Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 04:24
Behavioral task
behavioral1
Sample
2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
35 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
- Size 13.0MB
- Sample260928-e1p6mswtf1
- SHA256 f479b013f79dddad9dca0e40871af497dd69ca63d699f7b3cf48b185ac2f9233
- MD5 76a9cb71e97f225d88c10d2c3d5b3ab4
- SHA1 643db7fc57496e212409f74f26a88c429f5fb5bb
- SHA512 c5b73f2eed33b87d9f0eb014ddeb27e5a1c54dcd7076f8e86f6a0e9f5edaaac47335f5575151e2a9b028886c3494783968dc18b011160e5feea9175a2e804af5
- SSDEEP 393216:RKXOCEti4jikiEZijTCIKNtUnwYYA1KnZW:7Ft9jLZ2WzcnwYYUL
- TLSH T167D633297BE2098EFA37D73898B3114791997D076B35D8AFD210049E4D33BE2C938769
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00070000000245d7-554.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 62 3964 explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 22 IoCs
pid Process 2860 DiagnosticsHub.StandardCollector.Service.exe 4580 elevation_service.exe 6120 elevation_service.exe 5848 maintenanceservice.exe 1280 msdtc.exe 4152 OSE.EXE 3772 PerceptionSimulationService.exe 2572 perfhost.exe 4476 locator.exe 3684 SensorDataService.exe 2916 snmptrap.exe 508 spectrum.exe 3220 ssh-agent.exe 812 TieringEngineService.exe 2188 AgentService.exe 5184 vds.exe 2116 vssvc.exe 5956 wbengine.exe 5868 WmiApSrv.exe 2320 SearchIndexer.exe 1004 alg.exe 2072 fxssvc.exe - Loads dropped DLL 5 IoCs
pid Process 2488 regsvr32.exe 2488 regsvr32.exe 4268 regsvr32.exe 3964 explorer.exe 4408 StartMenuExperienceHost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process \??\F:\ 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened (read-only) \??\F: explorer.exe \??\F:\ explorer.exe \??\F:\ elevation_service.exe \??\F:\ DiagnosticsHub.StandardCollector.Service.exe File opened (read-only) \??\D: explorer.exe \??\D:\ explorer.exe \??\F:\ alg.exe - Drops file in System32 directory 46 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\alg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a5c748024bb6346b.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe -
resource yara_rule behavioral1/memory/836-8-0x0000000140000000-0x000000014257A000-memory.dmp upx behavioral1/memory/836-78-0x0000000140000000-0x000000014257A000-memory.dmp upx behavioral1/memory/836-643-0x0000000140000000-0x000000014257A000-memory.dmp upx behavioral1/files/0x00070000000245ce-623.dat upx behavioral1/files/0x0001000000016793-614.dat upx behavioral1/files/0x0001000000017042-613.dat upx behavioral1/files/0x0001000000017814-612.dat upx behavioral1/files/0x000100000000c53f-610.dat upx behavioral1/files/0x00010000000233b0-609.dat upx behavioral1/files/0x000100000001742f-608.dat upx behavioral1/files/0x0001000000017057-607.dat upx behavioral1/files/0x0001000000017011-606.dat upx behavioral1/memory/1004-972-0x0000000140000000-0x0000000140167000-memory.dmp upx behavioral1/memory/2072-993-0x0000000140000000-0x00000001401F2000-memory.dmp upx behavioral1/memory/2072-1017-0x0000000140000000-0x00000001401F2000-memory.dmp upx behavioral1/memory/1004-1019-0x0000000140000000-0x0000000140167000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File created C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\dxgi.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1200 sc.exe 4428 sc.exe 2152 sc.exe 2192 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1272 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DiagnosticsHub.StandardCollector.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DiagnosticsHub.StandardCollector.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Kills process with taskkill 1 IoCs
pid Process 4412 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011e8ef64014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041687867014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b2bd765014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fefa067014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e012e667014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000902e3f67014fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027564667014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074268e64014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047ff2c66014fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000442eb865014fdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fefa067014fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Male" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\c1033.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "C0A" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Julie" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB\PromotedIconCache = "{7820NR83-23R3-4229-82P1-R41PO67Q5O9P},{7820NR82-23R3-4229-82P1-R41PO67Q5O9P},{7820NR81-23R3-4229-82P1-R41PO67Q5O9P},{7820NR75-23R3-4229-82P1-R41PO67Q5O9P},{7820NR74-23R3-4229-82P1-R41PO67Q5O9P},{7820NR73-23R3-4229-82P1-R41PO67Q5O9P}" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft David - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "5223743" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_fr-FR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "40C" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{2984A9DB-5689-43AD-877D-14999A15DD46}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech SW Voice Activation - Japanese (Japan)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Julie" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Elsa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; address=NativeSupported; message=NativeSupported; url=NativeSupported; currency=NativeSupported; alphanumeric=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A6EA9C2D-4982-4827-9204-0AC532959F6D}\ = "ExplorerPatcher Weather Host" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1031-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "5218064" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-3082-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\lsr1041.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Traditional Chinese Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Paul - French (France)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "5248260" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR it-IT Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "È stata selezionata la voce predefinita %1." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Cosimo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR ja-JP Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Hortense" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Spanish Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR de-DE Locale Handler" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR de-DE Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR fr-FR Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\c1040.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1040" SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDBF3734-F847-4F1B-B953-A605434DC1E7}\InProcServer32\ = "C:\\Program Files\\ExplorerPatcher\\ep_weather_host_stub.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBF3734-F847-4F1B-B953-A605434DC1E7} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "{BAE3E62C-37D4-49AC-A6F1-0E485ECD6757}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1031" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\sidubm.table" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\tn1036.bin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Cosimo - Italian (Italy)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech SW Voice Activation - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "409;9" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR es-ES Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Laura" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech SW Voice Activation - Spanish (Spain)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Ayumi" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_de-DE.dat" SearchApp.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2860 DiagnosticsHub.StandardCollector.Service.exe 2860 DiagnosticsHub.StandardCollector.Service.exe 2860 DiagnosticsHub.StandardCollector.Service.exe 2860 DiagnosticsHub.StandardCollector.Service.exe 2860 DiagnosticsHub.StandardCollector.Service.exe 2860 DiagnosticsHub.StandardCollector.Service.exe 2860 DiagnosticsHub.StandardCollector.Service.exe 4580 elevation_service.exe 4580 elevation_service.exe 4580 elevation_service.exe 4580 elevation_service.exe 4580 elevation_service.exe 4580 elevation_service.exe 4580 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe Token: SeDebugPrivilege 4412 taskkill.exe Token: SeRestorePrivilege 812 TieringEngineService.exe Token: SeManageVolumePrivilege 812 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2188 AgentService.exe Token: SeBackupPrivilege 2116 vssvc.exe Token: SeRestorePrivilege 2116 vssvc.exe Token: SeAuditPrivilege 2116 vssvc.exe Token: SeBackupPrivilege 5956 wbengine.exe Token: SeRestorePrivilege 5956 wbengine.exe Token: SeSecurityPrivilege 5956 wbengine.exe Token: 33 2320 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2320 SearchIndexer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe Token: SeCreatePagefilePrivilege 3964 explorer.exe Token: SeShutdownPrivilege 3964 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe - Suspicious use of SendNotifyMessage 55 IoCs
pid Process 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe 3964 explorer.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3964 explorer.exe 3964 explorer.exe 4408 StartMenuExperienceHost.exe 3964 explorer.exe 4872 SearchApp.exe 3964 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 836 wrote to memory of 4412 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 94 PID 2320 wrote to memory of 3356 2320 SearchIndexer.exe 118 PID 836 wrote to memory of 1272 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 119 PID 1272 wrote to memory of 1200 1272 cmd.exe 121 PID 1272 wrote to memory of 4428 1272 cmd.exe 122 PID 836 wrote to memory of 2152 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 123 PID 2320 wrote to memory of 4000 2320 SearchIndexer.exe 126 PID 836 wrote to memory of 2192 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 127 PID 836 wrote to memory of 2488 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 129 PID 836 wrote to memory of 4268 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 130 PID 836 wrote to memory of 3964 836 2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe 132 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_76a9cb71e97f225d88c10d2c3d5b3ab4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:1200
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB3⤵
- Launches sc.exe
PID:4428
-
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:2152
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
PID:2192
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2488
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:4268
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Downloads MZ/PE file
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3964
-
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6120
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5848
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1280
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4152
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3772
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2572
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4476
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3684
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2916
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:508
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1980
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:812
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5184
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5956
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5868
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3356
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4000
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4872
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4408
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5972
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2072
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ad4fd1221087b6820f9e3059912d0ffe39c919a7a2b4212d46811972df141b17
- MD5 ca85d115d8dc07d374a5864e2b337cad
- SHA1 6310917043ae15307df055b204b2190cb92947e1
- SHA512 0bb19cf40d30bf25fe570e6e4e823bfbe413a925d7297ca71eef39f12572ce6620aacd6f7379cd32fa2f5a81fb8d4f5b9bfbbe44a9172b286f53c61576504ab3
- SSDEEP 49152:Cb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn8xrYpBZa8DkSyp:k3q6tjB0pBZa8wSyp
- TLSH T1FBD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.2MB
- SHA256 16e72a58d6579c7698bf8f84cf36f9704d1e3d50cd4369eb65d91d879f74b96a
- MD5 936ef60eed4d8c093e27a4ef76b0629a
- SHA1 f53a9ec7156d4bb99692b35d2f346d12837f02b7
- SHA512 b13f63a4445bfd037bfb1e9743ccb33174ce1e90322cd297b6392f23619efff9aded0dec6dad0b549a5a58f3150e2b135337bb9737012d191e9f71f42c9d8936
- SSDEEP 24576:4XYJ0lczALosXhn6NmrVYLlBZ/y8DkSvuQCpvzvM3yReRdqmCAzxj884:ylcGxrYpBZa8DkSypayMRYmJzxj8Z
- TLSH T17BB51229B7D405F9FD67923DC8A28446E732BC5587A0FB8B03A4653A4F336885D3E781
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 cb48349437fcc0f7c3918c7861334cab9c2ee1278a6ed747cd87fd04cdb2bcba
- MD5 fe511a46e84f37c2902119b712d95909
- SHA1 21d7d909f6a8d51379a0857b88de6b558ce53432
- SHA512 5824d0c132bf34223b3c9e24e7785ec99a783de616ee968188c1269703e69b7923dc73060c5fefc02bc64ec419f40ea011dbee7439f3db57081d39037c980c45
- SSDEEP 24576:oXYfDtczALosXhn6NmrVYLlBZ/y8DkSvuQCpv:/tcGxrYpBZa8DkSyp
- TLSH T108750228B79449F9ED67827DCCA29005E7337C558760E78B03A4A9760F336C85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 d18074df06942d643dcc5809fc5f92c666501678beda7cdecde2a16e5aca5399
- MD5 b624d474440565a5d302be91e43b81b8
- SHA1 eff33fbcbe9e43df3af4d0b72e0dc41d817dc192
- SHA512 0111894627e6a515c195f2309a405002c7a6c9a5070e48897d44d2ed3e41a6ad0f8e284e321ad79269f8bc2889e85f9c269449306a6b349ddcb324929250d255
- SSDEEP 24576:QwewsAjtosXhn6NmrVYLlBZ/y8DkSvuQCpv:pljnxrYpBZa8DkSyp
- TLSH T1A475E031FE74E036D77F0DB61B26D716142CBE204B621AC3E3A85E9E49705C22776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 f22d98d0d8071c1cacad76f10b29fd6c66f7ade185d5c1d7a84a220995d1e4e7
- MD5 2e9fee696ff5b539e82489fdbfe02120
- SHA1 ebd3c95d821cc94eb2321d9ca61539fa3ac977c6
- SHA512 5f911d7e06f69293974528cf11fa9c2edb635b783ccd26563572ec3bd52696e8befe69e6054d64f85f9aecb44fbe5dd1fd713bdfd1be9ebfe37321ef0858ee2b
- SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHiZMf:uUEtQevvqc2W1cpV29I32iZ
- TLSH T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 52b3e6b9fded2a3e8e729749327acee306a3b7d72cb2cf7964b350f93ad94833
- MD5 41d9caed5423dcd6ce3b68b2318807a8
- SHA1 3853de8014268d6302c2b8f72e7c030b3c2e801a
- SHA512 b4af76d4d42eb48a1234c479452cce4bf4ea9aa643ad1e6e23e5221d5d7c6efbf3abc64c48fb07b23073077fc927bab97db0b86447a805ca9290b864c3641bf0
- SSDEEP 24576:XAhGLmIFoiwtA5l7S53YosXhn6NmrVYLlBZ/y8DkSvuQCpv:XAM1Foiq5SxrYpBZa8DkSyp
- TLSH T1FC359D81EBF955D4F5B3AAB899B69170EA76BCA55E31C20F2160911F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 2ca0e8f01b6a158ae16d19ad99502777f2c60d56b59744795d33b616c2d87cd5
- MD5 eb794d3d2a224d0f13d83c3385991244
- SHA1 8c3dbe73de7c71510c5bb6cba1ea489dace58a17
- SHA512 9c379b99165188c18049654b947730957423225213d69f5ae01d3f8027799d1d4f8e32b79e330936c1365413f52d6a95435e76509f38381e1a24f79b2a0aeb53
- SSDEEP 24576:owuXOWxosXhn6NmrVYLlBZ/y8DkSvuQCpv:owQOuxrYpBZa8DkSyp
- TLSH T19065F14A77A80CF9E9678239C557D036F7B2BC012A21DB1F5760CA6B5F33251AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 9ed8ffa33eefedb91ed4f6cdd91d8bb0334f6d07f8bea488464a7969446d6ad5
- MD5 54be89cc7775496319e86c073a2e62b0
- SHA1 51afcc49dc157e6a862b63caefeffba715e91340
- SHA512 5149884748f9cac1248fad6bf9629b56a830a14b31255a902c1f92cdad1056b532c86fda930a206be35f0ef729faec7e8b539ffcffacfa0bb789445462f7d602
- SSDEEP 12288:WbZ1IyO4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:WZu2osXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T13E55125A379861FAF667937EC8A56048D3317C12A73283CF552026AA0F73DC96D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
- Size 155KB
- SHA256 bb5fda5f2d3aae5e0977ab28d8a8a00acfd63d73748aaac32daf4fc6645b6677
- MD5 6d025364f66d8c2dcd882eaa3df83835
- SHA1 92ea55b6f46676c3b4a684fee5d7c1ed4e2e8772
- SHA512 d62f52c0aa0e54c6505e9a74e92424f378e40405ac4a383d9b6cf2cbee02b24187c72fb7436841a1ca249970e5ae60a703d1b85ad40a17aa66cd9a231ba04e17
- SSDEEP 3072:17+r33Gx3Xe/uy0A4BBnkDC49KMNU9eAT8uEtJjvv8WD73pe:1wnGV4p4BnkDCEKXEtJwmM
- TLSH T125F35C57B3E90077E17BC278C9634A45E772B8115B609AEF03A4467A1F237D0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_dwm_svc.exe
- Size 1.3MB
- SHA256 3710aca895b93c61f880f6e91bf0c35dc083701042f8c07f895880f2f62930f3
- MD5 33d63851bdea12ec48f645fdbf1011af
- SHA1 7b2607708ca817cbb1a6f1882504f8275bab30bb
- SHA512 abbd56e90da443e131192fce9453bf6e7eb5901af90b8c41974046a4178910314f0db1f54f7307ff666fe8e5fbf90cedb78cbedd6f088aff845beb090a7c3594
- SSDEEP 12288:w2qzh4dl3gD4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:w2uqosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1B055122BB3D921E9F576977AC4661008A725BD305B329BEF4360256A4F336C89C39F31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_setup.exe
- Size 13.0MB
- SHA256 f479b013f79dddad9dca0e40871af497dd69ca63d699f7b3cf48b185ac2f9233
- MD5 76a9cb71e97f225d88c10d2c3d5b3ab4
- SHA1 643db7fc57496e212409f74f26a88c429f5fb5bb
- SHA512 c5b73f2eed33b87d9f0eb014ddeb27e5a1c54dcd7076f8e86f6a0e9f5edaaac47335f5575151e2a9b028886c3494783968dc18b011160e5feea9175a2e804af5
- SSDEEP 393216:RKXOCEti4jikiEZijTCIKNtUnwYYA1KnZW:7Ft9jLZ2WzcnwYYUL
- TLSH T167D633297BE2098EFA37D73898B3114791997D076B35D8AFD210049E4D33BE2C938769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
- Size 242KB
- SHA256 137ecc2eddf713556d2cee3ed74723f7aefc2e893cc0210c37587cd787af53a7
- MD5 561e88d9128ed8fc272f25c6c91fb69a
- SHA1 a1679ed8b099a7f3842740d546d45104ec115495
- SHA512 b4626303fb02ec2d86d2bc31b00e155f9f9ef73a7070b79a7a3a41881f25b9ff2d4786acb565b4aab7301a1b6935d4d9420150c6d5ecb6d2993eb6b1e351247a
- SSDEEP 3072:YqeAqGfYQej0qwPP1+YCflwUnMlKiD/FpargdG3km+Cm7S9kEXB9aosoQ75+7Rw:YiYhEgpFub3oKD5OR
- TLSH T1E634184477E50569FAB76B389AB35546D633BC526B30CBDF02A4420D9F27BC09839B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
- Size 107KB
- SHA256 f656731409df123bc9edf67b5667bae6d88275a086f463835a11fff436287826
- MD5 b3e78e973df9f3383e27726656896f18
- SHA1 415e7b02511072d82765e8c01bc9d602dfc8654a
- SHA512 21e220f5b564faf2faf6338f6a17b0a88e057782e90cb5b9dd78afd9067f9b3c28f567f817c69483685635215ee10d970d781079395da9f3e04690939d237fe0
- SSDEEP 3072:nM8lNaxkYbVKe9124fx6LvLVbZaZaZ8XWTwcsegYQIX:PaxfbMcTfx6rowgeX
- TLSH T1E8B3494BA3E900BBE172967884930A45D772BC0117629FEF03A4521E5F337D59E3AFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 9d80f761e5add08353ded208b3d8110d06654f68b8b960cc98f69907c857d73e
- MD5 5c76c5a138ef2d83e16b78852fa268f3
- SHA1 4c2e79057e7aaab583dd4f50a147577f6cf14ae4
- SHA512 be6a05c2fe266a00bdecc2f459b2cf815b272d6a2eaa3899a5da0c6f9625debb70381ae7ec20d39ee126772294183bfb85f1b4bfbece07cb5d82f56546cd997b
- SSDEEP 98304:tQRQyi36YOcPuLvw2gAf+PN3opBZa8wSyp:EQyiKakX+PNsZMf
- TLSH T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c40e0d960cc0eccc8e47b5dd36d5e63bed58508b717cc3f3538425410e39b20e
- MD5 2e6a5a436a03155d24a89a337bc416da
- SHA1 246fd530b2113d7a2f099f69c17c68567f13103b
- SHA512 d219a3c003a33694aff6306cf2079932a6886eff77b4ed1d4e381f66a883141a14badaf236159b403229e2dc5c5baeccd357300f3240c26d26f36a9614e53803
- SSDEEP 98304:3QRQyi36YOcPuLvw2gAf+PN3opBZa8wSyp:mQyiKakX+PNsZMf
- TLSH T155667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 ebf3922ffbda7c2c5c98c7a3ff2ee61e5ef4c0dd3ae34c91573db93dc69873df
- MD5 dc78b18942db10e8b5b2cd63c6aa729c
- SHA1 b797becd76dad2764a46baaf529caf9e37e37ea7
- SHA512 76e7a5e74da15abc7bf3dd47fd90ae756916bc642d921d9e11bb0c9bbc98c95dccf15e19fbc0da7629ce7971808ac3ab9bcd5d4ce9b2cf50b94b244725323e8d
- SSDEEP 49152:d68Qg55nhxeWu7PNU3/3xrYpBZa8DkSyp:bthGRc/ypBZa8wSyp
- TLSH T15FB55933B2F600A9C44DE1769F4A972196D17C71CFE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 5e5014aa5ab2ff0edb1fd8ab7c45687d9319ff5bf643e6f4718e93d82dbbc14f
- MD5 67d057baa9f388afd575548a4e20c775
- SHA1 8fe1d249fdeede8382328a7a989ae89f6ef3744d
- SHA512 8dfc7f61848e2269d33d3e79a472fdcab2049f1b8ab83c04a515853fa06fdc479a9c9d20f2c55cbc0f5e07c53e28a313d941e2935dae8e7cbc53951724175dc9
- SSDEEP 98304:wy5112gYy5azzVvD69nLKnhZBpBZa8wSyp:JLIH+WhvZMf
- TLSH T1E7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 50ce2697899e3eb01c94137f364ee9a14a727975fbb6f623712a764fea635e09
- MD5 02a3fd0dda812d1bfdcd30d68345cf38
- SHA1 e2a17336bb51d7307ebc866258f4c8c6e5129487
- SHA512 6f8210dfc7b2a0827c9ded7f796f7ea724ff7e878ac4f86d3a81a3757705151e702b791c217bb35d0d02103a8f59fb359974a24a40ea470e9c1fdc0d88126623
- SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glpxrYpBZa8DkSyp:cu6JmQxd2dwpBZa8wSyp
- TLSH T1BAD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7289624da48e63b17f22cea5c0ec538270cea9f76d83a5e003bfe5269d0d2c98
- MD5 ca7b09231315071b5dc88bcbb4200001
- SHA1 85972c731497fa31a2dc1e2f5a1e5af9d0d0f018
- SHA512 6d6cc265f0c26e7418918e03173ee9d85610388289cec60aaaf993047149f3aec18d8811242090020b831e63c40081d07cc4638c839405c8dbace9a8205c3afa
- SSDEEP 49152:11hpsNoJpF1A6yU44CwH7R4xlxrYpBZa8DkSyp:1mifPVRfpBZa8wSyp
- TLSH T199B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 96101dc38032ebd96e875154790f62b23251f476f089cbb3d52691564dcdb6e3
- MD5 6e9845fb37f8afff548d9ec13c165024
- SHA1 04145b805d3d33a08609665dc71a485f876ac87e
- SHA512 dd59fc040bf98585b08809b4861b1899353df98a93c7a44aea6c18107f06f942a860a3c103ff233e6e6fed196a4f3d7f3282b6ce6cde3ced10c15093850bbc79
- SSDEEP 49152:PSuZQIY0Be2KIRVtOnks6NMHqsxrYpBZa8DkSyp:15dKOi61lpBZa8wSyp
- TLSH T153C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 734d7efcf2cf49bca788d8a56ef9082420adb77a0568abbb0e71bb59a4a77959
- MD5 1f3bc86c4a9067c4867b89a8b19bb2a0
- SHA1 d2181e1bd17aae38e73307d46eca3e8f8f58ac74
- SHA512 76903b53777caaa7382b71783145f40d853983bc83d47d6a246421a2310b5852064ed3cda7a3ab90673ad9e1dc63705e299637e30f8c8199409b69874043f72a
- SSDEEP 49152:2htSn8EApI0figGgiDn0AP5wZxrYpBZa8DkSyp:XX2i/phrpBZa8wSyp
- TLSH T16F95BE13F2D900E8D05ED179C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 bbb86c5a32d475ab7e3e8d1556223cf2b2d47042cd8c4a55ad9fbab653351d3d
- MD5 e74f261e8346c7ba2f54a84fbc4559ed
- SHA1 3b0827f37826184cb6460f875fe5ecb0cf2b64e6
- SHA512 6c2084a910c2c6902d9f241d67eeb9bb26f21587a462363b5c620dc333e590cff9b53255f073d21a4db3a24544d6ada47f9eb06a50e2e81136f3cb0a45febc37
- SSDEEP 12288:g74TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:gyosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T19B55231ABA1DC2EAFA29E7B7C41A70CC53087F05FB27951BE524396B43B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 4f463a4a052d268fae96a040435ff4ac0f86c98003488b91a6e3cf7c27647639
- MD5 19c687ae1c420b9d9d0f60a2d8890e25
- SHA1 026a3cc13813f0e9dbd89d78c53352a56da15730
- SHA512 a394b2904de49ad0fc43be7cedeeffb933ee79f2d870634c19f67d612fa39adb4c23b244187ae731ab754a1f01babc9ae2d9f2c83eae3ab9f1a32a915fca4045
- SSDEEP 12288:9i4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:95osXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T14655232ABA1DC2DAFA29E7B7C40A70CC53087F05FB27951BE524396B43B2CCD68155E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 57a17c24f540c798d3b935b3fcf1a637f7c28f5ef5404e10dc358ba131103afc
- MD5 db06dddacaf83523a44eabb17405dbad
- SHA1 3f62dc5e1882974b85e3f937ef0391e5783c4fa8
- SHA512 c482d5fb6e0a650894d74eb75b948c9cbdc4bc79f38553e60daa569ed97befe11ebce02707caab035b00ae7d039042bb19ba0997d1a570919d349ea235d8f849
- SSDEEP 12288:IU4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:IXosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T12255231ABA1DC2DAFA29E7B7C41A70CC53087F05FB27951BE524396B83B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 1eefd875b4de87318615b36a706002e9d35ba65efe4db586bcb990a37ff45e26
- MD5 10643441bb1ca4b3a4d56b937fc27e48
- SHA1 a055c1332358f4cd1632745d25a83c4ffc97ebdf
- SHA512 eaaa93f0e05f77a9e5ec321a7fe06a419376cf3378ad3c80c53a69bbf48e1d35d2d77a8c99ddf74311ac58bd9e3738eda7b4f194efb739f05b8c49e84b58fbb5
- SSDEEP 12288:UVt4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:josXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1D95523197B1D82D6F935D7B7C4167088E3287E15EB33965FD6103D6B0BB2DCCA824AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 4f066e4392e02c31a557a12857492f6ae6c5c3e276833cdd500d7b3ecbbcd40c
- MD5 00b6463df1f1d6d4e3ec7b2835f83229
- SHA1 eac92c36e1b0959c771964a38330bf36813b6440
- SHA512 75ac09c7cbdaa0a1664805b138f49948b989270a0d10465aa38fde509563d56aad3af5f6d4ffb7c72635bef7759491c75157a2bc5657a02f1a0febaa89b5715b
- SSDEEP 12288:Kl4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:KAosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T13255231ABA1DC2DAFA29E7B7C40A70CC53087F05FB27951BE524396B83B2CCD68155E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 7430ab8b730c215784e795516a62d7c30716a1584427820928271d2ecc14f1d4
- MD5 b6566a1393bc379c02a289e97761036b
- SHA1 917e069c57d5ee872e86a4352f4f06f953847d8c
- SHA512 ee06a8f778634dd5d62805c3e03aca61c3e4829af972c5051e0e0f750b067b36016ef96a98141d5dd1c9ba2a2aaa3f0e0cfa22b21e7a096a19d69cb0f3e0a346
- SSDEEP 12288:xm4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:xlosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T105552319BA1DC2EAFA29E7B7C41A70CC53087F15FB23951BE524396B83B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 ffd104b1419705b278b385e720cca79b6219a09a2ee226ccbf9b086a02a05d16
- MD5 63bd29e316854cfffc5ed2e4ff10f8a6
- SHA1 30aee19d4db543ce5dbdb5ed7ea1238c05bb0b0a
- SHA512 e30fd1a9c89e5c634c23942caade7a31c6909edbc531bf5361575909ac5c87275de7b8e6d598ea3f076bad346df1cc199d1210f7616f8f0ca693c686ed22b107
- SSDEEP 12288:164TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:1BosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T17455232ABA1DC2DAFA29D7B7C40A70CC53087F15FB27951BE524396B83B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 974727ef8eae2c27dbe472927229542fdda8dbca6e9cf380a4c39cad3aeb32f0
- MD5 d3f45d0b50922658651f6391677743ca
- SHA1 a476e7415a2a05ab5332496833f1519978d2500e
- SHA512 cd67226d5b12a4256c551147fd0d6c0b94aba3c9375f7ff2ef5d12ffd98d8e69ff6389271ceb039470c1e914ea2d360f25882ab65c967f2c450c11903446332a
- SSDEEP 24576:yZMJzFVSOZosXhn6NmrVYLlBZ/y8DkSvuQCpv:yZMJzfPxrYpBZa8DkSyp
- TLSH T1577501A9B35458F8EC67823EC8159846D2B27C1A4B70C61F13B4366B4F737911C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 9935efe2ee7c76b95cc79a19ac8f2771a6d29e4b9b4c847d282e43bf98da082d
- MD5 08941bad6b4485fb93a53a92533d4d0e
- SHA1 237c8490b147eb7d2961297e4288fc942135110d
- SHA512 1b15023cccea978ad18b7c0fd3edf8d5b1c7f30c1a053846f8e919e12498e72149fef549d615226ceebafd7de56295d9b67927f495521a0e3690deadc28607d0
- SSDEEP 12288:EX4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:EmosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T14A55231EBA1DC2DAFA29D7B7C40A70C853087F05FB27951BE524396B83B2CCD68194E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 1e8960b8029a67bb55e4a4acdc53e8306a4374893b77e74b671c761bb25ae99e
- MD5 de04a3f5cc7b63bae939797b2d1acd14
- SHA1 c1bfcef47ac8e69a0e030739cfaba11a8eb6d3c7
- SHA512 31227c2fc2ce19946eb4bbdb7fa57539147bc69f00f93c238c4abfe216483aff6ac4438085dfd0fa63d767acd7c3bfbc01dedc975c93413c9bb853f27b970589
- SSDEEP 12288:QD4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:QqosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T13955231ABA1DC2EAFA29E7B7C40A70CC53087F15FB27951BE524396B43B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 fcb6fbac2a3b169b48c84aff3a979dc01723754c2598d1b66e12357fd7306db2
- MD5 19675c3d8fddc12140d6d9ce636dbcf5
- SHA1 14990c704007c28c954b2f6f1e83e180b7cf2eb3
- SHA512 f50a3805ce71d3762870d3525511ea6b395cce9e7d5fd5ce6db382948bd33d4e5d37bf07bd02f437d4daa39cca5428a65d016f07e6bd5764a38a52b5e0aaaf3e
- SSDEEP 12288:ryPz5L8O4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:GzydosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1E765120B776521F9E5369339C8522545F3357C329B218AAF53602A7B1F33AC4AD3AB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 6bb2e47e29e6687b85a76fc83ba569e2a959fc27c89065a3783875b201e2dfc3
- MD5 7e531b5ba3167c9dc03f29dc76abe94d
- SHA1 07d7f07c5c4c40e474df52847d384e761389cf0d
- SHA512 2b69cc4a418f3aceaaada31289e53b9cd2e444a41eb7677a48972a201ebc013e76f28365e333b02d8d438c6c08ddedbf9f3a2adad89c6c4fc529218f7625a146
- SSDEEP 12288:qX4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:qmosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1D955231EBA1DC2DAFA29D7B7C40A70C853087F15FB27951BE524396B83B2CCD68154E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 2.2MB
- SHA256 63cfcc9fe9367b0b4fd46096bf29b75ad55bd6a7a9965bdd0e4fff14f7eeda0d
- MD5 a374f8a60408ba62c3c89759ee1936a3
- SHA1 00613e4daff7c2d174958827ac39c6e030b9cc8f
- SHA512 0f9501a3e9f7154c1e40218c5dfc31c258bac33c148b3ba9cf299adf3b3b783788f4faa55624f90c33103ca9d03dbf1ac21012d0b08d43dc390602d509531210
- SSDEEP 49152:QP4m4IpOO67/8KmxrYpBZa8DkSyptyMRYmJzxj8Z:oppOOiBpBZa8wSypUYbJzl8
- TLSH T12CB5E02DABDC0096D0BA913485658A4AFAB1742E1F3286CF1160A33D7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 0b6423e54a0e2feb1b539b6bbd2d94cfe43417ea2a0a99bbed6df49b6eb782f5
- MD5 1a5f39eebc30907505fc6a288b2cf1b8
- SHA1 1b49f03b822704d3f1e282d1240b026d5e361d27
- SHA512 8dd5ef6c116a4118b5e8a9e069f845b753d04dc2d2bed1bcce7f58c4027a6c3a061a86f69a2dbfd331d2cea98b17f206873951c51dd8f3ffda2ea2e2098404b0
- SSDEEP 12288:2ksfH4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:M2osXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T129650119E25842E8D06EA27AC7065140B3373D2597E2D3CB92D0F93E0F769C4ADE9B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134350431262361938.txt
- Size 85KB
- SHA256 a9e358268b99acbf4109f5624a3f1ee4fd204f6ec0683fb5ad0d782724c2210d
- MD5 2a007f465f4755156dbbadefc60202ee
- SHA1 16342abdf49aa22b9563c69d59c84638136454bb
- SHA512 3de7ce1f3a3c8b5f57066d138b275432447cee62b982e6480f8691627b492a6b3c297f389e81ec9589bc23a0817fe742a3cef6c48356d3def96f676a50e8a311
- SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/ef/l7/MA/NV/CzS/1o/Yd/ew:vYYzoz/Mo9RzV1D
- TLSH T19383B3A53281CBF3313966A0BCD9E435E13926B1E0A88F4561FA9617FC5ADDC62313D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
- Size 35.4MB
- SHA256 37daf447f92f6d910d69fd8b9d549aa3d098dc38b374a63e83b15ca16f26504c
- MD5 7fa5409f40c7999b2d6df5d36631f841
- SHA1 3c24c505de1b9900ef4ba8b13d03d0c3486a58eb
- SHA512 46841811612018c0e39f7cac76094d7f48fd591cd1a0e93fe592ae85e678f7b75b1aa5a132f3fc6a49bce2f6c4ac8f9026d02dcce58ff4bacb4fca9d3ab85ac0
- SSDEEP 196608:rIwbOkEWq14knDNG7vL4hZR/dzkHPRSL1N8b8vfWI9cb1JAssvNHxPdgMKwKU69x:Mu3fZ+s
- TLSH T1E387D7187167A2B7E1BB0B7B4DC64349137111A357E39DAB5A2032342CB73419B8F6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
- Size 17.9MB
- SHA256 589c2ff9e4ac0465a8b682d6fb988c81b4e91af9f760d174811315681d94b954
- MD5 bc8958ca4f0f0760befa3523238c7d67
- SHA1 5f75add01201e78860be47a0eb65582733e823c3
- SHA512 3da6524215e011655c441bd6c085531ce54b81162a6bcb7412977b1f9e488ff600d1a0c6f54252c6c21b76bc8af3b6261632df8f1eccd96e385a0d552a615699
- SSDEEP 49152:vsUJFVyau2XnnO9vlVstsVKMXu16IwOIX8DvEdwHZgqg+gP26V1q+Xz2kB8AzoT9:/JiKEjir75KEMfzC6pKt
- TLSH T17917E963636F50E1D1BF933B4197878AA7BA41A397C3866F253572225CCB38A4B4335C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 f8b699bffca7c725ffb74225c4ae3a47a58b9dc6a67f8b1161868e51c3a1eea0
- MD5 78e7bd4f76252ce5d13222667e0919d2
- SHA1 20c7342ed2cabd0a1ae7f349d4d0785a681659c3
- SHA512 b0001603e27be9f65f2579a28fecf8fe3ad2dd0d33221ebbd24a67195b370bdd39ac90057ceb07cd0102c5e01bfca0eafc986e50ba8dce22ef95b7f57849f359
- SSDEEP 12288:mn4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:mWosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1A355231AFB1CC69BF979E7B6C41AB098230C7F14EF22950BF510396B42B1CCDAC25566
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 8fe049b9dd872f767044833ed874a544e097489bb93be42746bc090c10ea9eed
- MD5 948c453ad9a566c101fb088dbb08292b
- SHA1 e6818050f5482e4c5b8846c694d0013edc654121
- SHA512 cb5e662d606e29f61596efac2f5f4dd97a77821450215bf815917c50f9e73a777a140f47c0dfaab67645c73edd8e8290e63b218d54540e4c22e79f7f1d659421
- SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQqxrYpBZa8DkSyp:Fa0hNYG4JwapBZa8wSyp
- TLSH T1D685AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 79a7857f5dd6d91d07771805a847f394c3070272b00c531c9bb26e4af560b066
- MD5 2844bce612d145cb9626f0bf2160ec5e
- SHA1 d39312dad9d5421c50a3a7fa7aba5ed89d118489
- SHA512 6b2875ea811db61e51e409fc45c43a7d17fa12a5740b8d33497dffdddc97a491fbc35da63434f2ced4026074981c22f14776757412796d6f2e61bb2a8bebddb8
- SSDEEP 24576:PhbHjPJosXhn6NmrVYLlBZ/y8DkSvuQCpv:PhbHjzxrYpBZa8DkSyp
- TLSH T16655117E26AC11D9F531E2BEC446904AD330BD252B2293EF6290627E4F37DC85C39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 3f4728ca891ac984c72a32efbdc14274887b82b26f925c3b4988a13fc78a2c9c
- MD5 fbc5873a2f7e57eac58151e4e16d00a6
- SHA1 0f46eeae0a64e33cb86ca1351e5d504ac3a51684
- SHA512 6bd61f13d244b7f96c2e71f0db7584bc69e4456de48f7a41b185d3089dcdf37d535b365fb6fb08cc74e06c3d7d2619123ddd010da05615c46af3c6180b76371f
- SSDEEP 12288:CT4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:CaosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T16755235DBA0DC6DAF939E7B7C41A708C63087F10EB23559BE424396B43B2CCDA8355A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 14c4f442a811243e4efd2ad904a2ace082dfefb9d28e593d94b20e89e1a90961
- MD5 688afc36e1ce3b55c8d5cbe63e09a24b
- SHA1 37451222ef656827af8e4090ddb0d6d90fe75798
- SHA512 8d5e8c80e6b164438290603e3d5dcd6e309795eec647cbb83e3c83f9a28e4ed7f15a01706e39fdb9a6324471f5a5a272eb04427f0f092f6df3e48daf909fa071
- SSDEEP 24576:VtL3UTLosXhn6NmrVYLlBZ/y8DkSvuQCpv:VtL3UFxrYpBZa8DkSyp
- TLSH T12A750119F79800F9E97BD23DC8669516E332B85D0724E7DF03684A660F636E54E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 956937dee4ee76f6d1539c2f18062b0d29843303a1aa3d86df3b088a3e243295
- MD5 257fac8e25a38ebfa764322575115902
- SHA1 da8231df35767d40ad8a9091ac5378df6098f3e6
- SHA512 051e8d98cb61302f15506f4dae65adda48a6f852b2bec163ce8c2b9496fdc8b9d45602f39bcbdf53b5e1c7c951849b686abcc87af7068d08f309d614e0e87c50
- SSDEEP 12288:cpFtUOs4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:3O/osXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1C755122E379C10E9E539A27DC946924CD331BC21572257DF429051BE4FB3EEC6C3AAA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 728bf64a150a65fa6fc2bf95707c3f290e040089b81e19696bbe72f0b8baba78
- MD5 c4dd86514408fdcd5825602973a93059
- SHA1 e34317cbc05af5a876b0e8a8a10c200c676bb70f
- SHA512 6d1ef79c92ed745882c8b3b82cf04fb274c3c42545e0bae881e22333c415cb98dd2b377b4ffa8099a51d61521dd9b7b50fd6d8eca0a6100fa0d8200e30566a98
- SSDEEP 24576:57NM9YmZqmWMUkPjZM48Mv6bEhsmosXhn6NmrVYLlBZ/y8DkSvuQCpv:57cBWMpPjN8DbEh7xrYpBZa8DkSyp
- TLSH T11365AE2E6BEC81E5D477D13DC9A28205F2B1B8611B318ACF5162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 c57a82731fe02228f50f5aeca0cccafea8999166182302477274dde04aeba9a5
- MD5 f1d22957e16028768e05cfec4a6bd842
- SHA1 b5216920ebb95f89fe4c1e3fccf3976476134538
- SHA512 4130085f4fddac1b048ebe07bf57e3319818a051bb83646c50b6a57350611d63242854c547cd7b0de52122b5d2787c928cb749e1d5e1fa170cdeb0738a312892
- SSDEEP 49152:gF2YuHNETovcvNYf8km8xrYpBZa8DkSyp:16tCf8kspBZa8wSyp
- TLSH T178857E2927ED80A4E0BBD27D85B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 e08cf38044f252894065c87d9db1add57b5e70e35d76f15e6298036526d0bc2b
- MD5 149e6ded9eaaee80e6ce93a88acdfa40
- SHA1 9884717c9526b35497bcb8c0fccce78314f897db
- SHA512 2b10baa49cd68d92ed1f881f4452b7e355fcc3254a2b79c6e60c4d9b68ac5bde82ce5fe55c201a69a19b20fff11a6108cf4b7dfb8691dc291ba159798af1f5b5
- SSDEEP 24576:3AFs06+Omlf8NXEbTojosXhn6NmrVYLlBZ/y8DkSvuQCpv:QFs060lYXuKxrYpBZa8DkSyp
- TLSH T1A065BF2F66AC00D5E07ED17E8997C91AF3B1746307255ACB0160867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 65fabffe6c4e6b54dc1718cbabdac29951f0c018bfd3f2148726984cf172742c
- MD5 2ad0f2b90ab6f95a551b1925da5a8514
- SHA1 c8a1010f73735ef515dbc25d572ce5e22c3eba38
- SHA512 7f708dd06f7a0b7841aa3f55ab42ab210480d352864b352e7111282526a4ea891fc4961fbfd627a6407442177f508e89ecb0f7b57cd6c8a11ce5986f15d92016
- SSDEEP 24576:oJnJ5D3WtgosXhn6NmrVYLlBZ/y8DkSvuQCpv:oJnJ5DGtKxrYpBZa8DkSyp
- TLSH T17E75D02DD2A810E8E4B7C3B4815A2695FF71383D2F2269CB6874D5353F22ED0A979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 7070548ce3ba249508acf84cb3b9af7624c56e698e9bc63d1924b5033e162eb4
- MD5 d61edd9a63f15dd85efb1fb2729635d9
- SHA1 c8139d27baccd2e1f2f691279689abfdc82d4198
- SHA512 1c29dbdab9de8f6719afe538bf90c61574e1415122a948b49fd4bd4de7acd4ecce24e7169ce840e6693026cddf01768fcb40a1a18694d7f0eff22ac88fd6516c
- SSDEEP 49152:Lo06DIKdwc+eQnSt65aVAxrYpBZa8DkSyp:EbpBZa8wSyp
- TLSH T1B5955C16B7EA5294E8B3CAF1C962A1159B327C509B34F7DF0AC0C92E1E33AD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 aba1d51515cf9839810ae5fb0db67bd532f1e289194941697bb143204b4bde5a
- MD5 9c4b7abfa864128da99f855e416229a2
- SHA1 14a20028ac9d5eff0fadd3333f73178a886de2b9
- SHA512 1d26bf5349b5126f65b419cf82d8bcecee5e9174d1459de1708e823ccd8254f9b9ddbd20130ce620f87cbe3c07fe96a9106dd2710095736b6bf80bb48b2ebed5
- SSDEEP 12288:MEP3Ri2yLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:Hi7vM3yReRdqmCAzxj884
- TLSH T16F05237EA7AC70A9E175A03D92918687D372F0392B92BBDF5290C13E4E337E51D39601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 bb444c34f9649233111628dca2a088f8c2082e8826d1b85acfd05c17e463b55d
- MD5 cd8773a10c3fd0ab34d19d49cd0c1824
- SHA1 d080b10b2a295c3fbe202d510e51bab1b3aed46f
- SHA512 0fd25611db0b0b4ad0c846511383e362714a5ba25bf4d1e7776241d5149f9e2ba1cbacf1817c65d9a3bd1c67063446e775a70028ec8d80aa67a171a1fb3c86a4
- SSDEEP 12288:fjkyi4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:fIy5osXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T1D6651208735C91D9FA799779C82750949734BD20AF2292DFA050BA3F5F72EC8AC34B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 3e51d44c1f6d4f96237678a6461b3d76548b6b2b9576cfba9bb3427da73fc876
- MD5 dded734a822c6a94464c5549118091d5
- SHA1 3bf0300368aea7e40a40c917ff21ef4d5119c77f
- SHA512 05da7b0be126e85927570695be64ea3cb4003b3a6a778bde8a0bb10821d8d96e312da55ee18eea2cceddf62d5b79b3e496cc167b0935c6a897082e23948557c8
- SSDEEP 12288:cF84TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:qvosXhn6NmrVYLlBZ/y8DkSvuQCpv
- TLSH T10355231D771DD2DAFE29D7BBC41A708853183F24EB2255AFA460397B83B2CCD6435990
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 22a449eeaf59dd512da7eb95a1e593fec90ff1549d34308377d1f20a3adcaad6
- MD5 dac59c283203c92e8eda8dec9b45ce80
- SHA1 e2b42ab382dc951ffd8319d4eb4e9bef644410b6
- SHA512 7891ffe6c04dcd9cfc5b1bd6c5985ca9d9c7f763eddd2564fc9185bce9653aee5eb0ad0dc6682881fc85a5574681804902ef71355cc4545cdd6c70bb2548bf73
- SSDEEP 24576:dQ9MxZKdcz97w3+osXhn6NmrVYLlBZ/y8DkSvuQCpv:dVKXUxrYpBZa8DkSyp
- TLSH T1CA557C2DABE9059AE177D279D4A250C3A633B4311B31D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 67a88bfde9848258404a152948ffa2b056be2c558ade70f106e3c34af2cd5e1d
- MD5 5e14a13ad8fe637bcdb47aa39334d05c
- SHA1 a7649319fc40c4bbd3df92cdb66476fb0529b300
- SHA512 033714b17fe0fa81e241d6e67945c571a2ab534c58395f9b4696c703f3c65d440aafd3c822ad8afdcdf1efdf071dc8c2535e7f2af31265eeff16248fed63df95
- SSDEEP 24576:PyocxAptosXhn6NmrVYLlBZ/y8DkSvuQCpv:KocxApnxrYpBZa8DkSyp
- TLSH T17065EF1FBB6D40A2E176823C88858245E773B4305B6253CBA591873E8F739EDBD38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 d30e370b89f610662863a8f26a5e95711469901fcf625ceda5fbbf5c544aff00
- MD5 f057edf671fcf4f626d32b99159afa25
- SHA1 216368ad3f464386b3cc8f6ccaf29f9741711f7b
- SHA512 16bc35e1c43272a31279f350e74d24ac85101daea2b81e21d6e710671bca809268970afe1c82b01d6b34fae2cb7d0a01e6e2cfcc6c9eefe918d1871379a84af3
- SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKnxrYpBZa8DkSyp:i0zuNI+pBZa8wSyp
- TLSH T1ECA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\dxgi.dll
- Size 590KB
- SHA256 70a7d2ce085dc0db96d00abf351e5e316572801f5d43648e2ad47fd66ba174cc
- MD5 ced49a7f0a466a1652bd01172df2b5a8
- SHA1 4eb49d34e593de5d05c44df3f762359752011fb7
- SHA512 6ccffcd77bebc01e5ae15d00a94a5d489c231e7f6232c971127b01f1d5871d769e11ddd951ad04b9d21a7fa9bc418e4ae29363b00d8b77d8a6f6cbeaa18073ab
- SSDEEP 12288:GyP1gTP0RRejAShO/ddkHa2CFEgxtUSgRQHmB:H9uPmRdv/ddkHa2CFRqiH
- TLSH T12DD47D12A7F900B9F5BBC674CA634522EA727C461720DADF0390895D5F337A1973EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.5MB
- SHA256 0640eada2e0e4f3f9aa9e35697620190a39ca6e26307d90ce63dd664517b8f4d
- MD5 9b2a1e135a674758e2307a303507002f
- SHA1 af465a15d93bd8c355ae9eb6cc952bc029843fdc
- SHA512 11a2252b4897b949ceb1e3f029145e7c9c7aaaab88bdda56cd7412f0ea082a4d3f4b1d8d30befb883fda6f564c199175ae2d4f011ebc246d89fd8b460a9965d9
- SSDEEP 49152:pa0h2GEkuAe73q3ppj6zwwQqxrYpBZa8DkSypcyMRYmJzxj8Z:pa0hNYGjJwapBZa8wSyp9YbJzl8
- TLSH T1BEC5C01E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.5MB
- SHA256 ece39d457b66145914d5897539e758cabb81c56d20169d26f21a95b9c957e425
- MD5 027ab31940247b505101d7edcdf7c6ec
- SHA1 78860322d2ce0c181c41b0a997f1024e2ecb553c
- SHA512 c7e457d2a80a34c5f9088807faa7458ae7687cd62fa14a28e6ee689b71feb9a8a1d6179d085b882e0a4aa98a3e63fa361d6c381e7677ba5421e68c90535a65e0
- SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYhjMqbKvM3yReRdqmCAzxj884:bTDxR+N5YzTTjMAyMRYmJzxj8Z
- TLSH T1C775C02EA7F815E9E1BE85799B23C512FA727821033193CF42A0C17E1E675D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 2.3MB
- SHA256 a2e2a86c2ae4e5c91ce131ab6f5202c6563d92369483f57a647684c9cf22f2b8
- MD5 f44acec51021b7f4e6c8fc43e378c389
- SHA1 e110ed739e0746fa1a09e15cee8c0856c4e63690
- SHA512 777c0f197a875e34001adaf0bdb33dceabd7d6eb164197d9384c16d3e106c7f645145da3f5eab315338d54a669162903b605c3378b4d19d6f16001888a28a117
- SSDEEP 49152:C0K+wmSLixrYpBZa8DkSypGyMRYmJzxj8Z:6vpBZa8wSypTYbJzl8
- TLSH T129B5123EA36D10E5F57AD27DD6438906E67238660322BACB4690D07E2F67ED43D39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\fxssvc.exe
- Size 1.4MB
- SHA256 a44a3725884bd17fcec7bb3c0afd83011bfd00cc212e44db9ac1a4016d85daa9
- MD5 829e67b7cef62f672cfbe8b61f2ab36b
- SHA1 69542ec6c186d3da2d05c60951f483b010694f6b
- SHA512 215b9ce936616ce9e9bb6b91113e12b6c52cc2eb989df1ce8fb99444d98634c9e1d290a77df29ff277307c77ba09cb274d75abfd3c9d284bd44c4d096c504b62
- SSDEEP 24576:0cggL3cRTk4yti+R5dUR/5vM3yReRdqmCAzxj884:0zgLMTk46pUR/MyMRYmJzxj8Z
- TLSH T1BA65C02EF2B910B9D8A6D136450147B5FB71782E1F209ACB0170C538AF1AEE85E35F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 2.0MB
- SHA256 ec944ebaad062574fd0e4df00a872d8b1858292e23c1302a30c0e7da802c6b59
- MD5 20df32328db3fa764bbb00df13065f7e
- SHA1 f0cccad3d324f680a35fce0e7233bde13458af85
- SHA512 2450147d730fded328a817d41dbdc31429092e80a965b0b724d2cecff031fcc4dabcf98f38674f1dd4c96a5dfaaa8dafaeb91bf3942908cf6bd454be5dc0681a
- SSDEEP 24576:ELosXhn6NmrVYLlBZ/y8DkSvuQCpvivM3yReRdqmCAzxj884:EZxrYpBZa8DkSypRyMRYmJzxj8Z
- TLSH T1C9A5232DA7DC6099F571A636C61551CAC330BC3A6B66EAEF7090B07F4B339C89C34642
- MD5 SHA1 SHA512 SSDEEP TLSH