2374583763d134c117926d532b8c4bfaeb3bc9e9c96cd0f99437cb95995c203e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260709-vp9nxae16y
SHA256 2374583763d134c117926d532b8c4bfaeb3bc9e9c96cd0f99437cb95995c203e
MD5 73d37b21b93f53d87c25669b5b424646
SHA1 b79e887cc1cc029b4c72ecc58876193531bc1170
SHA512 5c5237c7fd3930f768c4ea33143ce6eec928e0920ffb64eec17d7e60619cb0e4c8d7e8ef3b481f62bd30bc9e7a412879f74e810c8bc866690e6b2ef38102ebd1
SSDEEP 24576:s2LhQvk97I2tBH7353+xRM+l41dA3H6NX/Iv:skh4ktI2td735uHMMMAX6N0
TLSH
T1C175CF0277E405A8F5F7A63899F69222EA737C855B34C65F0398415A1FB3F80DD39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5992	elevation_service.exe
3960	elevation_service.exe
1060	maintenanceservice.exe
4196	OSE.EXE
860	PerceptionSimulationService.exe
2800	perfhost.exe
4080	ReFsDedupSvc.exe
3024	SensorDataService.exe
124	ssh-agent.exe
2512	AgentService.exe
3452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c9688076ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a968943bc60fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d9ba43bc60fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089c62ff8c50fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074d74ff9c50fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4d000fbc50fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ac075fcc50fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b84c9f3bc60fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000549b863bc60fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000703abcf8c50fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9177ef8c50fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfdeb1f8c50fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
3960	elevation_service.exe
3960	elevation_service.exe
3960	elevation_service.exe
3960	elevation_service.exe
3960	elevation_service.exe
3960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4924	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	5992	elevation_service.exe
Token: SeBackupPrivilege	4080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4080	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2512	AgentService.exe
Token: 33	3452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeDebugPrivilege	5992	elevation_service.exe
Token: SeDebugPrivilege	3960	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 5980	4924	2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3452 wrote to memory of 6132	3452	SearchIndexer.exe	102
PID 3452 wrote to memory of 460	3452	SearchIndexer.exe	103
PID 3452 wrote to memory of 3760	3452	SearchIndexer.exe	104
PID 3452 wrote to memory of 5492	3452	SearchIndexer.exe	105
PID 3452 wrote to memory of 2952	3452	SearchIndexer.exe	107
PID 3452 wrote to memory of 4264	3452	SearchIndexer.exe	108
PID 3452 wrote to memory of 1956	3452	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-09_73d37b21b93f53d87c25669b5b424646_cobalt-strike_icedid_njrat_satacom_vidar.exe" uninstall
  2⤵
  PID:5980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1060

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 74d427d91f75673239f9cf7acb490462a4fab50e6f9657f2964fba2e8d84e5e0
MD5 6b9821f57fe36b05dc6efeda4bfefcae
SHA1 59093b8cca5dd3a5b39654775b47ae513556e26e
SHA512 86c1472720a2f2dadf5518d573d9bc95113f8d31961fd947a25c8b526f2bdec331b73cdef7cf01333343be7137b6046f5ef71b44ecb329d6ce413656b09c0acb
SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsI2td735uHMMMAX6N0:B3q6mjBzISSX6
TLSH
T193D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e00202a9638c4a02700e946084f6307559d54b5d83245e0cc916e1bd74d6d54b
MD5 1a33f3dbee0446c5c9d97a2431b6cda3
SHA1 cc9fa5c8eb5111e265c619fc4f6cbe616d7c2f11
SHA512 f5d6bd8d47231f44774a9adc00e370c1388130e69b736afd7751ffdd7d93391af94df98132fdc1dfb59b6bb24820127c995909aa61b2334fed2abb78bbeccb36
SSDEEP 24576:KXYfDtczA3I2tBH7353+xRM+l41dA3H6NX/Iv:RtcSI2td735uHMMMAX6N0
TLSH
T107750169B7D408F5ED678178CDA2C601E6727C958350E39B03E49A651F333C86E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5ebe44b59fad87ede893cfacae7b721c0ee6d3f62e61ae0ca9e7c765a562f4ae
MD5 53ba33b190d6d371225349c5e4efe801
SHA1 4a1c59bf80025979e8951d0c2943ff8ad0e20f3c
SHA512 4e655b0b729839c8fb0631ce2e388545e000e40aaf813b452882a703fd1bdf72a5332ec5667927d515156f43caec0c0a70398e027237f7b6928c7b820f59086e
SSDEEP 24576:N0Le5ji0hmxhrMkI2tBH7353+xRM+l41dA3H6NX/Iv:NPji0AzpI2td735uHMMMAX6N0
TLSH
T137859E66F6748331D073C0B9C5D2A78AE971308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8535e28dfa5ee124df25b0e16d0c8c494048d60691a4c820fb09367e37ac0bbd
MD5 38f682e1c22df565a4126d1c31cc374f
SHA1 12166c97991091a3f2278330afce5e9f119a2807
SHA512 d1cb073c609826eabcaabcf354cc5d33192af67ceba7f662b75f229e610e594fabae66f1d6f3d9d6775ff6298aa47ac8404264faa38733b8e88f01e8bf476c9c
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWj6q8wyuCI2tBH7353+xRM+l41dA3H6NX/Iv:g/ezSC6vUzPv+HjydI2td735uHMMMAXz
TLSH
T12B755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8adebd01c7be8ae332eea56a52093d3d9470a1a1b122dea50bd0de71a6179255
MD5 08d2252afe1d182dec0a430e69d62e15
SHA1 f71d5c8294903d564dba9f787a84dc36cc608665
SHA512 c4cfb5457fb07f40c09ab91431d75f400189a767937e22442a1924ed8386ecb0db36ae5fce2669f8c014d0a9b98c93768bce0c33ad1311a8dc0aaab0eab18cac
SSDEEP 24576:8VbqPb88hv/l+BjI2tBH7353+xRM+l41dA3H6NX/Iv:8VO88hXl+JI2td735uHMMMAX6N0
TLSH
T17455AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6519658bf7ab5ec19fff9e101b9ad3790f59fde919799d7c353fbe324ff22dc0
MD5 2d1562d1ce77bf1c8b7f7cd64bf5dd40
SHA1 6d37bc7665734ec8cccd014bc0f44fbcbf66d2dd
SHA512 e39dc521d7e1d9895dd3507bb3c703e722da6be95c99e07277b316ede621cf7d735608007d055faccd2b7acbf23ef6dd25b8427b70543122bc5155525862cdf4
SSDEEP 12288:fGgUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:fGgI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T17B5523EBBB8884D2E3160471AA76DF85F5981CD4F200A02617E47BC5B63D589FC4E1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 43ee8ca3555c8e55b8dd0147b7c82e7acfc9c76c16623969e9b5c7d1291b542a
MD5 f2f620366c716a369dba34e2d5d9d82a
SHA1 2077e306e40f97ee2a8fca39d181bf4a3b4fcfa4
SHA512 ff37ebd2d3bab054146ee7215717601687e058f1758de4478591845c6acea7ff2554f4e40f1df40b0309be2282a999ebbbe4cf88475c887c12de1b24345297cb
SSDEEP 24576:JJIU7I2tBH7353+xRM+l41dA3H6NX/Iv:JJIU7I2td735uHMMMAX6N0
TLSH
T1BF75CF7BEE28ECD2C27A4CB95A91C740E76278708B11A3CBD175830EDE235D45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e68835e21661fe6ea83fbeba2e4a516e8f548d9762f9c852145ba20339794ff
MD5 08054f782f4e3a61039fb0049fe05afe
SHA1 d8fa08cf2f335681f9640efec4fab412d76232fb
SHA512 0126d67158b3ad3b7ac31438e8917e0a58069b342c669c6daf7bb2e78443655cb5894ebdd6e756a2115f3ea83a3e6d593d2e4b4f5ba5a26d8186fa16948baf5b
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THC:QQvGAdlCEL8c/WRNw5CyISSX6
TLSH
T191267D656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fe1e6d006e411596e98c7761b81c78701b177817865521b9a29aed57f59fc3d4
MD5 17f3810ede84e061ad558725edd08874
SHA1 511ce28d3f725127059a4d258909ae796cc7d8fb
SHA512 8ca508eb2ccb95304552122f3d3f4dce41a542077cf0b9152fde61131f1d12fead8c956ca19608ae2be8f6e558fca053b7b478744ccc822f2f0201931750a2cb
SSDEEP 24576:+fewsAjZI2tBH7353+xRM+l41dA3H6NX/Iv:cljZI2td735uHMMMAX6N0
TLSH
T1BC75E071FE74D432C37B0CB21B36C716646C79608B5119C3E3E89E8E59342D2677AA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1138f0cab24e1c5a0f58a51ab01b381024a43a8206dbf7cd2066330d11ade6c6
MD5 3b3739f3507548bef61eef7f44694709
SHA1 9411c9534af408b791a8c852be46e3aebc211f23
SHA512 6a922fe1fa3e2d34a599180180ac75ff0653f224bdc91aed16f49b9ed96c668951d571bb012325079fc6f35759ae78d0734d56ae1e1f03342b5f322705d32b08
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHBBS:nUEtQevvqc2W1cpV20I32v
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 61d3448c8465d95881d7f4ee13b3f42262d93ba17a4d66b557574610f3c51737
MD5 0d842b14e0a4aa9f9dae2b563dc76396
SHA1 d920ce7f8f6996320e801e176ac13a6a2ffb8947
SHA512 8b08e3d0ac936350e0ca0ab3faf13882c78a1eae16e9f195e8b5dfdc49431913413a913086524901fd71094925e18b8fc950578eb9a8d09a1c8247224bc447a8
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/z5I2td735uHMMMAX6N0:boqtVjnmGISSX6
TLSH
T1A5D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c9310327e9af7f4ae698addf1815f35e5c94e25a06020f0a5471d31a2e9f5253
MD5 42bce6b71094f62c438b172b0c2f3874
SHA1 c115eec93a2ae5c618fc3434713c223a754343cc
SHA512 7e74a1d5b60965d769a5128843077186807bce3ae549e6604dc3e3d630c490a0ec24d79a2c93320ab09177cb3a8f271fde2756c6724b282dae356da975af6aa3
SSDEEP 24576:FAhGL6IFoiwtA5l7S53mI2tBH7353+xRM+l41dA3H6NX/Iv:FAM5Foiq52I2td735uHMMMAX6N0
TLSH
T1D6359D81EBF945D4F5B39AB899B68571EA76BCA55E31C20F2160D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b7afefbc2282a193922a59526875aa74e19bf0ae03bf479ea2462489e22933ec
MD5 3eec05468b68d8eb6f629ccdda52ea75
SHA1 4bee0fdf2a4657d83357c88ce1cd0ce28e58d04d
SHA512 67a9ab6b5eb2f75e2755baf97d7ee1fb001b9e789a0a34b64e2f96cd45d1eaae5612fbc01ec3c82fcc5b718df157452b4343106d489d8f32eb82078a9525d651
SSDEEP 24576:ZwuROW9I2tBH7353+xRM+l41dA3H6NX/Iv:ZwSO6I2td735uHMMMAX6N0
TLSH
T17A65F08A77A80CF9E66781398657C636F7F2BC012621D71F13A0C65B6F37251AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a93b3a45ebb973a7ce9db02e8944cd347269fcd91f963022798f47934d1fe83d
MD5 cb93946c7391567250092e77381b1fa5
SHA1 a7b380d56740345f222e7142a1e64cdf9c10790c
SHA512 e41cd6a73b0c5d39b00c28e6ce14d8f7ef4f063e2260b719ab947398215b803caa0114cce2f6789b1d137264a6ad81e0a4d5e5d5850eae2be459a1d6cf8fcb2c
SSDEEP 12288:DyZ1IyJUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:OZucI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1F655129B37D460F1E2634079C9E18B45E7A13896A32153CF12A4479A6F37AC5AD3E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8172eee70bf198e585e5b570cb1dcb76e1514d1dd106f053f9c610b914b6cff6
MD5 0d6b14b904d0b36e9a59bb9c9273ec4f
SHA1 a9df20d0c458ed070c8bebb12ff022707f22b4ad
SHA512 39c99b7794202049bd2c619f241dbd39998c2ec3d7a38e3a9fc59de1ed3c414167fdd17b7b9d06140104cae5841a1970d2ce59b77d188ff68907af7b017d9545
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UO:2QRQyi36YOcPDLvw2gAf+PN3PISSX6
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 afbf42bd5f089015381239c8bba4c0373ea7d20515225bfc06771c5cdfc8a917
MD5 94a3b20e504afe1fe62c5cf87248367d
SHA1 77749c1abc172e9bfc8a68bf0766f213e822e33b
SHA512 6388c1a04524e78489a69691a15b7b08b9b2cf715a97d4a84f7a931c2d42e4ba7cf3c69741cffa2cf772933bfb4af9b77902d63e66397c0fd797a0a0d6e8b5f3
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UO:6QRQyi36YOcPDLvw2gAf+PN3PISSX6
TLSH
T123667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 da02b56def684c709443f905887f002476865883b60f869cade027a892405b01
MD5 cbffbc9eab59d1dbc2b47c72671565ae
SHA1 802f24b09fd9ac6f23554d881f6e0b283dfc76ab
SHA512 03763d3c75cb764c14fe4bc059ec9f0fd52cca3153b2f3e5f41cb849eff57bee2b5ede6955b1d4a5865b728ff7b5bc8f1d80567a60ea88323280cc9a5b7fcba5
SSDEEP 49152:168Qg55nhkeWu7PNU3/pI2td735uHMMMAX6N0:DthTRc/pISSX6
TLSH
T189B55933B2F600A9C44DE1769F4A872196D17C75CFE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4d9bce994b8c435954fa5c20ebfdbede1c6fa6571fd241182943b9dbd35ba803
MD5 b24ecc1ee36dc97f2af4e9b47b6cf19a
SHA1 194cb80c03d3ec4069b6f3b0a619d4d75e5fc7fa
SHA512 1264480ee3541e1b9b0f2dc5e8f9c4aaf3b9e67c7958c859805b484df7772ac8cec18cc01f9646092be1d6fabee8112e3b0a49f3a6dad00d8c1952c4ee8d6507
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99k:Gy5112gYy5azzVvU69nLKnhZgISSX6
TLSH
T114167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5db1a8891dcbf00f503808488e7014deafef5bb2eb711f41c1317fd0f2ba2a81
MD5 ba3128f425d2666407801b3d7772e812
SHA1 73e21964dd7f2c3d7034381fc7067a6776fe747b
SHA512 b260dfcd940426e60e8451e61039be740b9e1f21fc6a2120d69678ddbeb5bd34ed057291e794c81fb91da7fb3ea179f7ab7dad756ab28da88981b93bb1ed4489
SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glVI2td735uHMMMAX6N0:zu6JmIxd2dVISSX6
TLSH
T11DD59D13F1D901E8D05AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 817c646800a9590c3d6acb992617538a463f6417c90f820dcdd6f8eb251a7b6c
MD5 17a92c5fbc53af1e9ce295fbdee72549
SHA1 b8144e0cfd1e99bffce9a3be4e162aff894f19fb
SHA512 f3035ae7d4809a17c78c4435408d28f360025adae6ab1a4beef7665c47de6f7fe6d2fd8753335278a622514fc585371baafbb8d59319f5599e5e30056809bc88
SSDEEP 49152:r1hpsNoJpF1A67U44CwH7R4xbI2td735uHMMMAX6N0:rmifPqRGISSX6
TLSH
T1FAB5BE13F2D901E8D05EC17887569632EA62BC450B20B6DF0A90B7962F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2a57814286ced856916ea3a73dbf4d44e8ee53a166c57a6db32491ed0c7672fa
MD5 c3211b9257945d4ea3ffe4db87d4a396
SHA1 b0dd50f1d63f346b3f9b996293c1bc5bff681cc9
SHA512 372ed5c698633e2398c4392b6f8a49c3b3b49d1abe17ff7b9ecb4533b93ab23d19f043bd8a814433bd23f5866ea78f63b53ebd6bbdaab2725c2e69b12b26f12e
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqcI2td735uHMMMAX6N0:P5dKqi61cISSX6
TLSH
T144C5BF13F2E940E8E0BED67487669632EA72BC464B34A6DF064072551E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4406dba4aa4851d20803457da538a26cc1cbbab97956f27ac17ac7da5f54000f
MD5 a85128834f2c959467a39f413d230dba
SHA1 afd10305774ecfb89e8c7c7042c0b58144856640
SHA512 981ca166b420aace75168c00de8d09f275564514df759a301e6167d7b5b747745bfd7c097269cf2babc10410b91a7e6d761ee0bfdeaaa3f571261ed8428d3ddc
SSDEEP 49152:yhtSn8EApI0figjgiDn0AP5w3I2td735uHMMMAX6N0:zX2iWphaISSX6
TLSH
T18E95BE13F2D900E8D05ED174C7568632EA62BC160B25B6EF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fb73c7579ddd17b7501b6cde0d42e787b285b3b166fe1c19fb538d10734f9d4c
MD5 73610d18bfd2abc27e09900905e81987
SHA1 37dbb1ef7787dbeee207a55cd9d055bcaa492d24
SHA512 ba805205ccdb1b709205ecad6706415bde374ea901f39691cbe35b21cd0fce55edaa8ff5512aa0f1d6fde315d690d96927d7dc685ece2dd87d697f1eba87935b
SSDEEP 12288:u4UJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:u4I2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T12C5523DBBAC885D2E20144B1DA62CB85F5881CC9F301602737A96745BB7D589BC4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6a35a91776c085f4445d7fba63af9244933251a323b5de02aeb6dd36c749fd50
MD5 c0a21d196cf5a5bb82b086f24db2a197
SHA1 27cc7f497363010ee1e52702e09af417385306c0
SHA512 6370db121fcc56e828f9c2723bbbe6c3537c352f7b7341d18de2dbe1aa65f69b14eff82a66593ddf00a38212374931a0ff4c2f1b48d470d12ad8c62d5360d13b
SSDEEP 12288:aFUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:aFI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1E85523EBBAC848D2E20144B1DA62CB85F4881CD9F301602737A96745B77D589FD4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b06811c9eeaec497cb37b6eee8fda04f988d6ffb2689c0173c54a1ac9e9a4148
MD5 b80d5544d0833b9242c66f83f5360f75
SHA1 0699eac3f277923c173d0739c31cf4ee4333c683
SHA512 e1877d09a758652ee48f03d6f209c11d13a0bbd05eafae6a1b9dac6610a576b47b945efcf1d6ec3e1a4b5f9fd95e625f12985d2cb4dbe02a5b1be37e113d0fc5
SSDEEP 12288:qzUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:qzI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1F75523DBBAC888D2E20144B1DA62CB85F5881CC9F301602737E96745B77D589FD4E1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7def9e719a08c27ac9c7e068724806fb816c9362fbc895ac4b54d39c1131d52d
MD5 f61da86f89bba64fd0ce8ac79ee1497c
SHA1 eda86ee5e89ddbc45bec711b4ea0be73a3d8641f
SHA512 7a4102f569d45f35554d55eb15857ace227925dcd1c142d44fc727701ccada9e6dd73e50d1e3277576bd658bab6b5805c38a047249a60ae586a28ea7e2271f1d
SSDEEP 12288:MVGUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:nI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1DB5523DB7B8844D2E1128071CA72CB45F5A83CD4F301A22F67941A856F797C8FC6D6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ac494a0c206fbbc2ac006b65376ed0a0de9b138317e4ad3d3cf3a6b53d36a641
MD5 0cdca90a37500fc048c5c1587455d732
SHA1 b0e1686f784e527f8973cc06aa2f066c636cb8a2
SHA512 cdfb9d07ad3e19ecab786683c1a640f26727adc2be11b0de96f9c294616872941860d62b2dbe06c675710f0a250570024f7c69c300e3d7e8074813d9082a42a8
SSDEEP 12288:xuUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:xuI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1E55523DBBAC884D2E20144B2DA62CB85F4881CD9F301602737ED6745BB7D589BD4E1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 21ffaa484c76bb65d195b52326386a0bae5bddb1f10a8f5387f65f13ab7e4b80
MD5 ff794861741218174b53b0ec5320736d
SHA1 a21d83066bb94e7a34ad3af2989d03f21eee95d4
SHA512 457d6a054c03fea919209863d78c98e6c6da8a9d7d481dddf6bafbe094ed20389c01f3aa54e2aae58c3a4838471e24700c95056022c93155aff6823ff7f049f0
SSDEEP 12288:9xUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:9xI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1585523EBBAC848D2E20244B1DA62CB85F4881CC9F301602737A96745B77D589BD4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bbc9aaa10445c18c3fb24c5600facdd7e4aba396118d6daa21376dbef3a8ea4c
MD5 5f6ae25afa2070a2624e96fb17d77e31
SHA1 97def2df0b5b07c40bbdca14297b78c2b4f54aee
SHA512 e0b293206d3b1b4759fccbac88c4c4f583a778728c41bee0ed75ab1340f8df1a1c78a3cf40924de68d85447f763010512328903c7fd33275a0c4c1ff79081689
SSDEEP 12288:CNUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:CNI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1575523EBBAC849D2E20140B1DA62CB85F5881CC9F301602737A96785B77D589FC4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1db661ab1c1d0547f565da56b0de029d99dc6dacfc4bb54582e8be3f06a5c6e5
MD5 e12608f34aa20c3cb075249f338644c6
SHA1 052bb2608ed13aae3295e4cd37c26aa889446b1f
SHA512 fe36bd60ed51a3e55a16f11bc194d9a1392dc121382efc30fea690bc7dcbca2266302615f204d32ebfbf6a09e2e3728caedd9acf1269bb69171c31c8d8bb7301
SSDEEP 24576:sZM3zFVSOlI2tBH7353+xRM+l41dA3H6NX/Iv:sZM3zfhI2td735uHMMMAX6N0
TLSH
T18A750199B39008F4EC63813ECD258A06E6B27C595760C21F13F836576F373915C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d830ffa3ee16f875caaf424ca796942faec32bab353c4e7080f0b51582e98110
MD5 54b94250b03a488e8798798a1cc6ce3c
SHA1 dff05eb09e431dbf6325437b5172caf8e15c058e
SHA512 2a597b95c6829084bd2e5323464cc5774c635b8067814ae539308284785f048c40ee7bb2feced073cda3126f9c18504dbb7459102ea8bf69533620dbed713022
SSDEEP 12288:wMUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:wMI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1035523DFBAC888D2E20144B1DA62CB85F5881CC9F301602727ED6745BB7D589BD4E1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9696556e1cc5bb2e1f7eaa7145918f6591345f160124ba52739b5231c7e70f84
MD5 c9e80f43bddf9b103eeeebacb411561d
SHA1 fdcd7f86429b323d0a7dd016cad72778d49f9ef8
SHA512 9ff9eee0e7bfcad037c7ece3ebfa215d33a390043cdd6a1a8af8d4033a53c6c90cb93abfa489958098168e11e9ce9ab6326f7daff63e45195a3f9ab18dcb9301
SSDEEP 12288:WQUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:WQI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1375523EFBAC848D2E20140B1DA62CB85F5881CC9F301612737AD6785B77D589BD4E1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 aa5ec6bdb4676f08c17239a3763f88c0a5958d7893cb0f545d6c314910851a5c
MD5 2b137e6efd5f9b92c9be486f7fbda2d9
SHA1 6ab6e4b6ba99781980c0b7388494b896de435f78
SHA512 1c0db22557d0155b82e1f923ef7dc99f623812267b20d4877d199b9d45a89d98b27ec6cfb5a4901dca55411d77ce9a3371ca59161dd3b0aeefc116a07f0862ae
SSDEEP 12288:byPz5L8JUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:WzyJI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T16B65129B77A420F5D1268135C9A24B02F3B57C769310966F13A407B62F3B6D0AE3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1875b647029994dc3810d7ae46fc4e7c0efa24276b7ae848b6d5e21d83c61ca7
MD5 002bd8117fa94657899f7adbebb5aba1
SHA1 f93e07609a5139f7a362447cbc28aecca4e7a151
SHA512 32c6b6f21f7ef737f5bd7e4b54588233e8bd58cfa38c9dd6d01fc5c1925adc2d5278e87892eb542a2d8c00bd2d2a7390d33e8e84ea9f9d81e29732c1eb75b0d5
SSDEEP 12288:6MUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:6MI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1675523DFBAC888D2E20144B1DA62CB85F4881CD9F301602727A96745BB7D589BD4E1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f957fc6ddf5255568b96ff2b564c28de1e50fec9e1e0f4b17e3f0fdd50f899a9
MD5 eede130c7cf1265809feebca15cf9fb4
SHA1 6ecb27eac095fe46eab24a4be5e8cecb032746bf
SHA512 19ecede54b9a18850fe022e153e66c2ccf763279ff09cbb1645f907124603ae24eaa71dd6732a76d7d07cbcd5d7b1f1a2ea6a5f62441138df76e3debfdac70e9
SSDEEP 12288:uMUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:uMI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1615523EFBAC848D2E20144B1DA62CB85F4881CD9F301602737A96745BB7D589B94E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f9a17c853a6c0190f8cf0656c2258fef76c439297ee901395a70decf57d80fcd
MD5 14e950ee4736d253fd71c209c6d73688
SHA1 f6d5be20acaa191f2daf822bf131434d44c9ac5c
SHA512 501f6fdd5baa99d0b60454b98d6249c8b68a9a517fdb550437e09a889655d337435124fb259cebfd6e8046ceb0016f1803a901304c7ad50ae55ee26645d746a3
SSDEEP 12288:ayPz5L8JUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:HzyJI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T15765129B77A420F5D1268135C9624B02F3B57C769310966F23A407B62F3B6D0AD3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c5726083aef9140bd2021ec0d3e7ededaf9ac01857f166129dece9accd082b92
MD5 dbd7a974c557cdc2f8172d1b768d6827
SHA1 c82acac13ff5a4921c798ac2d575161988a03c2d
SHA512 fd3899700681e26a87c22d7b0b6ae8a2480188d312d8be55468c370b7d5def323b4dd6faa4d27b9050504c28c26edf8cf29d69bb5d4c90a928799cefd9392560
SSDEEP 24576:GT8aLl3z0zDDI2tBH7353+xRM+l41dA3H6NX/Iv:GT7LljCI2td735uHMMMAX6N0
TLSH
T11E7502A9B39008F4ED67813ACD258A06D2B27C5A5760C21F13F837575F373915C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5ba8e433a1b9f0fc9f046126ab5057547fbfd0225b36fed86433db8169fb14f9
MD5 534d918645d39841dde3b7379693648c
SHA1 de44d56b8c8a531c317ecb8247e8c8deaf501d90
SHA512 1c1529828501f99987253857fb0e9d96c5f3fbd0e948664ae82ebc37b13cff9354a32dd798465acb772809e86c023819ad6972978919ca0b55d5f68ffb317adf
SSDEEP 24576:D3rd9CHKy7GZvI2tBH7353+xRM+l41dA3H6NX/Iv:jrd9CHKyahI2td735uHMMMAX6N0
TLSH
T1D185CF91F3E414E4F1738A35CD728601DAB67C995B21DA8F03A8265A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4ded9774a084b18b9c4a0eb16b4645f535a3f826ab77ac80908adc66ae54b33c
MD5 f3860edbc317a6562417a715a5e81014
SHA1 0a43e7039092f3514ca5d21d78ee165800fd3db1
SHA512 75986b15f9cf4588d6055ee1a488df682fa6bb1ea22f19e632861567e0d486aa57500ef0a92a7acab5c4dbb50b31d043430d0e2a74fd503a528f358c4db7c5f2
SSDEEP 12288:tTUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:tTI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T10F5523EBBA8884D2E20144B1DA62CB85F4881CD9F301602737E96745BB7D589FD4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 22f8bb9de1560066ad961a78b6e0232c2e10d77adbab512dd4bf29124bf589ab
MD5 a643f874db5482251732ca4b8074f37e
SHA1 bcb27d4511752d490f0e24efe20a57c1f0f5ebd5
SHA512 963768d65222f1f3aad0f6c2d5a702f64dec274897e151da443f3b802482a46dcb8a73ae964d995f4defea1ec9aa29c53a2fcbfb0dd2953dce52e05f1514ecea
SSDEEP 12288:BpUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:BpI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T14B5523EBBAC848D2E20540B2DA62CB85F5881CC9F301612737E96745B77D589FC4E1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3fb9f8d5e0a6b5538327262f78eeea32239aa095ee7367b76a1b7e4621de32fc
MD5 06687a8cb3fca15558c19f18f90b7cf5
SHA1 b83f8ce2508e54afbc1e7fc455034c9de53cc5f7
SHA512 fc21ee325b44ec6ba679d3c85d66d73f3aa156c36dc9f7fa21670a91ca176ecf5257e3e9d536ff943bd80c5da60afeea35f591a1e70ce79c3c916f47f7d9a834
SSDEEP 12288:iKUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:iKI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1135523EBBAC888D2E2014471DA62CB85F4881CC9F301602777E96745BB7D589BD4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e7c4cb2f2c49440dd6e9519ac503a7fc8b5ecd8a3318c2de2e26b66621d022cb
MD5 690cd8997bfec0a8a93cd007cefae726
SHA1 99d6b51894610a706d7ea52eebf461d6ba0318c7
SHA512 31093d27d7c43bb8767293613b9d7b1e683064abec00ee910546a21fbf590f1ff35a026d2520c2bab1f74d515dbeb34c81c830830aa94f2118f24199b2aa955a
SSDEEP 12288:HMUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:HMI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1905523EFBA8848D2E20144B1DA62CB85F5881CC9F301602737ED6745BB3D589B94E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6c7406549031986d529e1659fbcafd885a33b185f33259fcb82524a30555fa52
MD5 7d4facb739f51147c1058599c000a2e0
SHA1 b3cf0930b47377ec2872becb41525b9adb4451e6
SHA512 0e23ae81d778b3711955786370d032d110e90e959c775496412a043289437ffc71d15119a59202581a52fc77b2a40632be990b9e55ffddab6cf9e84620385f95
SSDEEP 12288:TTUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:TTI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1375523DBBA8884D2E20144B1DA62CB85F4881CD9F301602737E96745BB7D589FD4E1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5d505bbe4ce0a2e2e16ddb55fe7747127abb0bc9c169e0c453477bff5cdeb52f
MD5 ec3a8f5a05095161f1cc06fa0219e01e
SHA1 86226c0690fb106ba94440901e0d87d9178b4b76
SHA512 534126dd0cd61937661049ea0122d5b858877402d25ad109e2c340cc84f8310b7488ce940e48885e0dd6495ee4baff23c608461241d6a40076d88e6d94f5410a
SSDEEP 12288:p0UJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:p0I2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1FC5523EFBAC848D2E20144B1DA62CB85F4881CD9F301612737E96745B77D589F84E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ed21579fbd514df2cd96b0b044cf163bbe5fd78cf21c42320a4cb80f49c43269
MD5 1279a7f8a291afa0cadc601e49347dc1
SHA1 906d4aea586e9f0e9dc915d5bb1a77d37e153d2b
SHA512 ddfa54f7bc6d3951129e956fc088bed068c72ea859867b5bfb0f5e5ce088454c56a609b54cd6236e9b93ae347f686f764d5d6b5042a599f205d9be612d85c9b2
SSDEEP 24576:Zfwvzk9RX6wkyAIAI2tBH7353+xRM+l41dA3H6NX/Iv:YMnYIAI2td735uHMMMAX6N0
TLSH
T16E85D029EBDC44E1E177813C89B3460AF6B178595B31C2CF129A53AD0E37ED4AD3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e2d916195113eadc837f7967e747df9d94555e36568fd9c7a6b9437765283adf
MD5 e7a1792a7cb76864b5648407eca8fb2d
SHA1 eb92f9dcec0cbe8670b2f4350ad83d8cab4c695c
SHA512 c684fcbf8fadfcb689d9f51c0bd34a66634c69c79141929518edfcaac10a9f902fb1d775c4d3a7bcd99e56af8453e61990792772d03fb5bb68d59251e278dc67
SSDEEP 49152:vYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XI2td735uHMMH:SySzPvISSX6
TLSH
T117066C97A16801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 94e0aa30ebdee9fd7c6321dc0398029d2cab2c63939323bd41f4efb88f334f64
MD5 59492829af08421d83397496ae421c6d
SHA1 e286fdad3abb911afd8559c7c190eb220da97e04
SHA512 f98a8b6ac12998acecf81abe99f6f1e78dab2d248ba0885d8712b453e162a093255187aa24c5904f5bb4366d13551ce6f55514c3ba6cdde0a6436983128bae25
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYVI2tBH7353+xRM+l41dA3H6NX/Iv:R47JUQjqirIhCnDHUPfF/HI2td735uHD
TLSH
T12365AE1EA3EC01E5E17A827885158A5AEA71782D5F31C6CF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c3c933302cd46ef5c0c88f9f66eb66e2690e283a65f8fee8a0d2e8c8c69009b3
MD5 2826568ad59c007177ae81cf73a082c8
SHA1 ebe4dbaa68d9fdf006f2000b24c2899567b36c9a
SHA512 7af8218200e73a7d7a3fa5bf9cd1c93b1fb905ddd8daa8cf232629cb9e9e89bcf903532f7e18003e60abd2ce382523171227a9df021519d65ca4d246dff1abb1
SSDEEP 12288:NpsfcUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:+cI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1EA65F05AE28801E4D02E5175CB528B41F3673C6593E1D3CB23D0F67E2F3A684ADEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 707035c2a736f6ead80bfe9083f463db8fd1ea1fded4ceae15b01de37e905b3c
MD5 4989979194d62848b9658885b5280385
SHA1 27400f9481f9e122d54b345b403c1ded7ace92a2
SHA512 9cd276de8a962fdc220434847af22f75de33a6b115c960084c411e5f09e717a4ece21d98c78c1c9eac3e95b340807ff5f76769f11a2fbd74f745197ea187bae6
SSDEEP 24576:6bLX/kLxhi/kLTnuEg7MG00IoZb8BAVdPFV:kVEgoGPbZAB8N
TLSH
T1396527007626C64FC6AD40725E76D6CCAB707C42EE05AE0773CC8B3F9476A59B6F6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b9e2c884bfc76d19ee22103266a590376ca022cb6390ebeb67d6b7ea7cf01290
MD5 4e33dbca666f0db898b56c8129e24f39
SHA1 f5254859ce86c7c0362d7213def74de7391eea3f
SHA512 da973b0415fc27ffbb7fdb1241bd26fd97a5630df7402a973c7d67d4d0d04f6a0831fcd165db1aad641e0f82767240247a669653a14d34e7e6ce9cbc130ad898
SSDEEP 12288:bE9EV3qEYeDe7Row/kL3/kLTns8ckn4Hp1GZ/ZE/I2OaJ85Rcj:4S1Hy/kL3/kLTns8cOCHe/mZOK
TLSH
T189552900A4B7E75FC9AE5077023286CDBB746C42BB453B01734C8D2D9477A6EB6E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 229f16b0125833d185780ef20c71680f056527ac31485c2d06511c448380ef36
MD5 3a08466516f95a9a93a56580b70fd072
SHA1 debdf444e8ce01bc8824081ab6b4a9df9ea242ec
SHA512 0a1f1e23f2265d587138b38659c322a75736143827f63dc344f9f765ccf49bac032e553d9ce1cb2baf4b283e888250ad2a6a9a563d0fbce0e4a8113b9d73e079
SSDEEP 12:Kk6gISWEEEEEEE3it/XEzBRMtrC0EEEC3UTSEn8955RvUlkvsMlE3UvEIgNX/:KFj54it/PCqOS88HR0Us0skEIIX/
TLSH
T1AC02E5B9FB908E54DEF29971D4862FD54F31D42C6585539311C461292D95AC80C2CF49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9688076ce3e03f1.bin

Path C:\Users\Admin\AppData\Roaming\c9688076ce3e03f1.bin
Size 12KB
SHA256 e5fdd2e4946ccb145357465cf6e58393de0dce5930e5ac277b38743765d03a7c
MD5 d8c8623df0a0ece8eec3184f192c61db
SHA1 32f8e73d0677449fb4432cce44bdb16e00ff2d4f
SHA512 215f321d9497fc3af482c64c3a95f4591d29f92ccd1a4be56dc538cbc8efec78fa411f4b3a6530f8568255e5b530725957fc44fefceaf2167af7dd4bf8a377f0
SSDEEP 192:jQA8/iPIXyCFyvewVFtWr+pIVugmaXwbAPgF8dRxaRpHkaqJrWoY2GlUGJa:HmmewFcr+OVugmaXvPtdekti52kJa
TLSH
T1BB42D09799E738BC94E0388B618561CD9FE8D2668327859E0B975D33F033506EC7578C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e3b22a3399901acacf0efb9e2f51f03762c93a88e7925dc6986ed6de97475727
MD5 15926518d4f79390a01810fee76ea344
SHA1 72d672582c4c37ee642a22a3318f4427a00dd642
SHA512 d368484ff43d9917453deb08233c891571c94ce3c035418b67327e99e68edcad2513b762abd050898a95830fa9f839de998c8b6198327935d17cbf748a24ee31
SSDEEP 12288:+M7EUJ2tBEI735gTa+aYg48dej6L+l4eR6/FA3kBylX6PVX4In65txcZQz:7EI2tBH7353+xRM+l41dA3H6NX/Iv
TLSH
T1375523EBBBC88892F12604719966CB01B54C3CD4F700A09776986785B63D9C9FC7E26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 659733d69cf16aa9b25ea2d783004dcc4f3e4e8a0fdaf795be3b4902b9f89065
MD5 a6ffdd53f34327dbbcecc0678dba3112
SHA1 ae0a04ec9f460518a5b5c314a21ea23c64839420
SHA512 6f3ce30d359388c369f469e73874f9493b26733ba3aab5983dedef867b59c6cdcdbb1bab2e3c05dcec02e920caebdd5297947e5c4b188381e39269802ebb9d00
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYCI2tBH7353+xRM+l41dA3H6NX/Iv:Zgb4mBIBhGFVI2td735uHMMMAX6N0
TLSH
T18465AE1E22EC02F5E0FAD2B8CDA64417D6B278165331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 280d8b02be274468edc2b1f1ea857e6b52003894868ef2d3d5b4a86e1c891d3a
MD5 fb348797b46079a839e397ecbd4b6149
SHA1 a605c5c6567ffb16d60552a23b395b8417f59eae
SHA512 e7bd666b8286f4f8b1cde98b5c5f26ba80edb6dd8e5ce4120ec4e19a4c0f6941b1ef98461d13e3e080f52a16240f65c25b7b00617e5ed8a19995570638445cbf
SSDEEP 24576:0G88u8FpJqH1vzria7/mlI2tBH7353+xRM+l41dA3H6NX/Iv:H7ZFPqVya7/qI2td735uHMMMAX6N0
TLSH
T14385F16677E001F1D477D0388A928663F6B1B8251320EBDF07A88B552F33AD55B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2e0535b38fc055f763c15e51fa3e6cd47ca6f97222a80297f8c054b03b36416b
MD5 f3a18c5f36416ee426f70c5ed2dd839c
SHA1 6f7d2aa51bd2018ee6a46c2c133b8c107314cddf
SHA512 f42ac82a221968d87ef47f349669b6868c39f9543145d628acd07b5ca62bee6aab36c341dd38233bfa3bd7e302317a9acb4110959afa28cc351ee8069a8c3b36
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxI2td735uHMMMAX62:VG05lO43boISSX6
TLSH
T136D5C06E62EC11F5D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 edb2118ac7f92a31121fe0fc9a5f3b2b9da87015b828619b6d70b622181bf800
MD5 a07247c0c1fa48e4ed0e211e667200d6
SHA1 8825c00c05b03aa593f8d4fb2b06067c1f3881a5
SHA512 beae12803c5a411bf9a73ef716db2ba83cde8199d61846b5b3c4d12dccaf553467eddbfc3b1762122564895001d528280ef503b880ba1ecee35b57e569154b61
SSDEEP 24576:afa5POZ3dpyWVM50JicR2hG0lasx2+47eidnXI2tBH7353+xRM+l41dA3H6NX/Iv:ya5POZ3lJt2pasx2+mpI2td735uHMMMS
TLSH
T18665BF5EA7FC01D5D179D17DC5838A0AF5B1342553329ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 87d1a050ea13622698c8525e8d5d13177109f961fffe873c814dd227716ef980
MD5 ed164d3547e435ee5cd9e9603b69bc9d
SHA1 9379279f8204e7bc5ed2dd13a91f19390b1a2143
SHA512 583c5090412e6fa620409865213fe480440f5e04686d7c4f72c2707a9c373f75889e4dc6523aec488779157cc6523f10f3c28c1b4ac52df899d8bddc71e7b037
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkdI2tBH7353+xRM+l41dA3H6NX/Iv:qNc/zEOVHFKI2td735uHMMMAX6N0
TLSH
T1D9858C5623E901E4F1BBE1BE89779646FA717865533086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a0b9004aa864b156001c2400977d9f7735d5355243993eb035d9ea4263923c57
MD5 1fc2074b75a1cbe3fdceb17bb34afd40
SHA1 9f5f5e06c902706f6bb639ac7cc1b604138440a7
SHA512 dea550aed08ca6b50552bd548afa3e71bfc0dbe75e1654a7664e1116fccd167b425cac17058d149bed0e9dd5a1cb7303161c99eeae6dea4047372b8a8bc687ad
SSDEEP 24576:bzkNvNnaFeYhJNtmZBm5I2tBH7353+xRM+l41dA3H6NX/Iv:bzMwBtOm5I2td735uHMMMAX6N0
TLSH
T1B855AF6EBAF846E0D1FAC5B5CD238512F6727861133292CB5390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 73d09bcff3180ec6935fa5eb6fd2ad4f4294475c1ae1b840a325c60dbfe95943
MD5 d789df41f49df4d002cda7f3fae1c7bc
SHA1 38af32a5938583cb2e99b651715eb2fd9c1e2161
SHA512 a8cdc5d2946eb3b52d7db68d829a79cb2ea12745aa441c66641e7dfb716ae5f010cda0f020627a16b3429f3f3bd876d31d0a922a39be99f842b8029463624002
SSDEEP 24576:CPUr+NQhI2tBH7353+xRM+l41dA3H6NX/Iv:CJQhI2td735uHMMMAX6N0
TLSH
T1E065E16F66D818E5E676917D89828709F77178625301A2CF02E0817E5F37ED8BC3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3525d21ed5727d6b4e089d49f00e5d562ea59f4178abec467378879e56c2dda3
MD5 1d380f12b1998b762847ed6301328e16
SHA1 45fdb31f2a49f8fb2d9a0e3fe16967d4710c1649
SHA512 6c4a00ef5fee36426ffa1764083fb5bfef00f6b8798f80a55185cb495bb6d50feae62a45cabfdc1bbe31ace78341e393259966c4b8db9dea8169dcc8071e0249
SSDEEP 24576:AD3FHshBIYQgAYI2tBH7353+xRM+l41dA3H6NX/Iv:ADVHeBIAAYI2td735uHMMMAX6N0
TLSH
T1E875E17EE79C04E0E57BC1BCDA638A06E67138A9032165DB02D481B61F6BEE47D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-138-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/124-331-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/124-132-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/124-130-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/860-91-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/860-313-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/860-85-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/860-83-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1060-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1060-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1060-57-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1060-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1060-70-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2512-154-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2512-150-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2512-144-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2512-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2512-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2800-101-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/2800-95-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2800-96-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/2800-327-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3024-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-124-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3024-118-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3024-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-332-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3452-166-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3452-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3452-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3452-335-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3960-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3960-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3960-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3960-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4080-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4080-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4080-106-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4080-347-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4080-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4080-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4196-293-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4196-73-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4196-72-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4196-79-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4924-19-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4924-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4924-2-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4924-0-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4924-9-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/4924-17-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5980-42-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5980-16-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/5980-31-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5980-38-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5980-44-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/5980-37-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5992-28-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5992-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5992-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5992-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download