F9D6C21885F689F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointInvoke.locked

Path C:\Users\Admin\Desktop\CheckpointInvoke.locked
Size 538KB
SHA256 6e1ff67315d9c52ba6cbb2839a49ca8d704f00224daa32afe26077715b461977
MD5 9dad5e77e278f2f3e300c4eb364bf843
SHA1 07dbed15d882fdf0488d22abddc3e81a765bb70e
SHA512 d78a56beeeed275ec10fe1924192fdaa2f71fa3f4778bbc74d01ed621d44013fed233821453214de8b069f216222a9e87c4db5cfd563f8e6242ad55b8ef24fb4
SSDEEP 12288:+ffe8WLo+twOLr4jSg3s+2i0LL5hwJW8DKk8U9KjEdkZh4:+ffeF55r4jSg3R2dLT8WLng9WZh4
TLSH
T1C7C423DF5BCC5A839F1B043165A9CF15A3199145A72A54FF092EFC603B9B40CC6EAE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromJoin.locked

Path C:\Users\Admin\Desktop\ConvertFromJoin.locked
Size 12KB
SHA256 c88f145b041ba9dacf5a34f72c40d0e3a4c271f875977d00334bf256a7b29a2e
MD5 a2e021dbaff13a29f7a28f850c0bfabc
SHA1 a2b3943d4203be27c0cbc696a047438a32b59d5e
SHA512 a0cc648cd196cf6a569ef9f0835611dd5d5f79cf32dac62901ea1cb99b4bccda9358a2b32b70e92d2efdedc7150af0db631dc62cc2facb7cb652fceea2b0a583
SSDEEP 192:UlI3AFlLpYfwuY7I0GIwxvUXcaPDkDgw+aIMBLzgmsN5lCVCICbIo22UrSw:UWQFl+InhGIuvUXzPoPXgvNbIFoUn
TLSH
T11A42D08441242E9E2843D2C5A87B4D329B9BDA03D1E85C09272F3FBC2FDF285B1D7192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DECRYPT_INSTRUCTIONS.txt

Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
Size 605B
SHA256 19e6c817c9ee68257fd430ba66aae9d6139bd3d04db5d53141ce0b0df7d2139f
MD5 1bb48fbe6630129f14998a8c54945805
SHA1 10b60a7f37b5f8acf3eb6347eb83375b035877e8
SHA512 0d55e3cc1af7e40f02d4ddbcfed461519a1a162e71aab15c3b63bdc83d856b148d8249dd5d298f10a0b99a5921a35756f390df7266a1c2570a128a8f8b3ffdb2
TLSH
T1ECF0DD3FF40B900106E324827A19BA62F350524D012E2656281DD46C207DA4AA6D348D
MD5 SHA1 SHA512 TLSH

Submit Download

DismountRename.locked

Path C:\Users\Admin\Desktop\DismountRename.locked
Size 9KB
SHA256 05b6fc8ebcd9a14b3b893ffe74edaf43b295ea92c84d0e1499be26c085d45414
MD5 aa10b72f830d269854d0809547132f57
SHA1 34b35d57e05189ae0739d57514633a9168e3aad9
SHA512 e6e80681e454d4f7fbfeff20ad4e710fb7ab258d0820b6473f3907bfcd75fe1802eb37120f7a6d03458ea5d1574a2720909f67a56b1f0942014dcf1f9ca372f2
SSDEEP 192:UlI3AFlLpV56jZuuOA7WdWbAk3vh9Zf8pMbgP8jOQwiN6/UDGy/kTACe1kd//:UWQFlnwbAk3vhTkp4XOi86dkECeA//
TLSH
T1E112B0E4E6193C5D260354FA35F404D72259D50013CA8ECA53DF96B57B4A4C8BE7DC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableDebug.locked

Path C:\Users\Admin\Desktop\EnableDebug.locked
Size 390KB
SHA256 b5b3a62205715e7245acff266467cd1225a5633094550efc2295830feaa3af32
MD5 2a11f577f90a7d004ce97560f635e3a2
SHA1 30f909484fe9b4804dc5c5143374603642fe5622
SHA512 0e6dd3cc043e330c74ed24016d7ca211bbbb968b8cadf6277f61ef3f2dbc830e8115409f1c08ac523f947bf93ba2e90f6a8c26d374cbb70ef7867e58f789443d
SSDEEP 12288:7YNcusAkaU3+vSrRA4P6ukZe2L3q0BKVXX9:7Fus3zxrxcq9V9
TLSH
T1788423B94B27406772AA3C366D9E11B7CD59B49FD9A009E380CEC444401EDDBFB868F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeGet.locked

Path C:\Users\Admin\Desktop\OptimizeGet.locked
Size 761KB
SHA256 e9338af4273e39d97b4775d316e17993044b1bc6db68f8971a16723165c8460a
MD5 d57960dbb4fc6346f4a00f683030e0da
SHA1 8c2eb44d3a992712c28a99a3daace688863bb088
SHA512 ee48937c5e275488d98b0fbdae4410a550ff4aaae92600f3ebc0659dba00731158e4eb827f2502627bf7bd34f2efb6e6318eafa099fdcc50a2675d3edc7b7ef6
SSDEEP 12288:Q+PKh0Kof0PHn+saaT2IrPz88h5SMlKsS7GqJYIAhcsDKtNy4rb5f7gp0XvrAo/t:nUp+saLI3dh107dYZcsDKry4REp0rl
TLSH
T11AF433B84A7E2159DE34E2F547073773560C32A74861E525618B3F2E2D48ADAB3FE1C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingStep.locked

Path C:\Users\Admin\Desktop\PingStep.locked
Size 910KB
SHA256 97bac2646dfda4918b639168f29f7ece16b6a2e0d6cc03e75fddbff455900edd
MD5 66043b33bc1ae5b34f0565571d26ec80
SHA1 b7397abf951223c0fdb7407d7d88d8f90b52050c
SHA512 52ba15a20672fb24372a8aaf7a679d6e15e39ff562a4447cd9e18d69edb2876d8fe87d44afb45cc17f499c97436c487eda153d85edad4677b3e5bbf50a480bba
SSDEEP 24576:Fm4ML0WZ19J3gVH+X5JMB8/6DHmCFDA9mYE3:sD0WrXgVepJMO4GCFNYa
TLSH
T19215334B2E87BEAAE7EC1265AC185FB2611D37C116C135E58F32321DEDD924E8C57388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopBlock.locked

Path C:\Users\Admin\Desktop\PopBlock.locked
Size 17KB
SHA256 2780016e3d329278e94ca06ebf0dde4df446b613ca82c5804a03b70950ab3562
MD5 e811176e987428c13780eac1ee52b96a
SHA1 03727d46faeb710db36fc4268d07b021f4cacad5
SHA512 8d1aab33be88306b01440ae92d1a84b61c296c90b770951084f4a0787149bd5204bf69d8a89fcad9d8eaf3a99a880aac695ef60bda0e371dc15d7e2c3c1345a3
SSDEEP 384:qWQPe62m8SbOf2+trj5azG6mEwiCIBYQJVrT5VXOGz9ABUiWevIzxuy5+f:qdW6BBbEZ3qHm1PPc5VhyBUiWAMRIf
TLSH
T1A282D0D98146991207EDEF0D5B4FC12E6286FA53926F0B40BDBC74DA330B0652969B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchWatch.locked

Path C:\Users\Admin\Desktop\SearchWatch.locked
Size 835KB
SHA256 e0a75e1dd21ebdecc39b980ba683a70b033f01690258e0ce2b09174f65a5e98e
MD5 f6ad22a5b30dc4f4ea302f124f6e271e
SHA1 90c63d799d16c5d66c71f4fb828e3d5bc7a851f2
SHA512 6f708c54c71ba26a55b49ef74253a311149c3514113c50bd2702141d7612a01af12a870dbff6c155dbfa79856126947a97a66167ac7dc625bc9de35ba0413a62
SSDEEP 24576:btOO5+eY64TYsSg1kT92BX76jZZbFUx6YAudd/dVCt:btOTQFeG92mZZOx6nudXkt
TLSH
T15B05335F49844D60AB01E055F8DC2D7B3FA6B89A2332AD2E50E56F01CA6A16243FF7D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendReceive.locked

Path C:\Users\Admin\Desktop\SendReceive.locked
Size 724KB
SHA256 fe694bc56fdbb84efb21b8c291efb7052a398744576608685f2388afcbf03a23
MD5 3c5d409e77c18cb28749d959a9893064
SHA1 3b91cee78fb55077d49f4d70f137cecd9e3ad207
SHA512 977494460427006800d4948245cd34c47da82b0581c6c00eb71033e7a01768049d9f2236e8cb5bf6b11e7445ddb625d386e8e1c52d6a59cf847a635835a1536c
SSDEEP 12288:/6Yz8HFKXK93fjcyJyBnuWNcLN+abL+9IFKubt+bDgtbSJFWnJwME:/6Y8H0KVwyJKch+an+9wKitbLFE
TLSH
T16CF433F9473A7DE5D2A590AA49E7937422083830CB42CFF47096F5C16F8D6EB20A3D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallMeasure.locked

Path C:\Users\Admin\Desktop\UninstallMeasure.locked
Size 650KB
SHA256 a10ad1f7118330773b45949c6f4154dc23f07235f1c34716c4679b7408692387
MD5 45b914430acbe2d0746b9352b5aeb2df
SHA1 c52536bd24e4b48da91becc841d56f91526f3404
SHA512 ca59ad9bda85b960be35786e644d304d8dddedb90648551ab9e1341a3ab2737a5c4255ae5be5a0ec0185b5df193c1d974cbe936d55a32e4d3739a8cff6b95305
SSDEEP 12288:pr7CuEAZDArmmedcFH9Seudt3LAik7wxSYJQy8Ds8U7aTLfpx:p6upZ8rJe2FH5YLAToPJQpDs8UALfpx
TLSH
T1F4E4231E0ADC094E95F19F398DB082A315DD0FB8ADCC3CDB7B196A6BD1C708764285B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseSelect.locked

Path C:\Users\Admin\Desktop\UseSelect.locked
Size 1021KB
SHA256 d4f6e51ef60ae3fb3a43a2f19f56ed27f7e9297ff98e088b4f56292836c35efd
MD5 3428b538b808cd2c064f7bf8eee98785
SHA1 caeacc75fd1e427af96798c8b7ac9ec87b47c0bf
SHA512 38d647f43fc5f3b14da6f054977f27b05224e591280d68a67e5747d38ef23f26c9ead18aec0097da698795115d58c1115e26b3ec7fff4349177b5ad0d9706e45
SSDEEP 24576:JdPFABiYlHKMRvKjWa24ZJduloJq+RGbDhBLT/hy+J1LUo+vafw9:JpFARlBijWGJZJq+RGhBfY+J1Lt+vaY9
TLSH
T1F12523BD7B2D8F6C7C48935526B2CCDE1B1BB52A0927AF82E28593155A1C09DB7C4CCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Desktop\desktop.locked
Size 346B
SHA256 a499aac43fbfb28cd7a08c9387d89b7dbb151095522943f412539f86a05a69c2
MD5 779ba0d4bdb574b83e454441788cc254
SHA1 61c086a5e90151b3bfa8ef0ac3b8bd32f256c987
SHA512 f4c88d5c816b0b38209abe99aea634ca04701ed7651ecb120e5416d006dc529b55a22241210a54bb692d431e93e1ed39193286597293aa759a5f4050fa6845fe
TLSH
T137E0C075CFC44288DE0D0106FCB4AB6C00F60B5842084DB290B6B8B9C9A7D5D0640201
MD5 SHA1 SHA512 TLSH

Submit Download

BackupImport.locked

Path C:\Users\Admin\Documents\BackupImport.locked
Size 9KB
SHA256 099075208501800d31bc12058abd51d9cf3a97e7bac3a007e55cf6fc186cc537
MD5 b66d670ac52e12f411379b656656d1be
SHA1 787efba84ad1064a2cb7da5edbd9fda281dece57
SHA512 9c9853b73fcb7a4590a3fba57e7bbd8d2b1ebea135367eb895d30518bd9fa534fc3d8ce3b1b18644f69ed3ea2865b2e4e37c7ffa8943699a3b62b17d7240d70d
SSDEEP 192:UlI3AFlLpOQg2QWpbpuCwJ9/DsXAjG1xR/rkGZ5CyIXfRHZXaxzw8vxH/VEnOHMW:UWQFlAQ8WnU/gX0GpkmCyI1hatw8NVAs
TLSH
T19622CFD3ADFB40F85B14FD4E687E044216F4381CD29FA025135A2A5B1B816ACFD86722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockSplit.locked

Path C:\Users\Admin\Documents\BlockSplit.locked
Size 400KB
SHA256 866e9256f8fdc3fbe12d82b18d3ae9de2d3ee7fe6cbb40c4f76c2acfbf1a82ab
MD5 75d081af78a3c06694149f634d570b79
SHA1 3688f6a24c91e3e1979e3f48367a484e61c20b5a
SHA512 4db77fd9bc4f724a78327ebeae21ea3b567c873351b644425d2a93cf234c2c038b00db44dc1110972fb537a8dafc60dc799b972ab8f4f47f28335859f282c8d4
SSDEEP 6144:8ql2xngC3iS7YzRD86cKmAKu926m8XTBOoEabDPqiLTkweUNPCVOJi:8ql2uC3iRze6hmzKBOoEa/X0FUap
TLSH
T1B894231508BA7E271EF1C1A40B7E961EBF847B1A87D93643869FC500FD512A87213E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointClear.locked

Path C:\Users\Admin\Documents\CheckpointClear.locked
Size 12KB
SHA256 e642c24bae123f930b10b512057e1434c3fcfd6cb9dd3724cfdebce4e881e732
MD5 d8bb45c22b3d77da2067132d10c0c303
SHA1 709aa41cc6da6e4b042fa79ba09aa636f7843529
SHA512 53aac060b3d7bf84b6a2054f18c2589038fa29c12953b140d3d1205101dcc3ad9a8693ef52dd12c2cf94ad21bfec34e6f6ae75e6c22c1c6044d399a75275c8a2
SSDEEP 384:UWQFlLYLaZQAKyWVH7LK51F4DvE1EUuXbzKH4as:UdLeaZlKZ7W51FS+EUuL/as
TLSH
T11542D00940C5DD143ED3F3AAAC39449687193B3047E3BA9EE70336EEA365818339E01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandShow.locked

Path C:\Users\Admin\Documents\ExpandShow.locked
Size 14KB
SHA256 9a65831ef0ea22d3d75dc2d69e48a24b0c81ce6575d46218c1ed98541a55f055
MD5 cbd45066386d3023c7cefc73f839be4f
SHA1 4f0831c21d620e9f9d36b30f00763c342057f03e
SHA512 ba3cd9c0e2a9c02d1c27ba9c2c97c96efb86b540abcebe258032e417735dbab1f42a99afe545d4b3b351d73adb63b9d5fc899ddc072ce828c891c77b0c91f22f
SSDEEP 384:UWQFlG+TrXsqbwyx3DsLEAzYuRjoSmdp8A6sCJWApiA0VG//:UdLG+cGQLEInloDd2bmI/
TLSH
T1B462D0E5A9C68CE3E510D5E70C382CE93A4FDA1450217E3EFDC419086F5A98CBACB147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - ynujfzklme.locked

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ynujfzklme.locked
Size 265KB
SHA256 0b0fdbfab5defd45fc12e993a234c3e6b1ab8548c5ceaa0d37916ea7eac8928f
MD5 da349c9c3c6a35c1442191d1a1cba56a
SHA1 ff9dec8ad474dee26cf506f164acf44821947b00
SHA512 706f40e5f2e4296e5d4d2ff3c0c33371b6a8d65e04083b4077d6d06968efb85deb6b8fb57dfa58029a78e46a229ef72eab8357c1fe7bdaf971d15d70176dfce6
SSDEEP 6144:dybUuoTOVUzqLbgOPgkJ56RoqcJl9XrKMHLp:dyARTOUqHgQgXRoq8llKMHV
TLSH
T15844231AED07753563538E900B5BD3C32FAA137C15D1ACA5B36CCFECE88110B192ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushComplete.locked

Path C:\Users\Admin\Documents\PushComplete.locked
Size 760KB
SHA256 e8de4abf5e0cb98aecc6e3282ddfdf87eaa5c7c6294abf060ff66b2a51429b2d
MD5 8466c780c5354001ccedde206c9c80b6
SHA1 745eab26cd205de68bae13dc7241396f5ce5de93
SHA512 9201f158dafe3fe099019c5c62303dedb9711ac06b31c13eef25cb995f7921a9c6a49fb8f20f1a01d4736b2e0b060b60b81cd4ef0febdbd057e5abc8dc77c22d
SSDEEP 12288:66+bCze4LtIMNWu4ZRRFp1MrjFKIQ1AdYh2HcNBFlhyI8PYcm2lSb/5KIz94b3Dq:jXLtho/FLmp9Q1A/cNxMIC62U1zIm
TLSH
T1F2F423E8804EBDAE8FE365884E34D687AB8D538BF915D14F3541C1296A8CC0DCEDE741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushLimit.locked

Path C:\Users\Admin\Documents\PushLimit.locked
Size 16KB
SHA256 1878276ff1f9a222e5a79eb531b32a93ee23bdc45a57ee43ca78d5dce98a9b94
MD5 1987ecd0e63eaad8ec34192be1a298f5
SHA1 c01fd893274935ecbe5b3d116e2e487442511130
SHA512 6c4ee6fb70b7b7c136bd82776659302055f1a8ab265bc42f333d9e73838cdf008a75aff65e206f452b38a48af3b5321c2aa637abb62b302a2ad5b84dffd61e4a
SSDEEP 384:UWQFlTJLt0mWoeYQ8VGhLM+WBXW5hynkDGl43U0p:UdLZemWog2GhPQXks8GZA
TLSH
T18372C0B102D03CA0D755E792612CE4AE26BA943148E5661235D4E9B90B82E29E7DD363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveCheckpoint.locked

Path C:\Users\Admin\Documents\SaveCheckpoint.locked
Size 360KB
SHA256 afe3295a4d11eb13d70d55e0263a90d1c2a779ac5250d58c5aab66dd4b176efe
MD5 7c0449d839460f86e741e75b1320c207
SHA1 cb826d0bb850292777c2cc67aa9fcac4c6bd9b84
SHA512 ab90e3ddbf1f320440849fcb71d8e0d38bbe3d3b03ecfa10509e0bbfd6fbcce19a26395ee11a168c85b758e6a05fd821ca4061a167689de259ef453392711618
SSDEEP 6144:UsSSsZ1AMqIaNCzt49e7+MLpKNFfRrX2p6hIBDSawKYaS5l5S1PSMvJl8LD8PynM:VsZ1AtIg98n6fdq6hIlXQaSn4PEKl
TLSH
T1A97423A03EA19F10D642F0A1AE1597851B3101EFF5ED5C7B35F2C8EA21DAC43A785F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectReceive.locked

Path C:\Users\Admin\Documents\SelectReceive.locked
Size 640KB
SHA256 ec8eef8ca19600343c313f64ba001b980ce332e0ddba66ba3dfcaa56770a4d68
MD5 a3e0e7ba00f869c5f3e53e84f039e924
SHA1 e288f3be28a8c26aea34b34688f55953355f6b11
SHA512 749e1d0eda19f43ccb24d85914bb5194bc439eccad1776b2bbcf576bde2d24430db846f1d54e593003238ad3546eaf06995118c71582bff6f6690eec4723a187
SSDEEP 12288:iWvU6lH/XMAcCdcGQkUztnrAQKyoX/NroRI4YGs1cP6dV2kGHHR0LCFvlTXNfuGA:3vnlHfM3CdjUzt0QDoFr+ts1cCdVrSxG
TLSH
T137D4339C64EAEB23631671D0C115BE3EDC02B695366EC07D0DBFA889F19B49E21D742C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishWrite.locked

Path C:\Users\Admin\Documents\UnpublishWrite.locked
Size 18KB
SHA256 6102120bee450c20573676ad7f6da84d425911e399cb1d537d1ea932e11d3438
MD5 b63cd2b3746f5c531af2df0a93072c4f
SHA1 8fdd804b35753cfef29e03f6ac96199deb4fbf87
SHA512 1af48fc3f9b4d36090d153692521c6c0176467ad347743c0aaed90429316f6c84de8bfcc8b870eae2218f02519d89778b165fb9f87a4d67821a9a202ac007971
SSDEEP 384:qWQPe62/eiY7BOLKukfUl867hOCF6LgZ5WAWng2FPsMe2JZEyuoyI:qdW6Se77BOLKu045cLcfisCqy1yI
TLSH
T15D82E00FAEC615453F7E0C18CAB8CF2C6308B92402AF554534B1A5BDA6A077E17BF657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Documents\desktop.locked
Size 466B
SHA256 39fed699e16b273f913293da352810d0218e32515aedf51d04acb0892352c66b
MD5 02fe65f7e1c15be18bd84372512ab090
SHA1 8e3a8c078ed595b8b49b6f10c0426ab83704908d
SHA512 641a3d9005bd14b2a3a4bf080afc3a6d151a4447e604dad9d1a0cf8fb8b321c195acbf115174cd58502c6c464b827c32e9a2f494201be7d114172ab76e51b526
TLSH
T11CF0547CCF80428C9D2D3403FD74BAAC00A64B0C41544DF1067678AB655B92E0200343
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Pictures\Camera Roll\desktop.locked
Size 254B
SHA256 673d1ff7cfc4f0aa9ba2e9fdceed54f4f05e5cc702491cfd320df06bc334372a
MD5 f077ffdde07ed0940ad1570ffe942622
SHA1 091b68f3a1f7e60006040b96a9f4bd79eaf8db5d
SHA512 82d259de4f6a5694f63d13aa6d7387e1162bb4c694731f9d9c17f0a7d84ae9d5cc9051b8da96dfac34906ee7a51dc0ae6761addb2da7642ad00e561b5a37d5df
TLSH
T13FD02E3982086188EE9E4017EE70E97A01E94F04A3A46AF212BE21EEC886C2C5A85200
MD5 SHA1 SHA512 TLSH

Submit Download

ConfirmEnter.locked

Path C:\Users\Admin\Pictures\ConfirmEnter.locked
Size 575KB
SHA256 b0df07d9681d645b5c801f9d0875df9416cbd2ce63158404cad6bc081c9da51b
MD5 66cf90c8e3ec38482e95b06f945976e1
SHA1 1a1c85d4a6e9aecef110879a159164f42ef05cd3
SHA512 ec0bb13723b3dbba77920fe5b8b01524b76d18d3f72e5007eff400af1554f82073aa7712f5d82e746bbbc4dfb337dcee86fe9e4042d035205daf71f3ea51f8e7
SSDEEP 12288:ZR6MV84WqyuFFespODpAma6yJwh5Iia7NWdLpVShCE9w:yd4gees4DOma6yJwQia7wdLrew
TLSH
T18BC42318B32E487A3D2D39BB86DDF33C0D4665EB34411A484F275FEFFA2B5111912286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeSync.locked

Path C:\Users\Admin\Pictures\MergeSync.locked
Size 641KB
SHA256 ac874fae97a8607b6674d6132436bfe1301ccc8590b8ce39e7d38697585d3f52
MD5 cacf5dfc51d77039183a88be919e3909
SHA1 56be5238fb28ce75be425fafa56116a4afa08a99
SHA512 31ea9019ce226d8ac2382dd617591d4efbbae1bc0a45f878aa18d14fbe5dcffc54a5174c370636b96b98ee8875f414d9ce42ccd705a7bb3daabc5f8f36129d09
SSDEEP 12288:8naV5n2WwiXC1ITH1Il+iUpyvsRKeuskV1Wdkt7qQpD5HtaWx6+kE:+G5n2Tiy1uHC+pprRxcgqt7ZpDlPL
TLSH
T1F7E42323333B3BF634D11E575606F461B39A52548EEA22F72C8C0695C184A9A5CEF49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveOptimize.locked

Path C:\Users\Admin\Pictures\RemoveOptimize.locked
Size 1.4MB
SHA256 49866d7154875bbd7fee89e10e18fdf422e6aaf1be111fe87fa42410388ee224
MD5 7a6b28ac321704ddbd86d75feaa21c94
SHA1 8280ab18a5b1d13a6b40c2c5eb89e13c3dfc7ac3
SHA512 932c72ac0d1be62561aa599de4f94cee6596444312b5554cbab43901412d47f0198d9016f13ad33cb3cd9df7c9f8598c8e796901740a0c0c91d55341a29a7203
SSDEEP 24576:psmk5udJ/RY05DlP+LYkQlt1bt5cMcBGzWPLggds31cKonpvKGEJ88yHAG:psmkkdM0dRlt7u0KPLD2CnpyRi8oAG
TLSH
T1976533E4E7C0D6C5F3FAE9D9E11D3BD41569EECAB41A58086BB6D72CAE06C432742403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Pictures\Saved Pictures\desktop.locked
Size 254B
SHA256 a6fa51be034b4dbbb558c7ec5fdf8803593f81739e37c960b21f9ba532e12dcd
MD5 9e98a606719f0dfd90f4486d2a73e8cb
SHA1 f6370f234594f8f49fb51b52ad0497e60ad05a92
SHA512 45310ee07bdbe55d19b0ec44d35683f65c3cfead031dd117e939d800abcbe0782257c2664305b3da9b890d4fc04a29ccd854abd66bf7abe394cdca52dcda1fa3
TLSH
T120D02B3946489148DE5E0017DE70E9BA01E94B0457645AF1127B35EEC447C2C5685206
MD5 SHA1 SHA512 TLSH

Submit Download

SwitchStart.locked

Path C:\Users\Admin\Pictures\SwitchStart.locked
Size 806KB
SHA256 bdf67ca7e33819897c17c6fa60a007d50fc8144ebe4c1d60276839a5e2611538
MD5 1674e51c1414c6bdb090d0909112b174
SHA1 040b426be3f7ffb9a66a85281d028a11881d6c72
SHA512 2a7523f08f2edf14bfc2e28735e9b3cca55020995096e56a7bf77965c08f2702d51559f1e6f19f90e928c1c8d067e5099de39ac1c3fcc6d525c61148d87ac85a
SSDEEP 12288:3nkRa47m4+4l9sfPhHF7sERga3xCm5mmDh8QyjDJtuVDeOO3Z6xwKaRTeir4:gt7/+4eP3sERxr5mGnyjOJhOJ6MZeir4
TLSH
T1C10533244BC5538785E887DA437F71A49CDFA00F97A88B5DA7AC7FA52DB980CC2C1523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockCopy.locked

Path C:\Users\Admin\Pictures\UnlockCopy.locked
Size 773KB
SHA256 a61bcf5e5e566b031c5c8ba1aec17c1be12e35a19a8f46ac828412f41580e4ce
MD5 cb598f542fd0199bc7ebfcc7409ad271
SHA1 89cb7ec3deddeed408de3c1c9c196a1ebfc07699
SHA512 130e7311cf55ad287274f254a02488586f072837075c03cbda8ff842ee408d47a27ff82c01a626da77086cb0c89626bfa2c11ed06f6c0a61642f330947bee545
SSDEEP 24576:Ygibm22Uzd5RJxHdMuBue3Hqnh/dzZC2Ekz8:Ygx22UzdPHTB0JdZCQ8
TLSH
T10DF423A7FDCD54DD8DC6CC9D128EF115DB9984BC5A23B376AD889181E0EC04A4C8937A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.locked

Path C:\Users\Admin\Pictures\desktop.locked
Size 568B
SHA256 3d0e92f1fabd5eeb0283d5c79ac09ade32bae553d3826752dd2459ce0e92c393
MD5 98292d8267b9fbb36fea67357a8d6b0a
SHA1 8edb06825cc501438caa00743727fd753be680c8
SHA512 f60555d46d978302557ba6a1dd95052c8bc99fac3b1952d1f8ae2e5c2621c9cc839fc94515d534e0b3ccad149dafe1dc24670c4d7c2cd332c3ef284b7860b176
TLSH
T1D6F0EBA84908920D5AAC4426FCB8EFA705EFDB0002698E7021B335BEC98AD2801C6D0D
MD5 SHA1 SHA512 TLSH

Submit Download

tNOiRVO.locked

Path C:\Users\Admin\Pictures\tNOiRVO.locked
Size 24KB
SHA256 c8257a4745287adffdce2517cb9b26950dab3fa7f11fece81d7146bff5172358
MD5 4d3e93e46b4b516962d7a04f7703e369
SHA1 c8448868fbce38949808eda81279993d30592fee
SHA512 7ee96f3ede92c2167a238c324f1ced82adfc4e7e814cb8dc3796f6ec37a6507ddda07efca37773cfab17e47a4bff5eaada00f2c62345f37b7951fb38ea155bf1
SSDEEP 384:5b5g3XNcBPJYnfQI43ntrnDntb8BfqJdOWZ+kEY2XbOJbQjHwQfbIPWATL6SmEmR:0H6PmfKtrnDvGWDEY2LO5iQtPl/+Lyk
TLSH
T112B2E10B10B61A0BF8A12BCBC0DD40DAB9E6C63BEFD75F6626CA75033E537941259D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-263-0x0000019B7D9D0000-0x0000019B7D9D1000-memory.dmp

Download

memory/756-267-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-276-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-277-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-278-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-279-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-280-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-281-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-282-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-283-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-284-0x0000019B7DC00000-0x0000019B7DC01000-memory.dmp

Download

memory/756-285-0x0000019B7DC00000-0x0000019B7DC01000-memory.dmp

Download

memory/756-286-0x0000019B7DD10000-0x0000019B7DD11000-memory.dmp

Download

memory/756-287-0x0000019B7F6B0000-0x0000019B7F6B1000-memory.dmp

Download

memory/756-288-0x0000019B7F6B0000-0x0000019B7F6B1000-memory.dmp

Download

memory/756-240-0x0000019B7D660000-0x0000019B7D670000-memory.dmp

Download

memory/756-223-0x0000019B7D550000-0x0000019B7D560000-memory.dmp

Download

memory/756-258-0x0000019B7D880000-0x0000019B7D881000-memory.dmp

Download

memory/756-274-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-271-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-272-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-273-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-270-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-269-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-268-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-275-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-265-0x0000019B7D9D0000-0x0000019B7D9D1000-memory.dmp

Download

memory/756-266-0x0000019B7D9F0000-0x0000019B7D9F1000-memory.dmp

Download

memory/756-262-0x0000019B7D9C0000-0x0000019B7D9C1000-memory.dmp

Download

memory/756-264-0x0000019B7D9D0000-0x0000019B7D9D1000-memory.dmp

Download

memory/756-260-0x0000019B7D9C0000-0x0000019B7D9C1000-memory.dmp

Download

memory/1704-330-0x0000021057710000-0x0000021057730000-memory.dmp

Download

memory/1704-319-0x0000021057180000-0x00000210571A0000-memory.dmp

Download

memory/1704-297-0x00000210571C0000-0x00000210571E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads