da98e1bcb97b03b22df3a76f28043977bf0f14b2a9dba70b5997363a29a1f77d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.1MB
Sample260629-rmlyaag18m
SHA256 da98e1bcb97b03b22df3a76f28043977bf0f14b2a9dba70b5997363a29a1f77d
MD5 88a5c263f97f52dce503d009bdab8c62
SHA1 ede16abeee65c45a9685e72d31040bfe226948c0
SHA512 42a5ad2a56574dcda59e8d4d19e2206e709838984ac5a971b213446cea3980c50050d723181002fca15c27447562fe0df05247f4e8199f8d14afede83bc8d0d9
SSDEEP 24576:+0/C6CdH79Us2PtOsyJpQRPWxNs298r3OCDIjG3gE9ow+8xA+:+0/qsw2R+ft983Dl3gEe8xA+
TLSH
T15F45D016B79501F9D077D179CA568A71F6B3B80A0730A7CB03E486962F277A15F3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5412	elevation_service.exe
4784	elevation_service.exe
3336	maintenanceservice.exe
5616	OSE.EXE
1676	PerceptionSimulationService.exe
3896	perfhost.exe
1296	ReFsDedupSvc.exe
1456	SensorDataService.exe
3196	ssh-agent.exe
2212	AgentService.exe
1832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fb8cd93a118c7e83.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110781\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110781\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f6d437fd207dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0fb9b3cd207dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004731b27ed207dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009575ee7ed207dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075e1d739d207dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed6c213ad207dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5072	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5072	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5072	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5072	2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5412	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2212	AgentService.exe
Token: SeBackupPrivilege	1296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1296	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1296	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1296	ReFsDedupSvc.exe
Token: 33	1832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1832	SearchIndexer.exe
Token: SeDebugPrivilege	5412	elevation_service.exe
Token: SeDebugPrivilege	4784	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2968	1832	SearchIndexer.exe	102
PID 1832 wrote to memory of 3552	1832	SearchIndexer.exe	103
PID 1832 wrote to memory of 2796	1832	SearchIndexer.exe	104
PID 1832 wrote to memory of 2620	1832	SearchIndexer.exe	105
PID 1832 wrote to memory of 1868	1832	SearchIndexer.exe	106
PID 1832 wrote to memory of 5648	1832	SearchIndexer.exe	107
PID 1832 wrote to memory of 792	1832	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_88a5c263f97f52dce503d009bdab8c62_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1676

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3040 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3040 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bf2003d6f7b5f8b3e8554edcb13b62b4c04cb0b73d3cc751b44121b77b703592
MD5 0fe274c3f6c80d82db1287fffe9bc9bc
SHA1 c006cf3e642e1727f00177f721349930a36cd354
SHA512 bbba07b92ade75b1ca583d75e3be7c5e8bbee0479bee66af51dd8064f64568ed11bd4154f38fe8453f759aa5e6003f205da1b55df85c9d31db285055e18908c8
SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn0R+ft983Dl3gEe8xA+:d3q6sjB/R+l9EDl3VxA+
TLSH
T106D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5c0eb2c5f0dbc7e5711f08401e7d37eccda12e5525196c3d80df522db1dbd9dc
MD5 b9fe69a73101cb4906b8d32de3cf759e
SHA1 23468b1478e558b35e7131209cb2ccf313e03d3b
SHA512 1ee1c3afa9ec99262de4f01f23cc54327201c54da7db3b97e7035691eb05e76004a080d25e3159ba128bbe8a17537c115ff202a42d0054d09413b0401d74adac
SSDEEP 24576:KXYfDtczAzRPWxNs298r3OCDIjG3gE9ow+8xA+:RtcqR+ft983Dl3gEe8xA+
TLSH
T10065F12877D408F5ED6B827DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d38b79c25890d8e29b055dc3781639f7f8c77fa48aa7e9614c09ace0ce88f0ca
MD5 4c6af0b5305c5ca415807a197f3cfd44
SHA1 e0ad27e3cf5ddcff3d79a9f2750e2643a85c1c0e
SHA512 2388f9e05c5ade03757879ded74d556d8b5dc9d2b1ede3acb3b26c20a1ee557d2d52ad81742657d89ffaaf3a30d9a5e129a0b72a64a4f5d91ab996aca0412605
SSDEEP 24576:P0Le5ji0hmxxrMmRPWxNs298r3OCDIjG3gE9ow+8xA+:PPji0AjPR+ft983Dl3gEe8xA+
TLSH
T19285AE16F5788371D073C0B9C5D2A69AE97230861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7bf6b055d88f838b1ed24bf2431cc97569e7b8555282376aa8de1e5b6db70d5d
MD5 275baf5015142e573cb045cf301d96ff
SHA1 ce0254099f4217eea5fcc45199d8c9c82ccf76a9
SHA512 c3d34b36bf316a5a62890ac2259b721c8a5de986bf01756527c6bb7a2a02c3997f4504b4071af7f445d25a1ab2ca88bfa83dc939ae43f144d0bfd0c6e7cff3cd
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyuMRPWxNs298r3OCDIjG3gE9ow+8xA+:j/ezSC6vUzPveHjybR+ft983Dl3gEe8H
TLSH
T133755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e8931c0056921b1aa4206a9764991ddf792f788eb2bfa1e3a200faf8baa4b53e
MD5 191696be4d7b699312ecac4a06bfecef
SHA1 63eff223a51a3dc1c7c9f4e576b3cf1ce5201730
SHA512 f7e6b32dec0e32d4018144dc10c30b4fe3d7e5647ef1c056c9b3e3c7bb9512f129eb6c48c00676e06e5053c3f69e844e1b9d34c4ae7768781b8244c00979bfeb
SSDEEP 24576:/VbqPb88hv/l+YZRPWxNs298r3OCDIjG3gE9ow+8xA+:/VO88hXl+0R+ft983Dl3gEe8xA+
TLSH
T19D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8384bc24ddf75fe8f5bccab57a4ea8e1fa5949326871475e938bf31123e11566
MD5 6c234063bad0c8100af12fccacfee646
SHA1 628303738f8b13a04a1fdd66f7c9c669d70521d4
SHA512 8dc102d40d29dfce6162ac0285bb159f44fb8a85f97795c6555088125e1364db9b2062aa53e395734483d613dc7b9b58fb126b8bf7b7d58ac1437f1d9f0cf19e
SSDEEP 12288:KL6RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KL6RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D34523042C4C35C2DB6F81F599CAF0E2B0336D4E28F839F2D461AAA1AD7D65ED990177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4cf76896e899aa49bc58b61be30ed02641f882c8f1b0166689bd0b2d467a412b
MD5 f6043faccd965e8b943c0a1086b8f28c
SHA1 68bb3d21be7dc3f048b0ba6ab765fbcc7baf9c2b
SHA512 696c3062210a4c8e0ae9459cb0ee24397664532a4061b7f5e1b93dede25f7077b6fb18d8d5700562f3d0c93de42d4b7883babc3dfab89d7aee92c8691a1eeba3
SSDEEP 24576:SJIURRPWxNs298r3OCDIjG3gE9ow+8xA+:SJIURR+ft983Dl3gEe8xA+
TLSH
T1E165CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 68891786cbcd1dfdc74882114b1a142e3d320375a42fd473f8b69abf914f8bdb
MD5 7d07532685db7e9221cfe908037019be
SHA1 1cc09d97ac6f6f499aa9741a4fe0a828f61959e7
SHA512 9f9db2052cb2366710472cf7564969e6314daa15fa8bf4f13db8b0cd7d18e993c868b55df3241df2dd4e500f1afa3ba3cd00c72e7b3639eba4f453b35edcb754
SSDEEP 98304:hQvGAdlCEL8c/DRNw5C8R+l9EDl3VxA+:evyEYc/D3w884sDlF
TLSH
T19B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 60a11c01d72bbe398743da0b44725fc0beb9131207a5e557e9d07cb2dec8a576
MD5 7befae1eef8f97c9d42230249815b825
SHA1 cbd9016d7b78b58409edf47051a21a6898a60421
SHA512 d4adc96f230272969fe2e91f69160282cd7d0791b966f1f02d13d4c2271513135290e2d6e820a1168e73d5eb49c3cf757864d378432b1f064349af1e49f85f7a
SSDEEP 24576:40ewsAj/RPWxNs298r3OCDIjG3gE9ow+8xA+:Nlj/R+ft983Dl3gEe8xA+
TLSH
T10F75E030FE74E032C77F0DB61B26D716543D79204BA11AC3E3A88E9D59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 453c606208245036e7bee8f2863902208034e601931aaac9eaeff6e494d8934d
MD5 5b7cb5b953071ca0e914b3eea44ea567
SHA1 575ac709074cd52569fc99e21d4344cce2c2f79a
SHA512 7e6784509c422e6426e3eb8cf8df1c67c27e4e6be04bc99f95b060894595ca25cc40dc45f60847650b1ec6c445f6f573862dcb8a393a575de86ab6e32b04725c
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHn4sDlF:iUEtQevvqc2W1cpV2tI32L
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4e010bd37de9f19b4d817334a737900d22a60c4e344d6868190b102377091bf7
MD5 be08b1e99bd7c38c037e6f8e0ca6bfa5
SHA1 efcbc59259472f9e75132f566b6b3e00a5755e03
SHA512 9072c029b83a192a559c70ba9b01d3d9c14d905e8ec79c31f140b0d63e11342873c36c6b14aab79bfd822cfb8fd5d991f99b3f1db7cc4c44781c22e571888144
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/zfR+ft983Dl3gEe8xA+:YoquVjnmIR+l9EDl3VxA+
TLSH
T14DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ddfbbef3270ef0d03e1d8ba97c102eb151a718045e56cae3aafacb49a5ae8cc6
MD5 daf01b65bebe1e2b99892921a1b85ac9
SHA1 409bec278718028a4b53ce4b4381ee9d8474dbd2
SHA512 24786c13c891148599054b83117191ba955e111801db77bf01e26fa58b110f07340bcba2660cb933c28a7834cb48294ddd3076167324cd1a65ec5a0299f16eb6
SSDEEP 24576:BAhGL3IFoiwtA5l7S53oRPWxNs298r3OCDIjG3gE9ow+8xA+:BAMUFoiq54R+ft983Dl3gEe8xA+
TLSH
T15935AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8af645d6d1b26c04c78952a4499e482193ce058e7491ab30a161f4a8843f3a1a
MD5 164bba615d525fd1bb61e67653e6682a
SHA1 aba19e06f51c1d393b888586f75bc0b22f910234
SHA512 ef265fa2179c039dae7162c38a497825a1d228416158ab2c175f4ab16ca6a9cb5e9f969c265187aaf67017ec1b40941d05f2e7bf6d06549605f9652760b4859d
SSDEEP 24576:swu4OWhRPWxNs298r3OCDIjG3gE9ow+8xA+:swvOiR+ft983Dl3gEe8xA+
TLSH
T1B465F14536981CF5E96B8178C687D132F7B3BC022A65DB2F4760C65B6F37321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 eb3861e2ec3fcb1fa09e9a2893bf3392dde0baa551134c0141b7c695a3105460
MD5 51777a2be854c164e08ea6acda2bd25f
SHA1 459e8dd572c5cc156e668a3d8fb3176123831a38
SHA512 41e91d6bf8c218e2f37e638e70928c37c6fc52fc1924a819e934ef78bad87bf67d8958580eff896b13b0eedeb03dbd9a9ab06e59e3014d99416c4e1560703a84
SSDEEP 24576:3Zu+RPWxNs298r3OCDIjG3gE9ow+8xA+:vR+ft983Dl3gEe8xA+
TLSH
T1F15512493A8830F2D66B82BCCDE59141E3727C4627B553DF542086A66F37BCA9E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 42692a314277b4703b45def72b93594e40c1e983790de7dc0792ca74ff382fdb
MD5 7b2411ce70c501b80a844f2725786817
SHA1 ce49c467221ea80fb0c529ed9a6dedbf4a070456
SHA512 2125f2e95ec7144ce2cbfb29c03cffa0ca095b6a3db2cac2a932734affc9de2b75463ef77a3cb1472187eb17e3a402b680434a5816b23b8ad71ca836f4731258
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN3dR+l9EDl3VxA+:BQyiKa/X+PNt4sDlF
TLSH
T1C2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 405d813b3cb4738fae673d5bbf84eec600b3628f4b32bb48614a5d202c7104f3
MD5 60df08754bd026c83f6dccee090d6052
SHA1 c4388049175af8faf6b6148114e7820872af8824
SHA512 47063a3bb3d6d05812c1d024412b82c93bc0898c434938c4a5b665630df86a392c0af62cae39a72744e78662486a32c785244dfd544cd2f77036d03bc6b614a8
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3dR+l9EDl3VxA+:tQyiKa/X+PNt4sDlF
TLSH
T1B5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63a5ecd719b1e43216796a165efba22cb3bc0d71428b9ab283a2434c1f3e619a
MD5 c171026d0221c6f253f15e16f67f39b3
SHA1 9b9bc8dd140bd707cf30387502c215afb62a31cc
SHA512 76055f31f72f63bd05ace36aafaf1bcbd9dc6050edb7d7c3555a764bb1609c374deeef823fd656bdeb6e04a33c96e601f8a2bea065ad912bc803debe371afb89
SSDEEP 49152:L68Qg55nhceWu7PNU3/PR+ft983Dl3gEe8xA+:VthLRc/PR+l9EDl3VxA+
TLSH
T175B55933B2F60099C44DE1769F4A973196E27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a234da0a1d2de176d8774ea2a8ef50bcab462dc0d3ad42b178742f5b36282adc
MD5 3bcd7cbcbc77ece1139480192e953727
SHA1 2334ce893c26d5f1e902390c5fd38ad4e8f15ef1
SHA512 ff28738b4ff11d953b97f816897d584396d98a1283e069bb49311206ae587b3ebae65f5d6b5857973e071c819360abf65a1d18d6fcdd018722e8702e442b0ba0
SSDEEP 98304:uy5112gYy5azzVvt69nLKnhZ6R+l9EDl3VxA+:fLIHEWhQ4sDlF
TLSH
T1F4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 477d4b76c89ed81d0e134a0b5b78af8cbc6084a0066b9910efbb7bf1a0c078f4
MD5 67a8f6beaebe8af7ebaeab4dfda8d312
SHA1 ee8fd7168b2ff5c18a7caaac768ff05082fe0616
SHA512 8b77c925799cc53da302d28b816e260b73efa68d8d0caf685dbe6e26aeccfddde2834648bac9b7bfc1ddf1f377c04a9aa4d14fd1c4525a915d3b41a24fca5bcb
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDR+ft983Dl3gEe8xA+:Ru6Jmdxd2dDR+l9EDl3VxA+
TLSH
T1EED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 79d2a399c6fa080335d6569fad33a3eae7d52729b121465bb36308884e989291
MD5 3c3858159b478bf9294d6741f55a4200
SHA1 623bae59100b404904d75a21112f049d46f59a8c
SHA512 5a8715b66015f0deff0e3d4765ea732d156f7d7bed2f46e2fc89b407813e42d09cabf5a57dee3a4a841de4b792dbbe12591ad8dee277eca4742d7103cab322e1
SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4xxR+ft983Dl3gEe8xA+:7mifPWRIR+l9EDl3VxA+
TLSH
T133B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3431ab6331ac8140ea8e90316a32e191b354ffb6ed96da35b495a90eeab0e160
MD5 292363054817b511f3918d08918f176a
SHA1 6d53c419dc549f0a3e32846ce14a268beb7cf0ab
SHA512 7d105bfd4a63098eaf73bcaa311a05dc279f073c037e102244cd9e11b5a7cc60b919cfc561aeee61ca0691de37de3528c3e07e77570638f2e6a61c87ce061821
SSDEEP 49152:ySuZQIY0Be2KcRVtOnks6NMHq+R+ft983Dl3gEe8xA+:s5dKii61+R+l9EDl3VxA+
TLSH
T1B6C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65a3619987c8f00fc6946ab0022376f3a428842f3812f6eec26be1af407559bf
MD5 740bf92f2dbd09433b92ae28440d4710
SHA1 dedb37ebf6a9e092859367abfc1081bc243db5d8
SHA512 a83e99f4adece9ac8a52ac0e3e5d3aaa75103f296f98d0c5dbe9e9b8cccba9642e24af8ecef0eff52d06e99e4521f2ca4dfc65cfae10081e70da62d4c48d2b85
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5wlR+ft983Dl3gEe8xA+:tX2imphkR+l9EDl3VxA+
TLSH
T18195BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 333ec26705eccf6eb4b7b9d23e53c69e302299579937391aa2aa7ba9063c24dc
MD5 e99bb8c2986f10282c31ec134219e806
SHA1 30578f76357cb29bd2abac451d321a236379c4ed
SHA512 ae823e246660e845fc27ad157882e30d8fc4680600336f9d5697646837bc9d50e6c58022bf72f8380da17fd322ba48979619a94b226a7466d8d01335d9d52b67
SSDEEP 12288:5yRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:5yRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T18B4523043C4D25C3DA1F81F5CA86B0E2F0366D4F78F935F2E4618561AE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9a6a5642a138ad97580ee07478dd3f3f33e609b96c76638c278bda6b196489a8
MD5 83ddc00a11a020a56d1f65df80be2ea5
SHA1 078e766d47aa01b869a3c9f6427ee152e33ecf4c
SHA512 c18843bf3550cbf3253bba6f66963a45b78b37e3ded3ee15467bc762129ac98571496084eeb3a705adec509a4c808ba91866946319b8b7026929128a1b525287
SSDEEP 12288:CDRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:CDRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17B4523043C4D25C3DA1F81F59A86F0E1F0326D4F78F935F2E4618562BE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 23f99a920d6af1c50fa2a87a8cd8e38026be3f512cf9352e4c74cae2d9b9c793
MD5 25016f230ef35a05f2e4720459fdf02e
SHA1 2a64c801b6ab345aabce8444af210216db0404b8
SHA512 4140a5140ec920e5125db5d21ddd3fff08f724c979fde79798feef65bc5355f60edbb86ff651a3de413014ad250a7943d47be2be25df967fc2e533cc6a3ec844
SSDEEP 12288:YpRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:YpRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1AA4523043C4D25C3DA1F81F99A86F0E1F0326D4F78F935F2E4618561BE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 db89d3f3c48785a0ef97d672601ea32db3b3eabe3b25696c64dcb9baff7a9b81
MD5 c9fde6fc3287edbdc9e0ca9c114301ae
SHA1 0ff5e40f3aec9ab4c45b10950a8d4cf838379a7e
SHA512 eeb983cc36cb508a213f6123c466229654fc2c2ee94e4f2713fb308d6e5673af616679980681d471fa18e08324eb6cea11f7f68d97f2578c82f28598ae997adb
SSDEEP 12288:3VIRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:yRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T13C4523043D4D21C2D92FC1F9CE86E0A2F132BC8E79B527FBD41149625E7638DAD60A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ec1e5d3bfff182ee2706ef2b4147ae3a912795d19117d7cf0228864cbbe4dbfa
MD5 58c868772d1b17dda52b1d982636a31f
SHA1 712bb0f3c185c26d03e1c0b4b4ad2d97a6eb8e26
SHA512 72c280b0f3e0532c4deaac81edf8af8253e320696b4df805ff277d980956d20549e6fdda856a6465fab518f59a28186f1e2b091aacf4a25fe3c21770200be23b
SSDEEP 12288:2wRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:2wRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1F94523043C4D25C3DA1F81F9DA86F0E1F0326D4F78F935F2E4618561AE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dc5f125bcc2db5199a5ce8b4d0b782346718724f745319e8ed6c529fe15eba7e
MD5 287f9193d595b7406c5bbe47229ba756
SHA1 0ed77f9084b5f446bd3f2924b2b50343eae95fd2
SHA512 f46358667fccadaa01e2fe521a6f147415184767386eafcb6fee8b4baf0c6241b5b5f1673f8e0823bc392297796938b9e1b2f86e2f8a98070687ba667ab790f9
SSDEEP 12288:pXRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:pXRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1384523043C4D25C3DA1F81F59A86F0E1F0326D4F78F935F2E4618562AE7A75EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fb5b2ce607748b733ad106527ef8fdfccda426a3c6aeb36e88b4e582a61048f3
MD5 8f2b7abb1ab161802a6db22c6997b956
SHA1 ceeab4433d44a721a0cd8f075b94b8ae9f887b3f
SHA512 3f8f34c8e199916abfaa7f2d147dbaa40a480e9d50222ff4fb2b04e2609433592a45256a900d6591cace197b91a061babdfb56363ed92bf69091c7bf14918e1d
SSDEEP 12288:/LRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:/LRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1C84523042C4D25C3DA1F81F99A86F0E1F0326D4F78F935F2E4618561BE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2d184f5b17e0a937da6a72b67998b1b9f0455ab4aadbc6289ff910dee393bdae
MD5 0b6ecb94cbea85106c0353f5e9357193
SHA1 49694f655889883103abba0072365d86f9c41622
SHA512 f59668d07fae7b07ddceddfe065fd7b39f9806e259a5a43d5f4f8b32fbdfc91b592390587b023e843f7093fadbbac0fe4ff35c8360a906ea5df9cf5aa785f469
SSDEEP 24576:RZMRzFVSOjRPWxNs298r3OCDIjG3gE9ow+8xA+:RZMRzfHR+ft983Dl3gEe8xA+
TLSH
T1AB650194779418F0EC67817ECD569912E2B27C4A1AB0C65F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b2d4ff86fa5075896ce2531db2705962fc76e8d1018b0709037b3bee6d87899c
MD5 fad1c117d58062b28f5e3b23598c41ed
SHA1 8bb317c907b3db91f6d71927ae23dfba57805274
SHA512 b4d51275173ff1507fa20b19afda6a29ec23d30a4d0ea628f4ba2b26c0d6ed5bd0d144eeb8a7166624a641247e447eb63c081e6b9027235a907f594b029532f5
SSDEEP 12288:ruRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:ruRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D44523043C4D25C3DB1F81F99A86B0E1F0366D4F78F935F2E4618561AE7A74EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c1735952e5a43909859ca5c8966a550ef4dc7974efea608bece074093a2db6f0
MD5 7554f611520c05b0cb300c8bd8c4fcec
SHA1 c7429799f8e8829656c41d4227c15ce2039645d9
SHA512 68d8b2f0ddbbe8c745406c9fca0b17b1a0d8bc881ac9d1c927add2c70768edf9cac459c18508cf4e51d3679f00842e9407e64ffc5a7ba68fb8471ca8c22dcea6
SSDEEP 12288:KqRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KqRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1F94523043C4D25C3DA1F81F98A86B0E1F0366D4F78F935F2E4618561BE7A75EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 61d39b14d9550e4b41f966c4784e0e1bac383923588accb36755f74172f103fd
MD5 8c2ccedce25a7dc7c3f760efacac6bf0
SHA1 521f6ba4ec3b661562ed3b4bfd4cbe1ddafc54e1
SHA512 f2696dae7d5b048dd3666a4b189308bab9d909bf4105cf96103caf8bbd16390ee8c61485fa0e95a691fd93008cf0a5b2be2383d1fcf6208415c5254e5471a6bc
SSDEEP 24576:RzyvRPWxNs298r3OCDIjG3gE9ow+8xA+:RkR+ft983Dl3gEe8xA+
TLSH
T1655502073A9930F5D13B8278C8921952F372BC361B749AEF526046722F373959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 463ef8130b81674b3dbc85bcbe1932ef786876df8367863caaa42620eb602ded
MD5 044f3a8625e5d7f3ce3062ef67a95dbb
SHA1 6b1507812a23014df153384a3f7ab5e165e7f523
SHA512 19a792b151849d251c9bc2a7c354b12a38799e105101dbc33e41331f6fd9d9ce7593ba5d35545fcf8869847318ad7525140f5fbc8bdc6349d467b0d3d8f6bf43
SSDEEP 12288:EuRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:EuRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1EA4523043C4D25C3DB1F81F98A86B1E1F0366D4F78F935F2E4618561BE7A74EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 41907b39dddc895138a416549ddc9507028cbfd2fdba7f4fa61f45b9de9183f9
MD5 b554035581cabe805d251dfb75de86ce
SHA1 173c303b60f0efcf21793bdb4a7b9e56d13b2498
SHA512 e08ff4455b7ab0379036d5631b5deff4f5dd33071a5bf3a79982d0cee1fc5cf5001975a89424b1d7996e8c6e6c007e8d6b881efe1660ac1909b46f7b47e260cb
SSDEEP 12288:WuRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:WuRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1A24523043C4D25C3DB1F81F99A86B0E1F0366D4F78F935F2E4618561BE7A74EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 930793aa2cf10086dcb441c16657e103b2a4fce42e9c39c80d633936f75d6a57
MD5 38119f1b41ae603394ee7c93eadfebce
SHA1 7e8682b6443c6f67daeb371901ad446585414876
SHA512 930a44f23bd887cf27673a7fa6206056fa12d71981ee742eee8f7dfdcede4776bda08f2efd6fb0a991a0a64f3a3b0b82010fa1f43a014ecc7ffe759c642c9fbd
SSDEEP 24576:DzyvRPWxNs298r3OCDIjG3gE9ow+8xA+:DkR+ft983Dl3gEe8xA+
TLSH
T1335512073A9930F5D13B8278C8921952F372BC361B749AEF526046722F373959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7e30531783d309e8c4dc43610d480f7d1265966b7c2ffc05492fd0ed96f3efb3
MD5 3741a16c9750c6da41859aee38a30e51
SHA1 cb46baf2b7a29cc09c794b8766f2ab2c6e7d3c3a
SHA512 0010e0280a0b14c2d1ba9a4f0f2776c4e3d2270aefa55cd976a01278c85143c8eb640f788b843e4ce39aabf69bd8e2931e4428b8e2e21df2a71210c31114ccbc
SSDEEP 24576:STDaLl3z0zD5RPWxNs298r3OCDIjG3gE9ow+8xA+:STuLljMR+ft983Dl3gEe8xA+
TLSH
T15D650194775418F4EC6B817ECD568912E2B27C5A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 70ee70daae3a74265bdcc140a0ad26443bef4e10ff33dbbdcb3706293313cd84
MD5 8fc8c7f46cd4a34769f2995a8281bc37
SHA1 e97f3fe66fdae69a008c7231682a4dfdea46dc13
SHA512 93ad1c9a732858bdec6099daff40d05e97a592be3d21d7909eb5f1cf1f6becb117e5cad18396b856eee3ca7a458701dc0751a5b97a1340ba2dc09680ad1fcd1e
SSDEEP 24576:G3vd9CHKy7GZ9RPWxNs298r3OCDIjG3gE9ow+8xA+:ovd9CHKyaHR+ft983Dl3gEe8xA+
TLSH
T15075CF90B7E810E4F0B78A75CD669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fb63c413e15f11769c736ea7626fb1471f51da6cbb0a68a4b5c76c41594d22fa
MD5 88db1b255d90d37e4bf5987b47f7404b
SHA1 ad00c6ced226549a202f9eeb1f3d7b093b709316
SHA512 f18b549e8a5c1dc4c7aff45c38c12270e84e70431cb1603083f2fe5d6aa710744707049f4cd21a59f71bcf4e53b070c08efc2e8988f0e02c146cdd3f7236ada0
SSDEEP 12288:vJRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:vJRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1044523043C4D25C3DA1F81F9DA86F0E1F0326D4F78F935F2E4618561AE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c7784812b7ec4f2a9710e8e6cec0943ab05c5236cca9eab1cbf6abfcf9f5e966
MD5 2af6240e6b59b89a053076c2f44bb275
SHA1 613945f6424dabe30664e18ce5ae180f67cb1fa9
SHA512 22d5f0536a5cb71d8fa1951f9b90b9c2b3aa06543aab9230811372fbb42deefaa8111a8b6fd613dbcfcc4a1c74c15972eee993137ff739de7d4dc83d5d0b169f
SSDEEP 12288:MPRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:MPRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1774523043C4D25C3DA1F81F99A8AF1E1F0326D4F78F935F2E4618561AE7A74EA98047B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a37a538393bebeb0997d40c558d1806d978180dca78e3d0f98c0f001a62580fd
MD5 259923d362bc445cf510da08390ac25b
SHA1 526ad34b2cdc2c426a1a9d89e0463fc7354b2e28
SHA512 d5588fbbe41de83a05a6b97a279e93bea5ee99caeb939a1bfcea4a1a1ca790a749d41f3e7ef2118906118434f2f727e0e26ea0ee4f0e6584f84895d0a70380cc
SSDEEP 12288:oURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:oURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1AB4523043C4D25C3DA1F81F98A86B0E1F0366D4F78F935F2E4528561BE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2aee20b6414f7f099361459c7e51c02076de15cf492b30fc8095d43d8bca8678
MD5 cad4ceae323fc6d4cba1bb958156f68a
SHA1 d40aa4b847d219d3dce39fbdc6e5283a740e0aea
SHA512 c35634190a7adcf8e7596219c1d40218ee8d8b0d9d006c77741d88c7e9323266075f49f11ca0dac92062a486420f7da88e77c06f3c0994852c2e8a66809da686
SSDEEP 12288:MuRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:MuRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T12D4523043C4D25C3DB1F81F98A86B0E1F0366D4F38F935F2E4618561BE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5a113ba1d8793ce33bf12ed4821d44428408cd6825acff7eafb4dfa2ee9731b7
MD5 e9edbd9c60ec21c200ec266e61e8c99c
SHA1 ebfc3cbab3a68e63d3f5b1514ba744d5fdffae94
SHA512 2f34ec093e3b0ea1c96ba73b2fb95d836adf3701a8c2ace4c49fcee5de403b120037878c7906c4c3f1353fc372f1b4eec227b2847fc0ed7cba20142894f89817
SSDEEP 12288:hJRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:hJRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1CA4523043C4D25C3DA1F81F99A86B0E1F0326D4F78F935F2E4618561AE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 84969a22d9db671deaccdd363749af6423bc1f2da15df81bec670fb9378c3901
MD5 2d703f737d5a5b4e29d879d99c7ab077
SHA1 c51776ac68525f45d66e767016f276e951accaa5
SHA512 73a0910f9f91ba64ab9c39ff25df7086719d671ff251389ed81598ea431fd229b1a9fdf122969dd84da84c763ce73e4854faf1f674352d83dcc4a3a29bed8189
SSDEEP 12288:q2RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:q2RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1664523043C4D25C3DA1F81F9DA86F0E1F0366D4F78FA35F2E4618561AE7A74EA98047A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ee4464d14166b726e4d9ebedc4c7b692f4d15160ebad9bcb084b7c8f2e7cb09d
MD5 b9dcef880a763a0d41094a4071a2f2ff
SHA1 9fb0e1547ca6a0e0570c0ba0c58c4a3a86d0d429
SHA512 88dc313fa8fbfa94050b013212f950b07376821df2cb081939dda766484dbad43a760ca4a95f1e2bc137812bb988c7a26ef19b472a039c5f5cbd0dd8127af98d
SSDEEP 12288:6wRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:6wRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T19C4523043C4D25C3DA1F81F9DA86F0E1F0326D4F78F935F2E4618561AE7A75EA9804BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 22d1947b1302cee2527b0aa3ed3cc8ff85cc7d33525bb749d8abd164f3838c67
MD5 4acb15159a3c8836d006f0bce630a0be
SHA1 c50bf8a3d2ed8dd70520eb923b0841da387dbd07
SHA512 c347298d383ba4437ab952ee6773cf8e0adc7574e8b7e172c847ab8cd07497cb13fdf8e06bf66ebbbbbc31b0e8cd4fd779b6bea55f35c4940710f61f971e3d5d
SSDEEP 24576:4fwvUk9RX6wkyAIaRPWxNs298r3OCDIjG3gE9ow+8xA+:sMnYIaR+ft983Dl3gEe8xA+
TLSH
T1BB85DF29EFDC04E1E177927C89A7460AF2B178591B31C6CF029653AD0E37ED4AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 45843bbcb5e662023d29fcdccaa1a1cf67c2042076c2e83ba277e3e29e3d09b5
MD5 d518f4a9c8f902c26f8fa99408f8e5f9
SHA1 748d5d56d9f51628df77c3875c65aee466de9909
SHA512 7249a552f41756309892a0b6a7ecf45b14aecb34a193eca3334d3b7ba54c0bb887746ec95389596f00cbfda74859f9e84bf12c1bf04e0dbf7aeb928912290c06
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FR+ft983Dl3gI:RySzP9R+l9EDl3VxA+
TLSH
T1BF066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2fe4c9ade2f77becb3e4beaade7368ca2f17497003108c71fff1242ac54b2cc9
MD5 689cb13ac223b49b18242ed507e93295
SHA1 9a417a73bd9fe52aa7c8acb30bcea985c7598aa7
SHA512 16d8482f59d4759ec1b39ba1f26103ee4452b9c5933ca10a8c2c5eb83f5fa2c1d5d115874b545922461203ed2db6acdb9241d41297d47a2be42ca0c69759a086
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTRPWxNs298r3OCDIjG3gE9ow+8xA+:n47JUQjTirIhCnDHUPfF/1R+ft983Dl1
TLSH
T17A65AE1DA3EC01D5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 48f1e5598e05195977a2be2420d8bcedef50c7ae986e97acba343ee3a818e312
MD5 8f067088e76a995c7ab0aede91392321
SHA1 78dabf7e7a9e8e7c58addad14265362d05064266
SHA512 dc344ce4349e5bba014848d2c997dac5e5fd8001ef393513adc2cf66f45f60e6daf19b127fb81ce3bb8236a26c80a50373667f7fca7ea4fbee634b9eaf3fd2db
SSDEEP 12288:zbsf+RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:G+RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1C3550109D68812D1C06EA1B9CB469681F3337C1A97F1A3CB92D0F53E1F7A6849DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 97ace86529daf54ca208a0e4058b70b724197fe9ad17881b6c21b94d4ee2a64b
MD5 10cbca46ca78a06da17caa5350702576
SHA1 92190f07128821bc7c0b68ad229c51f9b04f4a25
SHA512 fcd7861bab49ec761d783f1e6b1c320c52cc5aa1d8a6422f673091fe99eb9495e372dbd550ad620b2986ed045c615a2ffc2304948a85f4047d373393defea862
SSDEEP 12288:HiJ+d6gFRU3fR4y2Jbwec45yZ7uvbODNKtlSNGsRNzH:Hiod6KRUPCyAf12uvbiNKtoNGsRN
TLSH
T193450700B626D78FC6A940321E36D6CCA770BD41EE046F1773C9873FD476659BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 aaa4ec8a0a886427c585971dee874f4aabc99509237212980c4274fde3f4fbb8
MD5 d4953e01e648aefe036d729864c43b1e
SHA1 5b70774a592fcb23bc4a7c627ec88f26eac05ab0
SHA512 a73c0f1eee969f02b5af8db505bc323dac6241433d314287143957df561930f9065b0acdb9a59ea73bb52d8dabf33f2a086a4d9906ac4ca1dc7d6ddeed2077d0
SSDEEP 24576:Q+SQjawlz/G8LA27jHHBx7iZoLB33MtLH:Qkjawlz/rA27r7iZW3cl
TLSH
T1FC550901F5A3E34FC97A5037463286CDAB78AC13BB452F057385893C886775EB6E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3328a35171379668052e972f076abd9019fa1ec019eb20de6d7f2b289b218d5f
MD5 67bd38e28c5a9f83c12ae6d90b41d3f7
SHA1 9bd9df733c945fe448fa4b4227a54f2099f5ca92
SHA512 796d8cf07de5d880d710a6d00122eab718820d9adaa2c78b3979b2b957b9f7b8644a4b04cfb7c3d0e6b7ef2dfac768492d85af9c36eb27f66f73186c03ecec78
SSDEEP 12288:607cRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:7cRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1E84523002D4C29C2EA3F81F4998AE071B0277D4E2FE465F3E41196A1AD797CDDDB052B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7178fdf5ad7f0b2391fd63b165a0973c445882fd4f85405d365fd9e983c97d17
MD5 330255c6dec8a37ac5a4d0dd51208572
SHA1 65ba1ec5b4c0b3922645ccb8bc2dcd750b6b5203
SHA512 dcd7739dc5149adfac65690e93bd3c7ed9508a9ccb1c8bfc2bd2ecdfca1a1343e31aa4706e94639ab7c9b7b7b4001664c703db3da26353ba7d39b8beea22a8ed
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYMRPWxNs298r3OCDIjG3gE9ow+8xA+:ogb4mBIBhGFTR+ft983Dl3gEe8xA+
TLSH
T1A465AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b866ec0be114c70f88bfff86d0105fc13be4069c68cb1e413cf3b789522bf96a
MD5 51515d706ec7b8212717229772f64f9b
SHA1 85d38ca24e4a567d4cdcc4ce6e3dd7d1799e25ee
SHA512 0170659b1ef8ad3c5dddbd5e679df5a2270ccd3d6f80501282139b413d9e4148b527cd3793ca3db4cd63de718e88f171cfb2f30b0657701e03cd134b984b823b
SSDEEP 24576:/G88u8FpJqH1bzria7/mjRPWxNs298r3OCDIjG3gE9ow+8xA+:O7ZFPqVea7/0R+ft983Dl3gEe8xA+
TLSH
T1058501257AE401F1D47BD1388A824663F6B2B8151374EFEF06A88B511F23BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7205fa834a24d8d68929a48d7b2294f8ca6ecaed93210ddcabf97dde3840cb72
MD5 08a833853f762ba6015f33aa9423414a
SHA1 3d5584a801ecda1c367db44eeb7a1b50e64d7f8a
SHA512 6b1d774a7c896153a955bf0b1b8f9144bd70e33c971b6e0362fe3d8235fb15cb42c0dafde9a447eeb2e461a7b4ddafafc7a9bf4abc9141a31cef1926c08f5260
SSDEEP 24576:OPUr+NQ1RPWxNs298r3OCDIjG3gE9ow+8xA+:OJQ1R+ft983Dl3gEe8xA+
TLSH
T19165F11F269C18E1E67BE17D89828219F372B8521711A2DF01E0817E5F77ED8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1bb21b77e11cee08ae316782f0353992794c6ee582e9bb8a6ba22d43704b3e46
MD5 ac5b211a367df598e57416d8dc2476ae
SHA1 e9148f114c8f1ba0395c8d37de6479b0b3385de9
SHA512 67fde6bb3c7e3d3050455f4f74f33df4be9ac81a4988343a82200bf2877d7d6e5acad317032879eef20c32793f836f85a4649d04d38cf35ca5863690b840d1bb
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXR+ft983Dl3gEe8xF:pG05lO43biR+l9EDl3VxA+
TLSH
T1FBD5CF6E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 85f0ed2776e77dcce292f4c3f48fe96f4b93650d35b09d1a7e33eaba57be6a99
MD5 b3d35125ab9113fa14470c9e6019d265
SHA1 e2215ebebe7af16d4f4642085d469ad9335c4bc9
SHA512 973230c0a86bf1a119c57f08235ecf870ab585f488ebc0bd23784dcad773cde2f355195d6baf4ff87a82c2c178a28735c26d499e3bc773b9cf3bf75e2e0c1343
SSDEEP 24576:Vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFRPWxNs298r3OCDIjG3gE9ow+8xF:1a5POZ3BJt2pasx2+mPR+ft983Dl3gE9
TLSH
T16465BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55f5e361b161f25b20b8d930613e7254b6c769d8607e214fb6345b218d520b12
MD5 5de2fd5d30b5990701b4449ef35ae204
SHA1 c1b8a1f4809b4e39a5c95b3acb50c81521b67f54
SHA512 97659d3ba9b1a360b0ac70557728d05da7046f9cf850d3dd2c325ae50775260ed7009749523a35bd5baea9e7d1f69dba1683f5e2baf361b2e9969ab0dce45466
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkbRPWxNs298r3OCDIjG3gE9ow+8xA+:/Nc/zEOVHFUR+ft983Dl3gEe8xA+
TLSH
T1F0858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fa8b29c01de2f8224b04b205746ef5e22fef2f178b1e3abbc631bde9555074c4
MD5 fb96b220bfa9b5494517b5cc23a44245
SHA1 9d5beb89bc9de058a4bb9f7c09ba69b471fda235
SHA512 db517c8e5762358ad1efd30065741b3fb1e284fbcaafa4375297084bd938b07080a10b111a49a935dc150f2db4917d17ce740bd93942474e9ce4ad55e94ab6ac
SSDEEP 24576:NTkNvNnaFeYhJNtmZBmHRPWxNs298r3OCDIjG3gE9ow+8xA+:NTMwBtOmHR+ft983Dl3gEe8xA+
TLSH
T19A55AF2EBAA806E0D1FEC6B5CD238512F6727851173253CB9290C13F4E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 185dee1eb849d94adffea9a05ce6ec5f19b66e50fe294b3b6485ca4b3e91d750
MD5 efd27f0440618bb968e290d8d59d3357
SHA1 98b940e1ded9df0f8da9f0964475b042bbf0e52f
SHA512 f84ca307db011a16af33ccc4daff0e591ae09cb2ca88e3a36f5bb8a944428d73a118d6642abf19886696d529e59db73ea076e1f156d945e1b580559a371631c3
SSDEEP 24576:wD3FHshBIYQgASRPWxNs298r3OCDIjG3gE9ow+8xA+:wDVHeBIAASR+ft983Dl3gEe8xA+
TLSH
T12D75E03DEA9C04E1E57BD1BCDA538606E67238AD033266DB019081B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1296-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1296-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1296-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1296-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1296-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1456-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1456-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1456-311-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1456-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1456-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1456-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1676-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1676-293-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1676-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1676-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1832-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1832-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1832-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1832-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2212-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2212-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2212-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2212-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2212-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3196-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3196-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3196-119-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3196-113-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3336-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3336-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3336-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3336-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3336-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3336-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3896-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3896-307-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4784-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4784-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4784-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4784-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4784-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5072-7-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5072-0-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5072-78-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5072-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5072-8-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/5412-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5412-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5412-21-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5412-22-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5412-15-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5616-278-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5616-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5616-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5616-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download