Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 19:39
Behavioral task
behavioral1
Sample
2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 5.4MB
- Sample261102-yc3avagb85
- SHA256 bb2d4b4c738b8d3f881dec9f2223116198e10a9824973514f587634d8747b3cc
- MD5 e77d77988760c95b88a989fe6e025812
- SHA1 c22664c829993dea404d14a5e86c9e147f64ed0c
- SHA512 22e156bdfe69ae0e0dd1e990143fb11e8834d6e3874f73f851217971ea1178712d3cf2ca91f1992837f33b5600f6aa6391b92c0d38f3c219dcdeee429fd38f74
- SSDEEP 98304:kxmysJpbfAcpyFnStKQIcB/ceQgEOmYognlmH6OF+O4pHiqL4/dxL/RwLfOpL4/V:smhprAcikK32EeQvOnlmH6OF+O4xi+4Q
- TLSH T1E7463358F68A62E9FEA78578CFD18383F3E67CA05348D69B53C243051F77A904876722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs
description pid Process procid_target PID 3272 created 876 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 81 PID 4544 created 876 4544 svchost.exe 81 PID 812 created 876 812 svchost.exe 81 - XMRig Miner payload 19 IoCs
resource yara_rule behavioral2/memory/4544-121-0x000001DE32000000-0x000001DE32411000-memory.dmp xmrig behavioral2/memory/4544-131-0x000001DE30920000-0x000001DE30C77000-memory.dmp xmrig behavioral2/memory/4544-138-0x000001DE32000000-0x000001DE32411000-memory.dmp xmrig behavioral2/memory/4544-136-0x000001DE32000000-0x000001DE32411000-memory.dmp xmrig behavioral2/memory/4544-130-0x000001DE32000000-0x000001DE32411000-memory.dmp xmrig behavioral2/memory/812-394-0x00000170B37B0000-0x00000170B3BC1000-memory.dmp xmrig behavioral2/memory/812-403-0x00000170B37B0000-0x00000170B3BC1000-memory.dmp xmrig behavioral2/memory/812-404-0x00000170B32B0000-0x00000170B3607000-memory.dmp xmrig behavioral2/memory/812-408-0x00000170B37B0000-0x00000170B3BC1000-memory.dmp xmrig behavioral2/memory/812-420-0x00000170B37B0000-0x00000170B3BC1000-memory.dmp xmrig behavioral2/memory/4676-421-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-431-0x0000021F3C330000-0x0000021F3C687000-memory.dmp xmrig behavioral2/memory/4676-440-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-439-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-438-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-437-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-436-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-435-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig behavioral2/memory/4676-430-0x0000021F3C830000-0x0000021F3CC41000-memory.dmp xmrig - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MicrosoftEdgeUpdateSvcsC9DD4FBE\ImagePath = "C:\\ProgramData\\c1b5f5f63a46f923\\0AD2744DC9DD4FBE\\0AD2744DC9DD4FBE.exe" 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Executes dropped EXE 11 IoCs
pid Process 3300 elevation_service.exe 2276 elevation_service.exe 4468 maintenanceservice.exe 1812 OSE.EXE 2064 PerceptionSimulationService.exe 2580 perfhost.exe 5688 ReFsDedupSvc.exe 4596 SensorDataService.exe 3364 ssh-agent.exe 4820 AgentService.exe 1684 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe - Drops file in System32 directory 47 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8cf053c67fac3b7.bin elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe -
resource yara_rule behavioral2/memory/3272-17-0x0000000140000000-0x0000000140572000-memory.dmp upx behavioral2/memory/3272-148-0x0000000140000000-0x0000000140572000-memory.dmp upx behavioral2/files/0x000100000000932b-146.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a6bf029026bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cce57e7016bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6448ee8016bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000191dfe7016bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c99cd129026bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045fbb6ea016bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 3300 elevation_service.exe 3300 elevation_service.exe 3300 elevation_service.exe 3300 elevation_service.exe 3300 elevation_service.exe 3300 elevation_service.exe 3300 elevation_service.exe 4544 svchost.exe 4544 svchost.exe 812 svchost.exe 812 svchost.exe 2276 elevation_service.exe 2276 elevation_service.exe 2276 elevation_service.exe 2276 elevation_service.exe 2276 elevation_service.exe 2276 elevation_service.exe 2276 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeDebugPrivilege 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 3300 elevation_service.exe Token: SeBackupPrivilege 5688 ReFsDedupSvc.exe Token: SeRestorePrivilege 5688 ReFsDedupSvc.exe Token: SeBackupPrivilege 5688 ReFsDedupSvc.exe Token: SeRestorePrivilege 5688 ReFsDedupSvc.exe Token: SeBackupPrivilege 5688 ReFsDedupSvc.exe Token: SeRestorePrivilege 5688 ReFsDedupSvc.exe Token: SeBackupPrivilege 5688 ReFsDedupSvc.exe Token: SeRestorePrivilege 5688 ReFsDedupSvc.exe Token: SeBackupPrivilege 5688 ReFsDedupSvc.exe Token: SeRestorePrivilege 5688 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4820 AgentService.exe Token: 33 1684 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1684 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1684 SearchIndexer.exe Token: SeDebugPrivilege 3300 elevation_service.exe Token: SeDebugPrivilege 4544 svchost.exe Token: SeDebugPrivilege 812 svchost.exe Token: SeLockMemoryPrivilege 4676 svchost.exe Token: SeLockMemoryPrivilege 4676 svchost.exe Token: SeDebugPrivilege 2276 elevation_service.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4676 svchost.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3272 wrote to memory of 4544 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 96 PID 3272 wrote to memory of 4544 3272 2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe 96 PID 1684 wrote to memory of 4144 1684 SearchIndexer.exe 101 PID 1684 wrote to memory of 3540 1684 SearchIndexer.exe 102 PID 1684 wrote to memory of 2852 1684 SearchIndexer.exe 103 PID 1684 wrote to memory of 5080 1684 SearchIndexer.exe 104 PID 4544 wrote to memory of 812 4544 svchost.exe 108 PID 4544 wrote to memory of 812 4544 svchost.exe 108 PID 812 wrote to memory of 4676 812 svchost.exe 109 PID 812 wrote to memory of 4676 812 svchost.exe 109 PID 1684 wrote to memory of 1344 1684 SearchIndexer.exe 110 PID 1684 wrote to memory of 1948 1684 SearchIndexer.exe 111 PID 1684 wrote to memory of 5728 1684 SearchIndexer.exe 112
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e77d77988760c95b88a989fe6e025812_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4676
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4468
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1812
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2064
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5688
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4596
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3364
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4144
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3540
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2624 2748 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2852
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2564 1764 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5080
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1344
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2624 2748 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1948
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2564 1764 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5728
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 da540d4dcbeb15f7ab2a1017cb8ea1462f2aef12275a9bd55f5e74d19b131cf8
- MD5 15ad03c1beec3d59e827e0e60da038cd
- SHA1 f7b9cd38460a2c4d1c8a6b411fee5dd10eac9d94
- SHA512 500ed61d23b15ac2bdfa83687e48b8aee95b34342538106993a868b9d0db28fdade541d6a6e1523358b9a20898e81ecd2b492e0e19b602add60352eabbc6f157
- SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoCS4g0djtLhVR:R3q6HjBxL4/dxL/R
- TLSH T125D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 01907554bde7229cad73a0eda81f4714d8ee7634ee61182943ed71f0a33e3074
- MD5 3778536553079e441c0b143f85d98f76
- SHA1 88ddc690063dfc9dc4106a741862b7f99a50bd56
- SHA512 f9f66706bb1978b854f04ef275f258470283f3cb3776b0b42de68595b3ae381d35f000fb7ac0af24879bc604b117a02ff680fb982729fd10b53356d73559a6ab
- SSDEEP 24576:XXYfDtczA/qAC/PT+S1g0xHnxC4bZtxoEgmK0:Ctc6CS4g0djtLhVR
- TLSH T19C75F128779409F9ED6B827CCDA28501E6737CA14760E7DB03A4A52A1F333D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 8c880dbd4375ef39e3bc0da0412cb375e343a957bc7508dadd71161ed6086c4f
- MD5 37ab7f9cd7227e27e048e218e1db8f9e
- SHA1 c1924c4bdb37e123a62a9240bb7bce7bb4240b66
- SHA512 f77c74b9cdb52a8ffbeb33d68f6cd4ec67a6cfa401efadddea2db9311515ca691f17175b398e36f65b0cf26d01d46da1824d1673156b2cc6391a6ef19eb5f991
- SSDEEP 24576:+0Le5ji0hmxFrMJqAC/PT+S1g0xHnxC4bZtxoEgmK0:+Pji0Ar4CS4g0djtLhVR
- TLSH T176959E26F6748335D073C0B9C5D2A68AE971348257308ACB4286D77C7E67BE6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 733c62de2e0d23437bbde741446de1121685a00985e017b2c23d57f8137b46cd
- MD5 2848532ff0a12169361605b8c261ab70
- SHA1 7b11e9120bccf76ad27e3df46b2dcb7cb8ee2dad
- SHA512 2bf47e98be1c796eb9d738ed9c5fff1c248f4fede4bf4b8452b1e1c263b3aac33efbba57c0349e90af5bf8151ed73a68b57cab386282f97d7772c27f5c55f7fb
- SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuzqAC/PT+S1g0xHnxC4bZtxoEgmK0:F/ezSC6vUzPvxHjycCS4g0djtLhVR
- TLSH T124755C25F5788323D0B2D0BAC5D6AA99FE723086573089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 58e81fd29e42e03e9a9957a0c069ad78462a2eaeff8c9af0ff2778d2635621d8
- MD5 f943f738a4716c31abe9dea9de6062bf
- SHA1 034d33455e9497434ae16f12b76e1d2f8f623b1b
- SHA512 675b2962ca3d5e2483d014f6afa3267cba115eddeb10d21c12688bc4aef7b79c062e912f8645d08716234dfe45fae4769dc7f4e2a70bc2808ca63eb8c0a40ff4
- SSDEEP 24576:8VbqPb88hv/l+66qAC/PT+S1g0xHnxC4bZtxoEgmK0:8VO88hXl+/CS4g0djtLhVR
- TLSH T1A2559E66F5748331D073C0B9C5D2AA9AEE3234425B31CACB1246D76C2E776E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 59814a9e84ae2f7319e6ec713729eba4fa2beee9fd340580b975b03c8fb387d2
- MD5 9d73ba031944b94ba49e418dc7773d53
- SHA1 208b4d56ac7c4c43962ad3549cf468014fc5d390
- SHA512 8a5b2f6ff1058808eda297221730f7d8864cdd248d0410358facf1318b7debe60a93b65bd2cc40227640d7f3ac6ae07d9de514f9fa92bd16ac27ded6064a2083
- SSDEEP 12288:MN9RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:MNNqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T11565237A9718169EFB9F06F0CEDA9680F4D19EF09111FAAB9644B90F5C3C560C86F432
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 4e2cbbbdc8992e0c6c46762497c66b447f3b1a647adca9d55a2fa66f51507687
- MD5 54bb8b96ec809f9b3fc7f627a8056ebb
- SHA1 9e82a50508c70bdb5f74dd2d26076923aa8768ed
- SHA512 18cd3279ea0b865e4baace2ffcddc80263c6302a78c0e9d20722a9d8d775989c56b507815689eeeb5b43686c1ff49e27112b0edbf4a943cec8dc01e6bf792bcf
- SSDEEP 24576:yJIUiqAC/PT+S1g0xHnxC4bZtxoEgmK0:yJIUCCS4g0djtLhVR
- TLSH T1F075CF3BEE28FCD2C27E4DB85A918640E7B278704B11A3CBD165920EDE335E15D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d7f24a72ad2133e7425eb6657f857ccec206534bae608e3627a4e3fd9598988b
- MD5 6aea64879577d61303c755d052a32b58
- SHA1 16bef2077284dcd5d01196f79c433f982bd38089
- SHA512 6db88aa614684142e669de19e974254eec5f6fdb87f43c26e9d8b490799c380a38a3ea2b6e273547b6ebb5c9027a7a422c1894ceccb5b37b964f314cd6766697
- SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:eQvGAdlCEL8c/yRNw5CBL4/dxL/R
- TLSH T132267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 a893e6bcef6a6ddc4cae8d45fdbcd67256cf1b23bb044a3bee665726cd3a3075
- MD5 f796ff03301a23f6c4eb9eb68c2e74e9
- SHA1 49dfa51dfa50bf6abd05dc2371c34f1af98d7bbe
- SHA512 cd52152fdf4f97088ddae1412a30ff34ffbbba0f3be2bca9c95871d90f6b45e762466e120bc30f9b522bf34fbdf3e9b2dea51f91e3e0feeec4b6a3b11d4d1739
- SSDEEP 24576:A6ewsAjkqAC/PT+S1g0xHnxC4bZtxoEgmK0:jljoCS4g0djtLhVR
- TLSH T14985E031FE74E036C7BF0DB11B26C706646C7D604B512AC3E3A89D8E59342D2677AA27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 3daaa420d51a50c7ae6777049de1bc8028bde3c470267109d3e9344980cc21d1
- MD5 02babb33bf978fa7552661633500f4ae
- SHA1 f435546d9e96aacc84e3036c09cd896c72948647
- SHA512 b2623beab6be81ca57da8b42f0a70b6d11a128fe89a9dbf650b2eff0910af765f57c409c06d1c554073c4bccfee91c58538f43722118850b9a74b5de3c49ed7e
- SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHM41pR:SUEtQevvqc2W1cpV2EI32l1r
- TLSH T158474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 05392067185fb18f077506013bb67b1647cbb554aa48c6eddad24a36ae397e46
- MD5 2aaa926a5adf4ec62a7a7aacb57cb1f4
- SHA1 2245443754e6e09f1f2dd573e3388f0dbbeb7e8c
- SHA512 6cd3f340d1dc4a7858c5fe80b519a9bebcc9fbb8f8eddaeb8959253031d6eef528e371bcc2c3ffb4f761ddc68765dd898574c4e8b6e7b9e6fb056ba20bcb8ce8
- SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zICS4g0djtLhVR:yoqtVjnmFL4/dxL/R
- TLSH T1E3D58D1976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 5b3f9df9f863133cc678475cd8c39ed43a440453c72ddce1567470544d93468f
- MD5 f795838310dcd4963f5066e0898260c1
- SHA1 ce3bc5e8a42293078ceb17325f48ac1758d8b68e
- SHA512 e8036eb67feac95218330bbf4309f24367bffd28c1d87df94b466a68c7717a2042b2b6995d7faca075812ae3f7d3f7541d44ad608fd552db56f4deadf00ae476
- SSDEEP 24576:BAhGLJIFoiwtA5l7S53vqAC/PT+S1g0xHnxC4bZtxoEgmK0:BAMyFoiq51CS4g0djtLhVR
- TLSH T1DD359D81E7F955D4F5B3AAB89DB68170EAB6BCA65E31D20F2150D10F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 f13dc3e0c9faaf43e73d778661d2f0de8601fa0f797d3eb7c6692b29893cb7e3
- MD5 205c8f731d9633ecf2dc110ccdaf0000
- SHA1 be876273aea1ee8d2ac667e55e64bbc986cfbb13
- SHA512 b9ce1d0280d2a0ea29e16f49f0e124b1cbce536a477f6c72e9276f6c2ce19c37d2dfc2dda81ab1799353394ddba6f985095659f3f92b5bbb2c9bf5bd70f99869
- SSDEEP 24576:PwuFOWFqAC/PT+S1g0xHnxC4bZtxoEgmK0:PwKOCCS4g0djtLhVR
- TLSH T1D875F14A76A40CF9E9674278C997C132F7F2BC512A21DB1F0760C65B5F37261AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 a9ba4b8e67dc45fe9b20b6f21cf4a2fb45c119cb911135c2135c0f56038823c2
- MD5 6fc7c977a657182b024ccca63a9f2721
- SHA1 ec0408fcd4065840897a716d1d17651c49f7cc31
- SHA512 59481bc2208ea9bc9ef78434d6e173d8548d734570bf4e798b48d8e5e48b2f56009080477d7c7f03457e0de9ae7dcd7c23d9b1a067ffe032f059cc40ec532e91
- SSDEEP 12288:wFZ1IyYRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:6ZuxqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T17765126A33A421F9E29742B8CDE18641E7B17CF1633293CF1654625A1F36AD18D3E732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e1dc1003ee3804a9e35fbf7ff5882dec32aad16a470a8bf0b4cc3ce1930aa8bd
- MD5 a8920046f9092d943ed7fc2b5ce9ad93
- SHA1 5617d54b802dc4fdd29870e79a5c3d9e5b81d6d8
- SHA512 8420dd5c8fb01bbf6dd7da85bab542e48451b36f7b1b2d5f06fcb184bcc9d3fbedb18efc27933df6c80b3a27115fd439c396312b8f2157c2ab6639713e18d035
- SSDEEP 98304:rQRQyi36YOcPQLvw2gAf+PN3WL4/dxL/R:aQyiKayX+PNS41pR
- TLSH T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 08cce44b81e8101d1c09cb81d24d0f1a8a77e001f0c89d641caaf3051d0ed03e
- MD5 7a9d44ac93924c8aed08ff866b75bc48
- SHA1 f018b9a8483ad22e5029d5d97d17bbc20c5abbc4
- SHA512 e6cfa514c4a04a733f27b835e95be5908a64d712ec9e87fd68697f4eae627151c7693465ff19ab7bb35080edaaae7215e1f69a4a4d31641e525387466312e56f
- SSDEEP 98304:/QRQyi36YOcPQLvw2gAf+PN3WL4/dxL/R:OQyiKayX+PNS41pR
- TLSH T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 58b30ebbe9b2ba438b1392bc3edd4182cbda0b9827a7d532fe67f7067f1dc880
- MD5 ef292e4f7c0b3e7b109af6d437a600d6
- SHA1 9f9dbfef461312ff805f192eae68b16b3a4f4cea
- SHA512 3b12389a77bb2dd8108f7951e7102bda4b5eb4eac2c03aba9c7547f126279625047905cd39ee81c44646eac775becfccb8d4db43f394197abe0c5e8ceac505a9
- SSDEEP 49152:C68Qg55nhheWu7PNU3/4CS4g0djtLhVR:AthWRc/4L4/dxL/R
- TLSH T127B54933B2F600A9C44DE1769F4A872196D17C718FE1E3DB8515720A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 dfbb8a44aad19a089e190a6f3c07fe7373b88f428918daecee8a96c937996c47
- MD5 f1dc38530bdf254808b1ce9d05ae6a68
- SHA1 44b6b787f203f21e66b553e960499d36ea6c7f69
- SHA512 b991d8da5eb3b93028122256c000dfd7d3024ce976bf61156ebf5b0738ea673c7420d50e7f438d25406639d37e111f157226f7d9f33df4bcc84959acd46674fa
- SSDEEP 98304:Fy5112gYy5azzVvL69nLKnhZ3L4/dxL/R:oLIHmWhx41pR
- TLSH T1DD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b24dcbb46c415910fcc0088077871433679580cf35f40cdd7ecef2d8d53b54b2
- MD5 329bad1ad9ab402a1bb3ec302c7e425a
- SHA1 6434e9968acdc8b514e8ad14fbb0ea78bef814ac
- SHA512 6a1bf966998fe9b706cfd5872b83b5cc1dfdac0eb1269d0105b09ee4d767478fb970560ba4859c244e13cd1ac709f06c16a59bb40fda811de0d4675c2c7f24e7
- SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllCS4g0djtLhVR:Fu6JmVxd2dlL4/dxL/R
- TLSH T142D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ee9f32abfe1cb19ff414c0b743c797f77461ee2355b949c71656e1a905083198
- MD5 f250f5030364ac304fbb540e69b84168
- SHA1 54dcffc66d9c5bbf4dc43fdc4f2fe36e76bd249d
- SHA512 3195868950c939e034e432e183465b80eadff01949e6c29b0e7f39e4f124cad6822969908d118b34a9adeac955924947f20a9c5d39d923d48103cbde986033c2
- SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xiCS4g0djtLhVR:+mifPbRFL4/dxL/R
- TLSH T1E8B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 e9f83f7c2fc31f2b256acc2c0a012d4e09c09e1cbabe51d545d6ec54acce5ca2
- MD5 79ab18647e63c1d8d0cec8b1665886b1
- SHA1 cddb1623d692f7597d8b4965dd26b71d1b52d835
- SHA512 2c8f1b942b9b693e4b8f9f146510467982b51e6d07dfc9217ef9eb02544745f585b7582bdeefe6a187008c37245fc14662078b7b15db763af66a46c4fdb621d6
- SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqjCS4g0djtLhVR:W5dKTi61jL4/dxL/R
- TLSH T17BC5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 927ab75bf1333291d8194ebc7951f34444ef9cebef845522b4eb39d08373af92
- MD5 1c5e77c495368f06baa9b8ee21ea9791
- SHA1 5839cccabf5c938db8923f93eeb88c082ca78c35
- SHA512 166ed35158357e287eae82656b8c361744c5704a25f75ef706b6f1c8af5ee1355c229306a988b1decd137db5c16f11003f05dea25f4d9edcb5261d377afa771f
- SSDEEP 49152:whtSn8EApI0figngiDn0AP5wOCS4g0djtLhVR:hX2iyph5L4/dxL/R
- TLSH T1A995BE13F2D901E8D05ED1B8C7468632E962BC150B35BAEF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 6aafc8dd24af6fd92d858a5d15cd4f353c5c3bc643b9814be1173ecd07ff0a1a
- MD5 2690430434d5b420019a598b88fff3d1
- SHA1 f20ff7faeecf8143bb8420ad5823b961bd3bb88c
- SHA512 65e88d37846beea5ac489938e3033c6ee47e230cd119ce57e45e7e9c759edd55ddcaf15febc9ad3beddb756c48a5575c58f90863befe92c60276892ce682c751
- SSDEEP 12288:GVRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:GVqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T10E652379AA19179EE74E46F0CED68280F4D45EF1E212F6ABAB48B00F5D38571C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 ccee8341b5a20f0dbe4d0a2bcb6a93025da547de2443659c718bff18b52c2ffb
- MD5 b27f55f2281d00b776bd7d548a713c35
- SHA1 8e3538d0e1fab396a7a8f4ea695f68aa092a5551
- SHA512 14f7fceb405c655f808436bc4f2b7a4ca471709ea42e65707e5ef86dd1e86221c38eb2ab958d1f9fddc81f75a4bf826e999676593e4c7bba1d59337164417c15
- SSDEEP 12288:qMRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:qoqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1CA652379AA19079EE74E46F0CE968280F4D45EF1E212F6EBAB48B00F5D78571C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 c92ad1855044e9f577f2876a9bb837287b6c2cb585b31891494db679080b0186
- MD5 19c44ae8fb11db75923bd6022d5e5f96
- SHA1 422e393ee79997b558f0a9b84c8b187d40987a9f
- SHA512 d87ec6a588991be6eccd899306b462705914f120deadc917435f5e9be88a039e27da01477a6e6428feaf633e1a3924b511f3d491fc2cbf0460f977867026d546
- SSDEEP 12288:huRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:hKqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1EA65237DAA19179EE74E46F0CE968380F4D45EF1E212F6ABAB48B00F5D38560C96F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 7d52e2326ba84ca3c5bc9b4ad66c228ae4f6aff8a7b33d3773497ccf51300324
- MD5 76eecff79542f3a24c2e9f60c2ec759b
- SHA1 d081b9ffcfb800b5942a976ea8bf3f4edf5bb9f2
- SHA512 4a28a808a5eff73ecaa1b43a0dd1951df93e397b87d006b4de00a6613a5553d1bccc7491103906306480e2e2c603a801f6631ce69ae0fee0385a21d5e3b07aa4
- SSDEEP 12288:BVHRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:jqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1C7652369675902DAEA5A82F4CD968241F5E5BDF0E322E7EF9700740F0D746A0CD3EA21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 6ff994f9c3f64f36ea20b7da1edec2ac3e0ac0e3211af4b0c04920bbfcac7457
- MD5 ac6d48376729628ec7779b7e4041d793
- SHA1 543e0abc3171256c593735bc5e295084eef2545b
- SHA512 219bb82640e1affcbb5f7ed97679e15899b4ad8779a109d6f4d50ea5e23cf3bbe7e139674aec691f3b8f454b6d8d89f49e35ff3858a6500206ac056490777870
- SSDEEP 12288:WPRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:WnqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1EB652379AA19179EE74E46F0CE968380F4D45EF1E212F6ABAB48B00F5D38570C96F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 32bfb1079513967c96d03fa1c4d3e70d63b297c028fc9a2e426d435d64bfcf3d
- MD5 c6ba927d7de9eb1b83cab5af107513de
- SHA1 5d40da1dca9ac53f32180a362f9a25d2fa5e2490
- SHA512 1dfd3df70e3f7b9ebf437422a2c0fdebb5d8a225a8b2c3fb46a996cab894d1c330789de5e1ce7bb8bf146f420639a37735c2c5a2ffd692bf0b39d6b59f93c4fd
- SSDEEP 12288:qARZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:qMqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T10465237DAA19079EE74E42F0CE968280F4D45EF1E212F6ABAB48B00F5D78571C96F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 c8e5e9461ea6acffa5458c37f616d1479d6a2f5324e850852fc1649bfb6dfa63
- MD5 f0d00f462d322b2dca36a3f0346968e9
- SHA1 5dac252eca23abdbdb3ad9c66d657680cd982e9e
- SHA512 b47805385496b101e8a112b02698062bcb68e54a6bef0b80202728b97e313166c9d1ad5e25b94e2e5ee9c55da0aac8127c4ddf5ddaa2a72b4200c0955160d1d9
- SSDEEP 12288:sURZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:sgqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T12765237DAA19079EE74E42F4CE968280F4D45EF1E212F6ABAB48B00F5D78571C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 69ba0fa713f93a46701f559beabf91a154386d327cdc484c7c64e98367ef36fc
- MD5 07f2b58d72b85f96fefa2190ff5fa28e
- SHA1 6cae28ec377a6e895c5ad54bdf88e0c85fe88bfa
- SHA512 eef0eca52fed7656220a1eb39c00e698c1f6b2fcb66ebf1fb157d3fa4725c1ba45ba6bcc31450bdebafdc5fefa949a023a0222b295b8dd8d7635627c28704356
- SSDEEP 24576:5ZMdzFVSOIqAC/PT+S1g0xHnxC4bZtxoEgmK0:5ZMdzfgCS4g0djtLhVR
- TLSH T1647501A9B35018F8ED67827DCD558902E6F27CA64760C65F03A4362B5F333A14C3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 5625759ae9383d3c62b07effa25a6d409affc5411e0527401cf93cbdf7314374
- MD5 2bad4a5d060e757c06d14fcd263b98d3
- SHA1 38fa192326bd2ca1a2e3f9ae7a64fa26a37caea2
- SHA512 01caf02a0129177831599b9634020641b477265847455fbad2e67c2f223808eb1d97811ae443ba00c3709f183febed5cdfb08690faf94196ee7baa3d5bd50f29
- SSDEEP 12288:OBRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:OhqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1D365237DAA19179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38561C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 584ece8411d688784454f15451f56eccb3b942e4ab905c0b34eddafd33007a04
- MD5 ab389c0feae83b5d7577d3740a291072
- SHA1 5a89b6978c9eeddd4eb6afdfdce75b073aa1ca2d
- SHA512 90451b516f4d7c3b1a5d9148d9bb83f1eff1810d050eade9f98ded38608e86e4d5846ecb4a7ad325b1e8204ccfaa339f46083074b76253fbee70c1182117abf8
- SSDEEP 12288:HtRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:H9qAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1A565237DAA19079EE74E06F4CE968280F4D45EF1E212F6ABAB48B40F5D38571C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 fa2bcd632a7d5e04c58090c3a39be9ad7d8d89a300907673d4798f3ea3acefc6
- MD5 ba887fd71951fa12a827b4177c1792a1
- SHA1 3fad25208535a3b9fd02c254e996a689e0abb537
- SHA512 e179928eed3da3111356dac2d7217200ffc2f63acc373a7e8c7df5f6a0e5330ac6c0ad134eb51e76f7aebef3b0e0baf8b5d11cf49e7fd402496b9a85ddbb6aff
- SSDEEP 12288:JyPz5L8YRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:ozyUqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1FC75021773A531FDD16A8278CC920A01F7B1BCB24720DAAF5754667A1E376A09D3EB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 7a2235ac04c0ec5bd2d02277d9d4b83d14ee085cdebdcc05c356658900ede009
- MD5 f02822fe82524b21a3decca907fcad22
- SHA1 250efde242bc6bf18e23deef2e9037e3a3b8a0bf
- SHA512 327d1762fc88e0d29ef52cc646b6ba5372ed11021d0a4b13a6b48ad543196df624924cafd63afd14b3ddcfc23dc2b060e6f19c15d99e326bf53bc5f15178c70a
- SSDEEP 12288:wBRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:whqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1A265237DAA19179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38561C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 6276f6fc2be348633251cc54c55c60be181e1a9ba2db0770da980a8b077ddccb
- MD5 13c92a3b480a799a1d2c3ba3f3e27d49
- SHA1 d26ab7c7b9174154c56d4b7bb00414610f2e035e
- SHA512 8bb59580fa939d0054932dccba1b0c9b188e7f53f7649c41f4fc9d8039b8c541159398a57e16b05fd60088b8d62313c6ae11ed32eafd86aa39d2b4cad45f1f4a
- SSDEEP 12288:PBRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:PhqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T12565237DAA19179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38561C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 046afdabe5757447c644591bcba699c67cc3515fca1690a0b8e7b20e37ca234b
- MD5 35549a265afe774cb79d8380b8c0256c
- SHA1 2ffdc0010a89684a7159fc8d0de133b58b06c28f
- SHA512 1c69bb09e72d5cbf863358d1afdbbc6bbe9c8a3f6044270e605e95f1814c9501e5ad0979d242b9809e78f8b37af2cc39c3b61b43e14e419eb9c403978cc622bf
- SSDEEP 12288:dyPz5L8YRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:UzyUqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T18675021773A531FDD16A8278CC920A01F7B1BCB24720DAAF5754667A1E376A08D3EB30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 30ecfc40e8b85221afdeba02ad1ecaabf6806613d0c54d726898149adcf99135
- MD5 b0ee11e0135de7e375b2b30717d4c7b2
- SHA1 25947bfa059399fa0789b9b92c568c4de08e0ddd
- SHA512 a6acaa6ba2d37750b3154f3d4e9cd1a260399ba9a9b9ce0d2aa7e4cd0ac6567b43ee8352f7075bfc907bc89d905d1b86fbce38f493933a77d7636f84faac9649
- SSDEEP 24576:2TGaLl3z0zDaqAC/PT+S1g0xHnxC4bZtxoEgmK0:2TFLljRCS4g0djtLhVR
- TLSH T1D07501A9B35018F8ED67827DCD568906E2F27CA64760C65F03A4361B5F333A14C3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 0bcce83f42863fe193fdf242c51391c0f901720ff5a8b7f8733486138edef7c3
- MD5 1eb8be5c448a837aafe6f383cbf25e21
- SHA1 cc6e005d643225ed84b3efe2549edf93a4af0823
- SHA512 c79a1c34c1066a13251853214138dab6b01e10ab5b14b02f0263d8b3ae9382c08e88194515e4c9c52f130b254de8706448deec4339ddceabdaf0eaf95b0c4bc4
- SSDEEP 24576:R3nd9CHKy7GZOqAC/PT+S1g0xHnxC4bZtxoEgmK0:Bnd9CHKyagCS4g0djtLhVR
- TLSH T11295CF90F3E410E8F1B78A75CD768511DAB67CA95B31DA8F03A4251A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 18e2c82c82447efce7b0d57b56b71bbbd75ac3823ab98bec5d154579e8989a52
- MD5 1e03b260893f13f56741c892440b741a
- SHA1 cae2412f01963687f6bac3fbdaf7e6b5a79df3ff
- SHA512 fd1bed0eaaaf02f2c2038aec724c43a890b903db0c4e699548fe77c927ff7b34943ccd55ed367e4b47a20b5e845a726838ac05ccd42b65980676c4a48602a554
- SSDEEP 12288:bORZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:bqqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T189652379AA19179EE74E06F0CE968380F4D45EF1E212F6ABAB48B00F5D78570C96F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 9a9140c4abc4a1e30006c2e0a78cd08792ef3e7f55d42b06a46e043faa85338b
- MD5 773da8eee33a71eb7603b22cc0a02c93
- SHA1 fa500fca76424927965398570d80fec779fda2f2
- SHA512 fb0025bbfe6d21a5356f19f2ccf27c465a483c43e4229d58c780d05b2fff90ba15111b8ed9a222acc98186ecd98c2d375c5d9ecd92e678187d97c7d8b3f82676
- SSDEEP 12288:/4RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:/0qAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T106652379AA19079EE74E42F0CED68380F4D45EF1E212F6ABAB48B40F5D78561C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 e033a05d0c600569fc2a2c560b682281e181f4de706a4cd24e8d370cab5e5841
- MD5 63d4894634f0fd66bd970715a8aa507b
- SHA1 9c816718bf2dc804080b45aec54b67d07abbb2cd
- SHA512 c4190fa2e34675de7eeda62062e96e906711d5c90245446fb503771ccd71c2af4163534d29aa342e7f853a309dd55560b1822da96f9cacb825bd8d6060d18fe4
- SSDEEP 12288:BTRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:BrqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T15D652379AA19179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38570C96F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 1529563f9e6944caef378deb0356754bfa1a04b049252a22ce0f1b63bebe2f98
- MD5 a8f04a95d4de352bb00f733756e53554
- SHA1 592375749b76cf4a4321740123e46db53f1fb1cb
- SHA512 633059bac00b800a700ad74f1bba26b3e121345d086c82cf93c0fb9a8972932777a3e07100348d045b9521b7cd81345f1d6445c8789d76a09a311dad58163f90
- SSDEEP 12288:qBRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:qhqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T1D365237DAA19179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38560C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 a9fa4553c2263e57f0bf13849cfa52fa949f8d659414afd9a5e4509ac87782fc
- MD5 74f779d5b616ad486bd1a6a2c10a5e3a
- SHA1 c98f985e2ab73978917073d6c79b6a13abc0b7d6
- SHA512 431c5cf6b0754e255ab308c41f52bc4f443ebb3b22ccb79b2a2c6d4d3206acd1f0b97b855fa56e5f67ed0251d7da4f1a7941daa06591bd29457588553e1e75db
- SSDEEP 12288:yORZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:yqqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T174652379AA19179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38571C86F431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 ad712286b6e3ae787ca54f0029016729601a856464fcb45c0b32fa28d2f1aec7
- MD5 23f261ec86cb75cc70062bcc26fa2c17
- SHA1 f5573299fbdb4f5c6fc00a9de867d007d1e71cdc
- SHA512 69a444f71ee5ab771ec6a96e0160c7f1592e40b9d225efd20a8a52f9333a1f8ad18fde76e1a5ac986ca62cdc9d2afe6a02588d358e46af22f01ba02ce5328b20
- SSDEEP 24576:9fwvJk9RX6wkyAItqAC/PT+S1g0xHnxC4bZtxoEgmK0:CMnYIXCS4g0djtLhVR
- TLSH T1F795CF29EBDC04E5E177927C8DA7460AF6B178691B31C2CF025A536E0E37ED09D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 603bb7045c5ba567d1e19c2a2459380f668a78bb95d0f170633c2b694dae69cd
- MD5 a3cf428fe7fbd8b021df38a3b4c31a09
- SHA1 677b16767b9f1d107319f129815e413df9127f3a
- SHA512 955536e9133126c4ce487e7038ba04df0290fafc2e0d57610f7d3bff28594d4f472d6ab8d5402be68792f64691e6f78d199b3d93012a3aecf07d0125122612a1
- SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uCS4g0djtLhVR:5ySzP2L4/dxL/R
- TLSH T15E066C56A16801D9C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 a5d40f939b60a1e340279f7d2a77f535cb18f8be9894e0bab63c6a9a5ea34569
- MD5 37bfb19b49938d7d90db69636776d526
- SHA1 b166eeb59a0666764f887dce17a1ee31cc47d609
- SHA512 86a2745dc053ec9cc68ca3a14363ce9a69b2197a3e4b0ccbd31aac7cd34c6d542484b90c795cbef095009b968036c63fca1aeeb0a4c08a5ca696fdfaaba2aa3d
- SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4qAC/PT+S1g0xHnxC4bZtxoEgmK0:/47JUQj1irIhCnDHUPfF/eCS4g0djtL5
- TLSH T1EF65AE1DA3EC01E5E1BA827885154A5AEA71782D1B31DACF1270937D6F33ED48F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 a9cbe3cdec3f1c6c3c6a43daafd35be5ae440cb32d0b4d26997da1ae998b8554
- MD5 a88622e6e7466b7548a260a62f1b4835
- SHA1 1d039cc0c86de6750047056533423cccb79d0c16
- SHA512 d00ef61fc2b904cc6e1f07a263718f06770eb460974d3fdb99a86802310c63d0e998bb1ca9797f10359f18f63d34793dd1d417ae46411bca1d54909a8c29c169
- SSDEEP 12288:y+sfRRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:ixqAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T19F75F11AD25802E8D16E52B4CB968641F3737CA193E1E3CB57C0F53E1F396909DEAA13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 210cb2fd75081fcf550227c2f14372a6f972b3a3f9dc958190039169bb9e12d0
- MD5 20d864a0f0c6d229b1b3c5ae9acbbe8f
- SHA1 cec60a2119ff776672a07e65a517c9af9d662097
- SHA512 7efd39b6e117941545a743dfd2d1838e3e1c09437e25a4fb3745224033f690624eba14e54d5625d8e03c654595b65e249112474000e3ab9fecf0547c92f5cd47
- SSDEEP 12288:uKp4U3fUc+kfGDiJZtr2EpEHdcYePkv3VpvGwU2:uKaUP/HHV/EH6ZPkvFFGwU2
- TLSH T11C453A017626CB4FC6A940325E33D6CCA7707D06EE45AB0773C98B3FD576658BAE2281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 da0f5fc3454ec80c98fbbbe886b6f8615ab42cf692d06f8f099af34d8bce335a
- MD5 41b1472840fb7b8ab74e43ade28bdbd3
- SHA1 80e666e2de5a0170706211bb396d27ac4bdf695e
- SHA512 1af55c593228a520f50a77a66ae557913a70b60c43b330cc48ff39911fc5d2074521af53ef2bd5bebf11aa677a220fb6d911797b3d7c5c7314ecdc46e0139afb
- SSDEEP 6144:0KaEsa8kV4ZAZt2Bk+1/oQdwCFVxvEtMxFvEtMxdVBczjbj36v+dPJsGcVjbhT:DiZAZz+1/oQdwCFWKv+d9cV5
- TLSH T11B65FA81A537A78FD1B72031072A6B8C7BA8EC07B7055F2673D9453AD866B15B0F93C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\c1b5f5f63a46f923\0AD2744DC9DD4FBE\02-08\7b34c9f418ec3a58
- Size 124B
- SHA256 1a32ea21b88eb16ca41a60ee9e98a51c542730027e6e2019df705b128a7817ee
- MD5 7e6ebb438aa0386b6d3abf0971232b67
- SHA1 d0632062dc73351eb0f441102fd052fd1b354742
- SHA512 bcddf972b1d5ebc67ecd031fb1b4adadb103c39d95f367437df4b787fa0cfe3d9ca231b456d6fe71581c4bdf1add9478155dd142ed19c2c802331f6af04fcaa7
- TLSH T137B09BF56FD495B7D0109170E394409395857B4F712541544446154714D55D45915951
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 1e5e3a8647edc11f51a70b2c319afef3e98e09dabef57ac4b85b17748d79a287
- MD5 b5c4ea5e402d0b5b3ce3953e6af5c677
- SHA1 acd5325099f60b207f8d6cf2a3e9dea32547b927
- SHA512 1c434c43c30615b486558d514a625d66cba310e6f6f1e855e796522daee559ca11250c58456cccb635e196632bc1d18d5ea3d6ee3da60ecde55ea982e7584e80
- SSDEEP 12288:247wRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:n8qAC/PT+S1g0xHnxC4bZtxoEgmK0
- TLSH T11C65233A971C1A4EFA6E06F0CD9AC210F599BEF09711E5EBE604714E5C389E0CD7E522
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 3894d24ffe5a782e90a175c28eb613001f32bbc9066ecd827397b5321a6e9d58
- MD5 d965a847f4aaadb953054c9751d88f44
- SHA1 0c27bb82306624d9b80780a83e5ce48d70c4f52b
- SHA512 9cc5fc26515820d304602fe4ac43b7678317ca24a1aece8b50235f270a0c2ad99851cc1b73d6208951bc6ce00e8373279ba06388e0ee820ec4104286cff62a95
- SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYzqAC/PT+S1g0xHnxC4bZtxoEgmK0:xgb4mBIBhGFkCS4g0djtLhVR
- TLSH T17D65AF1E22EC02F5E1FAD2B8CDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 22eb9cade9e4322f785a8592d20ba254f4113394a9dcfa59b3394ba2e33750cc
- MD5 05b9375b26f76b32e0920b8e6b259bee
- SHA1 f31e2bd79e1d6fc26625e9b95d1769f45df6228a
- SHA512 45e04cfe3fc37ae8c114d4fcd48b1e7c0072e90b6b67932053451029ae21f850295b646d7c60d285dd6f5a597a56293b8918b4823b153b13720f575ac2dce4b5
- SSDEEP 24576:tG88u8FpJqH1Kzria7/mIqAC/PT+S1g0xHnxC4bZtxoEgmK0:g7ZFPqVVa7/JCS4g0djtLhVR
- TLSH T19095F16576E102F5D47BD138C9864663F6B1B8210320EBDF07A89A561F33AE14B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 4f5ab5f6189876d77a1c8db3ff981e2b7867d4fbcbdd465cee1b55aa1d56941d
- MD5 6f42004319364eb69d9c673ca14eec42
- SHA1 fccef78e95a241712f94619809c7a51bed8594c6
- SHA512 10444ec20157bfd4fcd967db2e0c6fcf8f9c23a16f455eef1a35b9aff4ba747cfaeed617e77a483f27b9c649e24e64477fb48bd60c0583e5c29b1f80cb5f6797
- SSDEEP 24576:fPUr+NQBqAC/PT+S1g0xHnxC4bZtxoEgmK0:fJQzCS4g0djtLhVR
- TLSH T1E175E22F62AD18E5E67AA17CC9828709F77178611311D2DF02D0917E4E77DE8AD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 749159a4fa9f8e93e157afd1f1e5d809e26fdd2896d452548bfad2fad7cee699
- MD5 92789f85a71ab3f77d6dbd37d9384911
- SHA1 c8f6e3cb95d2cf77fc67a387371aa6ba4d9e71eb
- SHA512 65a097dff11d5a4d09b133a0a948f597a1945290538ee869c374ffac68b39e145c8488741807e32e1d42d8cad223d5fe9d2fd14fbaed3c4e7a7a2320d8669fac
- SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjCS4g0djtLhVR:SG05lO43b0L4/dxL/R
- TLSH T165D5BF6E62EC11F9D1BBD17CC9C6460BEBB23825032556CF02A486A91F27FF4997E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c2271824b63be97292ed1f03c5fd71990b382073cc80665ce707e1d630bebee8
- MD5 49e8a6c71dfab46215e963fcbac8afe4
- SHA1 60ad26404fbd08cb294250a1029f163f2fcf94e3
- SHA512 f146272ad0850baa16a5c0686d10992ecaca443e70eeffe976b1b1f66f2a8ae4bfcc1469fb020995daee6cba32211ce03311059b4bd8093399d9be9ff3ce7911
- SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnGqAC/PT+S1g0xHnxC4bZtxoEgmK0:ga5POZ3+Jt2pasx2+m4CS4g0djtLhVR
- TLSH T11665AE5EA6F801D5D5B9D17CC583861AF5B1346153329BCB022182BE3F37EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 8091486cc3342cf0b51e1817d8fc2b1584477481ba1c859361384d0f3a5a7a7d
- MD5 a64baecee3d6731549e939a5e39750e7
- SHA1 f40f4ef283e2886508f5c8382c30afc659ce0a59
- SHA512 477ff366f91b12b0e4ede59536ff7ab1743662b162e855fd17133cec43eaab11f150df00834125a9c78ee5ed5580facf4e8431ac4ec9f8f88bc8bfe6f47d8e17
- SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkwqAC/PT+S1g0xHnxC4bZtxoEgmK0:BNc/zEOVHFpCS4g0djtLhVR
- TLSH T1C2857B2623E901E4F5BBE1BE89679546FAB17865533086CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 0d372751e1c644ccd5eb2951b2d9334de6a5b36e7e370dc27e7a00a65d150f98
- MD5 18db25eb0cdb854f128dc611bc4cd48a
- SHA1 f39c768f8edd0e900309f77ec454f74bab42bca5
- SHA512 3b56d107da70b7e438291fb778abe8c6da16b613a6dc766b89c6aa5ad3eb06fb2eac887515e219c5205231d66cace7d224084643ba8ae9b8b1d993446687e3f6
- SSDEEP 12288:g1Hck6j5ZI7rcR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:w6DIfeSL/Wvee9jYFNZ+rSrpUqkLsxJ
- TLSH T10C25015C73BA10FAE0B7E07E85930316D2F2B465D7529ADF468089B94FA3DC8B538E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3d4e62adee137d8a898557cd2dc463e9fe564254597798ef04757ebeb26c1a55
- MD5 bc72c5dda8580ca99e66c5e60af49a78
- SHA1 2ec16cdbef56399a709e3824911fdbfc926bf1b1
- SHA512 4d895dbaaf9fb85090f2e420eacbffb420c3a87d86c59c20c933683c47e6023256e25b9ca05cf2fd3bfdd31c9b2a86d73e7f0d776f6a6f9314037ad2854a036c
- SSDEEP 24576:A8kNvNnaFeYhJNtmZBmrqAC/PT+S1g0xHnxC4bZtxoEgmK0:A8MwBtOmpCS4g0djtLhVR
- TLSH T11755AF6EA6B806E4D1FEC6B4CD238512F6727861173293CB5290C13F0E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 b6abd66dbab6d115bee3b03b9634115f8e5756e733b0930f1110295376c39188
- MD5 7a798a7041b38d88616fa8650222f12d
- SHA1 a0ba0848f74170eee2ff5fcffea475e358a2c25f
- SHA512 9ca2448f780cadfcd1ae2758779645c820cefef81f4833ef05ee759eee056a67dcea28bc0fdbc30daadac43122be53db9aaee46ed7863d2d9d3132970872bdd9
- SSDEEP 24576:nD3FHshBIYQgA1qAC/PT+S1g0xHnxC4bZtxoEgmK0:nDVHeBIAAfCS4g0djtLhVR
- TLSH T1A085E17DE65C04E4E57BC1BCCA538606E67138B9032266DB029491BA1F7BEE46D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH