Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe
- Size 4.8MB
- Sample260721-xpdycasgrc
- SHA256 57c6efeead928740929493ea2bf7eb7c19625cca333a04edd8d6b67f4a53f0ce
- MD5 baa016c62149b9d41c7f415cf46a6ea6
- SHA1 17758ec332ef0576555324340997852a93172baf
- SHA512 757ebc104b9deafb5d6fa3c02d2255268b4f5b903e801a4d9da933c9b95c91772985d2a090e1677e355446f73063fd942c4096891e3fa1a04d680dc10ded18ae
- SSDEEP 98304:n2FO3ZxJTxy3Img6jsjtbhlivpoj9ghi1RebMIg9Cbk/VY7wRGpj3:n86fLy7IZllwojDIg9Cbk/VEF9
- TLSH T19036AFD5AAEC00D4E8A6D13AC517492BE676BC441236C79F0061BB7B5F336930E3E762
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 3328 elevation_service.exe 3516 elevation_service.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 3100 maintenanceservice.exe 4592 OSE.EXE 3860 PerceptionSimulationService.exe 1700 perfhost.exe 4232 ReFsDedupSvc.exe 6124 SensorDataService.exe 4156 ssh-agent.exe 1848 AgentService.exe 3052 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5132e758e05f6396.bin elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7659d614319dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce6ce2614319dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000057e8a1614319dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000599c29a34319dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc7672624319dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 3328 elevation_service.exe 3328 elevation_service.exe 3328 elevation_service.exe 3328 elevation_service.exe 3328 elevation_service.exe 3328 elevation_service.exe 3328 elevation_service.exe 3516 elevation_service.exe 3516 elevation_service.exe 3516 elevation_service.exe 3516 elevation_service.exe 3516 elevation_service.exe 3516 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1964 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 3328 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 1848 AgentService.exe Token: SeBackupPrivilege 4232 ReFsDedupSvc.exe Token: SeRestorePrivilege 4232 ReFsDedupSvc.exe Token: SeBackupPrivilege 4232 ReFsDedupSvc.exe Token: SeRestorePrivilege 4232 ReFsDedupSvc.exe Token: SeBackupPrivilege 4232 ReFsDedupSvc.exe Token: SeRestorePrivilege 4232 ReFsDedupSvc.exe Token: SeBackupPrivilege 4232 ReFsDedupSvc.exe Token: SeRestorePrivilege 4232 ReFsDedupSvc.exe Token: SeBackupPrivilege 4232 ReFsDedupSvc.exe Token: SeRestorePrivilege 4232 ReFsDedupSvc.exe Token: 33 3052 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3052 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3052 SearchIndexer.exe Token: SeDebugPrivilege 3328 elevation_service.exe Token: SeDebugPrivilege 3516 elevation_service.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1964 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe 2380 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2380 1964 2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe 91 PID 3052 wrote to memory of 4832 3052 SearchIndexer.exe 101 PID 3052 wrote to memory of 5992 3052 SearchIndexer.exe 102 PID 3052 wrote to memory of 5128 3052 SearchIndexer.exe 103 PID 3052 wrote to memory of 6044 3052 SearchIndexer.exe 104 PID 3052 wrote to memory of 4916 3052 SearchIndexer.exe 106 PID 3052 wrote to memory of 1804 3052 SearchIndexer.exe 107 PID 3052 wrote to memory of 1740 3052 SearchIndexer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe" /start2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2380
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3100
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4592
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3860
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6124
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4156
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4832
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5992
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5128
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3004 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:6044
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4916
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3004 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1804
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1740
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b0f522cac4f4b8c7006c991b982d744dec5eeef50962a702abafde34adf71735
- MD5 b87b8999c11fcbcbabe3336466c44a35
- SHA1 58f0e7f87f9ecf954aeb945dbdafd465833fced5
- SHA512 e48d06d0ff157aef6f182b856e34387d35b9a1ef2aca39f4038c4db6b9c20d5d85fda0341ffb132820e1c7bff2022381daeefb1d4af77d091be045880be320be
- SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPLNiXicJFFRGNzj3:u3q6mjBg7wRGpj3
- TLSH T114D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 f4c83e30b50dd6f6cf53b8b91be909600afee7bfffda777f3219a9efac27df0f
- MD5 f1fecdf379314cb5eb519553c1a25a0f
- SHA1 f4e6df79d67e04e66a560eb376e52f18db954277
- SHA512 b0bdb091fdfd0c60530f0cabc9ff02e9a6a6934e09df2ad66a4fec126314f94562de123a53c0e39c48531fb0a8f4b21457fdb1da5298f49c565691f561b0b26c
- SSDEEP 24576:nXYfDtczAm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytczLNiXicJFFRGNzj3
- TLSH T19305012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 d99b4204fe2a0d00a8255b98648e9c5d4c59280c5c672e9698da76f244f8a7b1
- MD5 43a45f9f57c41b350016ec8c767d2f6f
- SHA1 9b2b3645008337737005a02b3c46689b87124ca3
- SHA512 5eee02e40889577ef82236d452989bf552b8a403160766c07a1dfcdee7bc8f99810ffa18ddb73cd34409923e6f78deec019ab26c95a030bd17ccb60feb0af57b
- SSDEEP 24576:I0Le5ji0hmxhrMJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IPji0AzsLNiXicJFFRGNzj3
- TLSH T1AD35AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 4e408a3d40824a6c01e4e906f9192cc827d472a4269ade7fa71a7c4bde62e5f1
- MD5 6ab0624e75a178b905175b05f6f76fd7
- SHA1 239ef14742c2e02cf957fdc550c05659dc8d0810
- SHA512 5872d05fda8cf0c766c038c005b9547dfa9171a47ef7262d07614a55fa39dae8fa3e28d6d3619aa210d42fb1fb6c87b97b8ce1b21428d3de0a84cd6b600f5b49
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I/ezSC6vUzPv+HjyQLNiXicJFFRGNzj3
- TLSH T144756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 84c9a1d7967079cbeec08f7d7b248c9bcd939dbd419f2d7041619f7da30ee75b
- MD5 2f0333eb28577292219ef51312f20fe2
- SHA1 b1496d470806b92061af443ee3b3d7d7adc537ec
- SHA512 69a371ef5109c7b5a0a91856a9857b24ed11dbd15e73dd5d8223dee72511db1ad17f474e7183e6c0e151cccdbec5a4d12ba2b69d75427cbfe12701ed6ba321b5
- SSDEEP 24576:fVbqPb88hv/l+Bi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fVO88hXl+MLNiXicJFFRGNzj3
- TLSH T109559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 916da741cda279b8e3f9569ac8ae674ff08f201e26e8f0ed65bec59f457a7f54
- MD5 4de82187e0b33f3c6933908da0c2b943
- SHA1 4e2a68469d7a30b8568473dd318ebc7e8bb3fbac
- SHA512 05fbeb511ca162dfcc8ba4dca21c210ffa7fc67bc0080479499458d5d5fee8ca08f4470c2a0f3d05ea78f243d9576536e9429f5a02c2ca807bc1d5ff6ede2c6d
- SSDEEP 12288:YGJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YGV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T128C423D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 776cf2ff2247f9e5a5c2bc4369601ebe9c973bfea58af4290c62839dd3ae01e0
- MD5 64b0a4f9c71a8da5fa455145612056a3
- SHA1 ac0e7d9cfc3e5407ac07ddf8973e8b62158fc953
- SHA512 56a1c40163b73f833118973789fe6fec5650a328a75a48530276c401e33c609b5a21f077b61c74ce8436ca2d7d0ab1c1245f6302e7dd0d49b333259f9bd47472
- SSDEEP 24576:gJIUa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gJIUaLNiXicJFFRGNzj3
- TLSH T18E05CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 aec1e826aea28b420f32b2cad5bb07bf7498058897d9712edde81d8552d10ef5
- MD5 d5a17d8271e36aa625687e3d3a85cec6
- SHA1 bd8103c142026ee5b73a21e39ccc47812eb665bf
- SHA512 efbd99c11fb08f5e8acd0f979e606b5c7002dc1cb4041963163b57949fd90e07e0f7242e6c9a021d0384f7df7143ae936093102f96e185a6cd7281e2c946e17d
- SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:RQvGAdlCEL8c/WRNw5CT7wRGpj3
- TLSH T11C266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 f74d4b9597e495c098067f2ae355b619e83e67aca4dd8298908bfb64acbbe7ed
- MD5 ccd3c2a985b7c65304e638956f1a99e9
- SHA1 13f8a9773ae6e2a6a36c0f6cfa86b35f2dbec79b
- SHA512 c40bdf44d7b49cd676aefa9e9b0122cdbf39b128fe01afffdca028d85e666d73eb0fc12bad50af0b547489eba3333dba7dddbe3e863911bc871b01cdc6f0a20e
- SSDEEP 24576:hfewsAjc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dljcLNiXicJFFRGNzj3
- TLSH T14015E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 1145eab3c43b7bb49da8b091d7f4858441b2d8306f6bc939a3ff6ec8fb6b5959
- MD5 5df6e7457c8fbebfe9c5ad3b41afefbf
- SHA1 c3dac713ee1d0b719125e3eedad102fb6b1f178c
- SHA512 f3e5a92c3dc483853320e184d917e9dfb0fe8cee4fa7026d34a8e884451474b3c2a37aab15e160a361d70825e2c1935aa2d174b29c232b5f58f8afc6faba1d33
- SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHQF9:UUEtQevvqc2W1cpV20I32U9
- TLSH T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 7d59f0bd4f9e1ff499e96cbf3e526186eed81919f58564181fe612a02626307a
- MD5 2db4eb1f7a8265deaacf866d2963579a
- SHA1 a17f881ace18ee39631fa916ae010415f5bf3c96
- SHA512 5e4cf37e33194dd915156de29416fe0b44ffc857263d8986aa77d96d629da60f974b401cfc60105ee42086ac4100d52ba27cab3d1728035af0f27bea168be1d2
- SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/z8LNiXicJFFRGNzj3:Uoq2VjnmX7wRGpj3
- TLSH T1EBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 ae3b5ff6a9752451a61513b5947efeb53693caba3bfe6046451ccf29dd9b04b9
- MD5 fdcb769cb0f0f0ae4d6b462b7343eb3f
- SHA1 968d11b89cf89a198a1c704a58f60332fa73af55
- SHA512 3dc7997741fcdb7f408ca30760a1b4d06c95a0e2281a25396a2bf3eb3759f1c28d2cbe41622a43f26f74fe99e9873d474af1e016d04df4b72c7e41ba3c22bf73
- SSDEEP 24576:XAhGL6IFoiwtA5l7S533/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XAM5Foiq5HLNiXicJFFRGNzj3
- TLSH T1EF359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 57a34bf11d65161fedb08b0c389dc0f4db34c58903d05bc9b07f2916e04be2e9
- MD5 d9d39d3f73745d200429a445c3802b65
- SHA1 ab4d708718a2ec893b719b64d385fcc8702bc7d1
- SHA512 34d7fd305ea7b66e410b482b2501786cb04b0a940b59590ea025eef08a40d1cd1e164da284affe21f3d659c8ecb18a2c90cc321be417830e00deeb0b7ad2a9a1
- SSDEEP 24576:+wuROWw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+wSO7LNiXicJFFRGNzj3
- TLSH T1B505F18632980CF9E9BB413986578035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 a4509b2fd734eaa47a1bb723fe0963a00e086599aeca1fdc89a9af5c12978549
- MD5 443f86526fab43e1d98d6e94c4898195
- SHA1 6ae301d6f38321700b998a41742ca0d261db5c9f
- SHA512 aa3af3bc0abe0b72a2c571d017b7c1d957b8e1e63ff488798cff0e7444d2b5ffe011c2ccbd6816ce08b475ba6b781b72e6c2c4309ba0ba4a657fdc5682e25232
- SSDEEP 12288:UyZ1IyKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pZuB/TwSfVcYG3K/cJHlnFR+IGNe8j3w
- TLSH T189E4129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 3209b4d3beefa0a70760ea0113367af46e845e09b1e877d3c337c502858c2373
- MD5 dacc6c688b40e6c5ddfe8b72d723d175
- SHA1 bfc18040cd8fe701aba9d1a2229754eda96c8c66
- SHA512 a64042c13b65e68362c64423ed321f1ae6d57baffe71ad1b43f77b9ac87104bc8800572afb1fda4fadf823fb481dfb60a43942cb8523289d51b49dc7d94ad917
- SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:OQyiKanX+PNiF9
- TLSH T1F5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c2063053bc9696984bda00f6b68b051d260108bbc66e904f1ccbee1cd5201aa6
- MD5 c52f6d57321fa4bff6c220601c348bae
- SHA1 002efea9897ed3a45670e3743afe003dbd72921f
- SHA512 7079ee26628b7908d7ee8b0ce04207be36429c72e50d6d4ab1ba437e817ac17a391c685fba3256605ca29d6c09ad04d8a0a85ea05b555f158ab1e608d85fe461
- SSDEEP 98304:ZQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:QQyiKanX+PNiF9
- TLSH T1BB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 3a5c339a0777610459383c4979543359a9981c4e944cb5fcf17a89fe23af7a6e
- MD5 6c0dd76f89697a03fc503b32de258d70
- SHA1 78d530278d16e93c0969fc5789b85ee9c4e84233
- SHA512 9b11bb9dfd474657cf022b892254a3e10db41ebc21a28e4c6860cb3630953313a897d8c940f16ffbcb5838435ebf04ce801b937293cb185955c49ff3d812696d
- SSDEEP 49152:q68Qg55nhkeWu7PNU3/sLNiXicJFFRGNzj3:YthTRc/s7wRGpj3
- TLSH T142B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 bf19f5442ccac3a16d1bdef383996c80e186b7775b4e8b696413af2443803cca
- MD5 5370594df617d98d5ff505e76687b2f5
- SHA1 0d7c1c74907429ab9d77e7d4734b9850e2a1fb0d
- SHA512 666a070f2925117a85b190e21cab992c59be89036f8e8907da07ba7471d990a2d082be41feac1e272c89109e1f3533bdca535efa65d936067adf0603bed75c7a
- SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZV7wRGpj3:wLIHRWhDF9
- TLSH T192167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 032a4a30b84f1b893268ba60af117d7d1d68ed800226a5c4c0851e180bf394cc
- MD5 b10786e08f80b9d3672e0ab391a2b6ef
- SHA1 5e34e051986dc4c2e486738daa4d044593f0d38b
- SHA512 6b62516830b51d538cdcc74219301c79f7ea4870b3634354b16c339f0fed587165b26fed5ebbfdbdd8ba3b35d670141f198ecc0bf88a25b4bd1790e87ae8eea8
- SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glULNiXicJFFRGNzj3:7u6JmIxd2dU7wRGpj3
- TLSH T171D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 d2bc01ac62fbd7006394e803c755da9afa97bb6ecd0b55a5ff21a63107d1e038
- MD5 ebbb071406d2b9e34973b4e44e10caff
- SHA1 0776b30755b0629edc41d08208c97218faa08481
- SHA512 798f9f3c3f047d706653cdac184d2fd8ff14281ec7de7acc1fab354389fd1366ec305f40e7c2792235ccfda715f8ee0c7c64892ee0186737e19a1536ff165699
- SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4x6LNiXicJFFRGNzj3:6mifPqRX7wRGpj3
- TLSH T1FDB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 0a2ee6514f731886429650cd3d2bb887662966ad5f86b0eff79cca111b6601d6
- MD5 2867de8c9f8de50294672a8f3ba5f76a
- SHA1 91195595b02ceb21e8cce45fbe28078311fd9f67
- SHA512 27f6c356456f504049021039bc511ec529a07729eebdf509e04be749d9aef090c2c2b6e101b715a6304ae43619cf4942ffd92cd123578a10b8fa30d0dc1f7f2b
- SSDEEP 49152:1SuZQIY0Be2KkRVtOnks6NMHqBLNiXicJFFRGNzj3:b5dKqi61B7wRGpj3
- TLSH T161C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 420c54f01cab65021ef9004ac9fec037eb3418a0ab1f6b951ca3381044a03ad4
- MD5 66485ea475672d6c1d1dd72d4bd105d5
- SHA1 d9db8caf763d5305407d0e01d99ea28928d65e92
- SHA512 6905c54075d4a94fed665ed652cf558566c56c6d11e92a6485541eed1656265854a74dc4dfc25d0e28eb68f737e6d5ad33670102e4b1771d4a49c841a54be3cf
- SSDEEP 49152:9htSn8EApI0figjgiDn0AP5wmLNiXicJFFRGNzj3:sX2iWphb7wRGpj3
- TLSH T1AF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 7942a383471fde6fd443b01f3db2178a5a7a83385549f1475b87667d400398ae
- MD5 4a7592f8d8e15bcef9da0073982c2e91
- SHA1 29d34aba912fc9caf050f97c51dcf97f190953de
- SHA512 f545ac0ac985badb7455fa68a02adda9ef6f985e1394d546ba77826b38de9b7485b4a3fc3cbcb6627d197bfe14de56244b96de496bc0795f91cc2f4d8e7db552
- SSDEEP 12288:EhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15DC423D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 368c69a88957e805a12ad09183aae407726ad326f235f615af030e4241f00b41
- MD5 7b2c1e0c753fb7b0899bab406760a973
- SHA1 e5e2a0a416a3cac46255fb19867597eed4ad7562
- SHA512 ab205534b8d64b198850ea5a77607921fd2e1f4c0b5bc42643bb1632ace39820514427ca56eaee89fbeb68ace0071dd855d3ded2bf3680781c9bcade31acaa88
- SSDEEP 12288:SuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1CFC423D3548955B1FABC0039C6754428F5882E2DEB5658E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 599b62f2884dd8e9ed2d5ee2a26701f3b9b004c5cc061c87fc344df513e58260
- MD5 dc05641af9288de501a1a16593d84fa6
- SHA1 875f6af3b475d3b1a4450200c0df24cf07d7d4a7
- SHA512 262774a28c0d6a2b63d28b29a358b2df89581e0a11ab8e04f7ab55d27d5fb896a0909a2910ad1ca3e16162f8d713ea10d24f5ed052264e4c8c9e286f050b8c07
- SSDEEP 12288:ugiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T12CC423D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 0befabe56361f7fdcaca887eb170b211ab26dc31144dba2e0448edb4028d4f0a
- MD5 2b546409e473d41c064c6342b469fe9e
- SHA1 0ded7f664f4e0e1d026de9e90ca137ebb4d70806
- SHA512 c1ae599de24932bbd498194c0b5fa7cd3c237c2f7ca24b87205b5e6ed6794d0ae06ac3d7567ee086ca69584007814ae67321fa466c90b659f3dcce22844832c6
- SSDEEP 12288:JVjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1ADD42393168901F1E9BD8039CA764424F2947D6CD7325AEBD3003D1E5A74FDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 f12e1c0421c6fbc556d2bec7936355c15d2a1fff153d63888d7757ea88e2d629
- MD5 4b0eb56fce742e097deb37cbba48fcc5
- SHA1 4245d32d8da61b4ccfc7de6b47dbff8c51f96a29
- SHA512 b3c9abfa8b233288fd36e95399b992779dbd5a0a4a7e9f0b140cd39cefa1b54a5a51924d8bc5cbe22c658b2f5545f1bb62744930c0e89b6ae0c2fd5b7f601585
- SSDEEP 12288:GriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15AC423D3548955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 414a523c13d32601abdf035127e998d953219e5f76493ac159279f606d8ac14e
- MD5 3e1478ee9b5fa8f2c5592740574a1a40
- SHA1 19035afa29416da8bdc12d93037e9efe5a3d87ba
- SHA512 80bb5207d2a8221c11359f3861c87094e6a1f49409e91b67f49007afe7091ce97d0fd36de0b7532e18d7bb7589aa7fe3e1f223bcf3685d93fa735f907e04e54c
- SSDEEP 12288:7SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:70/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T18AC423D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 ada6cafc6efdd0b1b19c5ed30b92cab194129736545ef8d85f813810fcb88558
- MD5 da43d8e23de1bf528ef04033340d2f96
- SHA1 f81e394f700ee891c74759b8d479c7814afaa77f
- SHA512 570900a7b589bdaa7a7c6ac9811c95497da37292687925da0a6bd894b9cb9ccf909b047f93cd4b3f64ddc85ce97c8c76a70d04c4fa2d20059ae8b45beb09f42c
- SSDEEP 12288:r2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B8C423D3558955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 2e5906f278a74e42cdcb505506fbbb474a113b2192e13d8f6821dc057dd92226
- MD5 8422c8d9373b7cf8c44deb5fc14dd271
- SHA1 f769374c95b633f614a1f9e2c8f214737287776d
- SHA512 38aa46dbee0d685c458fea48841cf80a143b7a506bafd00a4f759407c5c635d1654a09b9ae297744cab8489164e8bea95a0dfb1b19a2270842c86c5cc5af0f6d
- SSDEEP 24576:GZM3zFVSO4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GZM3zfkLNiXicJFFRGNzj3
- TLSH T1BA050295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 3de8733a57ff8f3ea98434bd7766c2ed3535ce5dcb68c0d0169666407650666f
- MD5 247a311084c1d3430da609802761599f
- SHA1 1f8411f63112b7652fe66e209053de983f8bc0d2
- SHA512 d05b0979dfb0fbf33877a616520f1c9a70f001850a52bbb856164c9803cfb58c931c61bcb18e8c1168bab431bb18c4e285280da7557cf9ff214cbfa20d11788b
- SSDEEP 12288:StiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15BC423D3548955B1FABC003DC6754428F5881E2DEB5659E3E3483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 caf90377865036f2e9d95cfba03475dd6099a185298e8c804b1f6b3154d7be9a
- MD5 7e1524a0cb1307afc1660b4e7c0d8527
- SHA1 d0b6f9fc1ab39687775e18095a427489d4c7a46c
- SHA512 0bb093b4da6c0ea33ac62e4470d4307baaddac5ad12af77f5cf94041119b035656fb27c85632893a6be52549f23708cdf41cdccf7c16a7f2e2d93ab4537a1b77
- SSDEEP 12288:UZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B1C423D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA238FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 3f6b731a985bdb6c77d3c7b26bf51d395ef2546ac1df8d07081ce0bbec762f63
- MD5 6b6f18e887075dfc3686e0808665cab3
- SHA1 74d1cfb579bc3fa2efd54508d4f646bbbee10844
- SHA512 43f97d17aef21a0a79906685ee8f8f0d016810a180b0211a83121ffd7c1a3b9617fbb7187a29ba09f06f5640fe85c00d0a378d9ea2fd28e27f56c6ec999d267e
- SSDEEP 12288:MyPz5L8KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VzyM/TwSfVcYG3K/cJHlnFR+IGNe8j3w
- TLSH T165F40247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 db010bb3acc36b99409dd6d9b87dfa749f663ce5f0379ba8f92c64443d945e55
- MD5 7e148c1d8166aa3c05b08a756229260e
- SHA1 910cb241483797cb3f61985f2594b6daa4a526a4
- SHA512 00173c958e6a1bfbf087b112b8e2f13c0392fb841abca83998150dbd5501bc97549443ebffbba7e19bd1ae0d413db257619bc10c1b0ca66cfba5a32c00133afb
- SSDEEP 12288:otiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ox/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B9C423D3548955B1FAFC003DC6754428F5882E2DEB5659E3E2483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 c72fa8ad56558ebcb4d2cce2ea0cb438a0eb6053ceaf5530da04969ccd2aeca9
- MD5 1f3ad861436c757e613945714b7ec25a
- SHA1 74d7ceb49d9d22e86dfa37c7575de2aa1a61ef48
- SHA512 f262c82d4ccbfa5e3d3308bd611ba52b292051c0561045d4e25ae3b2e4f3e5d8fb92f106a393d2f0f656aece680423b69831804fbc301653e5b31e22c10fe159
- SSDEEP 12288:2tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BAC423D3548955B1FAFC003DC6754428F5882E2DEB5659E3E2483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 dceaf8e652fb6bf889426c2c3613af5ac43140e6cbdd3d20dcde7215f7225ff4
- MD5 a2003e277cc1765b3cedb33cf0662001
- SHA1 3ac57bd9de3434fe353447b43e9f6a9ee604f1c6
- SHA512 16ce03725d8f2caefb12bc8a0c9e1e3e2a664571b4509f9647cef93a77832305cefb5760ec14caafa92a28ee5ed95abecd31f7041650e1e2580f77832b852b63
- SSDEEP 12288:zyPz5L8KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+zyM/TwSfVcYG3K/cJHlnFR+IGNe8j3w
- TLSH T10BF40247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 60c73889339e699dfdd817542e89bfc8864f4cb7d67c3478acf3baaf3a575afa
- MD5 a8f9604d5ddab70337d5e9dacf4fca38
- SHA1 253c4095b4a52294b715bb7abea0901218fc9eb1
- SHA512 f849ce150945723ae9e630e45fbaa33f28fe45e15ba838c87aa4704024bcccd223f1c5b7ccfdf79a9dbad4f14d637608f006272a01e8ff57d66609c12d3a6256
- SSDEEP 24576:1T8aLl3z0zDC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1T7LljjLNiXicJFFRGNzj3
- TLSH T13E0502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 92b69976da1e92852c14624d013a25d851ac8a0d1b5a2fa8f1fbce6442c85f67
- MD5 6756c0756231480f39f2358780460a80
- SHA1 f51cb2cc9f683d32f8f3a9ddcdec49633b0af612
- SHA512 71f81360e0ab1dbef51751d0cfa7e4a6bfe5c27f30246ed826c167037e2c69cb8e34d1fc8b5a0f2ef36dbd279e69b242f0bc4d0e58775b06ab556ae389767f70
- SSDEEP 24576:z3rd9CHKy7GZe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Trd9CHKyakLNiXicJFFRGNzj3
- TLSH T1E125CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 74f1f6f5f641921a8d220661f5acfa9fbaf6f0b825c76ab6b4cd88f5ca0a075a
- MD5 b818430e6647c33c7299c48488438dae
- SHA1 78139be2e67f050c655e65f51982efbb5092ead8
- SHA512 04976393b684b267e80b27a99bfbb0563b9e891d615764e127cf26eda8821aa170eb34fb96b463d7e69f4a68b1cdf096d3c165684c4b20d6a713a2404fe4afcc
- SSDEEP 12288:jAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BDC423D3548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 cde49442ef6ed7b34812dab7857b9a4eb80e006b515b783491e6e20cce763eec
- MD5 8607b93997c86149aea1a505171e324b
- SHA1 83a418fb634bf99e759a46ef0d5a4308ae095024
- SHA512 00e2bfe3ebd2b0a7dbdd0a8f62e23395a34a85e2eab7654a508c3f006b726a25ccf2222655ee31ff37deadbe2cb24042d3e44ed0d5e7993b0ecb7f90afa3fdf8
- SSDEEP 12288:hqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1DEC423D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38066
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 7b304a2cb2f3cfe041ca59b98b912210f00a59591d1a92f85b5222e0375cd4ac
- MD5 4788eaa618eade26d45bd85b67b91674
- SHA1 929509ffeddbe74073f27962cfa1d83a87a2efa2
- SHA512 a452ac2fcfe2e76f99fe405360519141c5a8a1acb3777895dea2416f113646680bd1364ab6d46cbd0499cf26e95071688c05eacfd8cf5816f01645350aa19d8a
- SSDEEP 12288:G/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T111C423D3548955B1FAFC003986754428F5882E2DEB5658E3E3483D1EA27CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 2fa2c91668068c55e130f993f73a93da735b83d86b873bf084e0c41b29edae66
- MD5 11b3ff762a7d73d5e5eb433d0e04c151
- SHA1 4488605105d782dc0f6b2d83ab2b4f88e8c8a74f
- SHA512 f488e802c65a32a0abd45b29523df0e1d0f2e9b7fad2309576dcdd7d4622adfd5a2dad940196c0d6015ec8b8c9b308434da186e1bce90fbdb074762ccfefb1f7
- SSDEEP 12288:vtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T135C423D3548955B1FAFC003D86754428F5882E2DEB5619E3E3483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 cc8d83c44a88176ae176dda136ff63988d6d1a791314f047b2a46920094d94d7
- MD5 31e48360c030eccec1f489b38cac5445
- SHA1 b77f015a8ddc48b08c60f0394393ca258cb1562e
- SHA512 d5d30aac11a9bcf8ef6f615293d0fc8a47404b81418a1cb2bb06b6b1b358872ae2f320ab0ca0aa34d50de6ea0c32f854688eb9bff99b5a5be773a8ee189843a9
- SSDEEP 24576:6fwvzk9RX6wkyAI1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BMnYI1LNiXicJFFRGNzj3
- TLSH T1EB35DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a34ab54acde65637b4b9ecf78e6b9c1808692f511b4675e88c8a4a1e0d326f5b
- MD5 57660a43a69fb734a813d0beb4f10e00
- SHA1 9df2f0eb08fa946834a4c9bebb5bda6394b9991d
- SHA512 2cc8bb83821bc01a3c6ec0effc4ca422c204ebf413812ad3b4697eead25cf33033e07cc6fb6d11d1f3e56d21084e8cb40a0dd50245dc32043e7eb8882da643ab
- SSDEEP 49152:WYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GLNiXicJFFRGN:ZySzPe7wRGpj3
- TLSH T1A3066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 6d0a7856ae39321133a75f694bd70428004f961b095b3b2fd67e2e7d237afacd
- MD5 79f90e18050da69ab18409eabf6f124b
- SHA1 9f1105ade02884d65d9469d65e6da210b0beda39
- SHA512 f06c4bdd227dfbbc28fbf18e9c26aea67792dff21ae2cc4913baedd6d08e8e2be679edbc082b886d98de5d4126da2e9972dd1d930a55a038c1c360c82900fde1
- SSDEEP 24576:D47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D47JUQjqirIhCnDHUPfF/2LNiXicJFFS
- TLSH T11E65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 7ee2122fccb5329379bb5c4cbbf8ca755a8f4d8509fceb0f72ce7f47ac4905dc
- MD5 98d63e3992196ae8002e70575a64a222
- SHA1 1dcd3e185e8fc860de1daef8f60c133729a2c19d
- SHA512 4169352b36aaabdcaeeed10cb4308aee2158fae59f08e6c356bff425673fefee87cdb4621ad44c22ffae3f31631f6d20738b110e5fbf935ee7dbf48bf2c837d3
- SSDEEP 12288:7psfdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F8E4F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB53C0F93E1F3AAD59EE9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 850778d277d8643d1e5af2f5c80ea20a4f4157eea1bf2cbe07b41da29e9a4eb4
- MD5 045dd2de6b1962b1a3b4cd37501bbe8a
- SHA1 063dee2a8ab3e42cbcea61c45afdd00f2bfd30ae
- SHA512 ead8bcb592e83a2652549407d56c228a628793f67216f2e6e2c42b31721cf04a263b08411112b31ca313fec44ce15a602b05cface8f49be05a5b2281d9f4cf4a
- SSDEEP 12288:K6m+VU3fJfQ9b6P9NKvbGgbLSv0SGCtgZJRMtV+q3xg:KXGUPz90vKgvScpCtCJRMmq
- TLSH T15D352950766AC75FC6AD40321E32D1CCAB703D41EE05AF0773C88B3F9576569BAE2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 c19b43ce9078f6bdcb631fd6ede015d6e74d27a230796a462b72366eeb23a078
- MD5 d8a72370d7b56a7e14a72fe6f731a171
- SHA1 7f41e6ead5f8cd00a8eb93e60cefd696c022866a
- SHA512 70f1eab08d12fe5bd5b563e6cfb9355b809bfca9f2ffb06e41cb933be246d9b7acc9033e9910352d081bcab430120f43381f5a78b31025be42045426ff114b2d
- SSDEEP 6144:J9DHoylvYwZCrTGYOTlq8B1DD+emdkUm8KLm85rPPdpJUCS8X72GE5FJnZRv8oZ9:JDJPnDie/Ut6FlCLpx77n
- TLSH T15865FA819537A38FD5FB603207265B4CA774EC07B7495F22B3C8453AD82AB25B0B93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_baa016c62149b9d41c7f415cf46a6ea6_cobalt-strike_icedid_njrat_satacom_vidar_executor.exe
- Size 4.8MB
- SHA256 57c6efeead928740929493ea2bf7eb7c19625cca333a04edd8d6b67f4a53f0ce
- MD5 baa016c62149b9d41c7f415cf46a6ea6
- SHA1 17758ec332ef0576555324340997852a93172baf
- SHA512 757ebc104b9deafb5d6fa3c02d2255268b4f5b903e801a4d9da933c9b95c91772985d2a090e1677e355446f73063fd942c4096891e3fa1a04d680dc10ded18ae
- SSDEEP 98304:n2FO3ZxJTxy3Img6jsjtbhlivpoj9ghi1RebMIg9Cbk/VY7wRGpj3:n86fLy7IZllwojDIg9Cbk/VEF9
- TLSH T19036AFD5AAEC00D4E8A6D13AC517492BE676BC441236C79F0061BB7B5F336930E3E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\5132e758e05f6396.bin
- Size 12KB
- SHA256 1a22908871b7cf7e4189b20b23dba263f90ff27a4b27bdf5ffac9627a5785eb4
- MD5 b74853a23d449c56a81d0ffa30670e27
- SHA1 558a495eccfdf5f60238531c59b6d4bdec4ce429
- SHA512 1d462cd0db83dc453c4bc8e7c3a987fc945ad425de2c79b737021e574671cd23976b1087a3e49d66d194c8c5cfc0e871d901a8b1ef1c99c5b64fe3c95276c91c
- SSDEEP 384:GVcutaIfZUZKzHykVragwNmJtKIVdPs9j:wcIhLykBagwMrJVdmj
- TLSH T11842D0A1FF673E79C3571AF44AE0A30386F51C232F1CB9A104E46E23791DA49D14B616
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 7523b486b1337dda285d2ae7f910d78a87da36a2e145c9f696be077f0010806a
- MD5 9c8564d350b7b101dedf68018be32a27
- SHA1 13bd986502ab992ac8c0a164de3d934fbb23b58f
- SHA512 059c7550c03b829ebf3d6c9841ee28511274b8e58191d96b7df0ccfd6e08e173dd75b842e910e11edd3d09c51f3c4879a2da1ed4f18c61568b5ecfdd447ce10f
- SSDEEP 12288:QF7liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T133D42393468D59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 e450fe35df9d3fdf73c140297928be78b0ff2862d0c5fe54949b86576d3e33ab
- MD5 a839a15b096268cdff118f4b53324dca
- SHA1 2c7670ef0de77befc796d431149734a56e20fd3a
- SHA512 413c537de36f4bbe25aabf1c79a2d70a0a188a0294fa69e57d867697ec9e6c41030a953dda0b57bcc8c7ae25cd629a65e2cf98f0934ef87fd3d1f232b45894d5
- SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Dgb4mBIBhGFoLNiXicJFFRGNzj3
- TLSH T13665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 746ce439369fdad547e34722be2de61b4619260f08125d14dff5f5590a3bc25a
- MD5 f7021e2a3b92a261a3c5c787ec16dd56
- SHA1 963f62fd563f204d035123f8d67e8257d6d7fc99
- SHA512 cd456290fe283c035fea3339eeb1b23063dcd23fb57950ea2cbf16595f67763e0301d2a5ed9be6585e19637a50ae1ce7caf8e135513f157d9309d877399eec7b
- SSDEEP 24576:XG88u8FpJqH1vzria7/m4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W7ZFPqVya7/rLNiXicJFFRGNzj3
- TLSH T16235F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 2c66cd64a8db9475b21ce99a1ce99efaad6230c1ddb54c84cab96d7cb173daac
- MD5 1d0f9f0ee2c7c1e66e0f5ad36bd99efd
- SHA1 5099cd8e991c6907cce3a963d437f0df8354321e
- SHA512 c8d833af7c5550ecd903b90d9d537f798c0130f3164d2de3446d830de4eddd08d6698efb760d9d401157bdffb2ccbdf2dd195837d30179b68155804e7ab8de1d
- SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0LNiXicJFFRGNzj3:zG05lO43b97wRGpj3
- TLSH T1BBD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 3dab97273e8b8657e6c91a036ea9e429628965717d637a9eca613641e64a2e57
- MD5 b9a99240855918cdb9931b144876171f
- SHA1 f35b44a94f01bc93483ae96ea6dd385dd6593c2c
- SHA512 ce00bdbe8c1e21c351852e2d3c619ab470686b518fd554b7bd6871b832fe6fb45cbd94d0525df5b15aa4aaca4e2214b0973cfa8f9b7dbf7a8756637e5527f4ba
- SSDEEP 24576:ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidnG/TwSfVcYG3K/cJHlnFR+IGNe8jg:na5POZ3lJt2pasx2+msLNiXicJFFRGNf
- TLSH T14165BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 68286720e1efa91782f461ee6f4c9479cf34b7a637436dc368a9c901d9cefedd
- MD5 6e91df50bc48d02600e23076733a23cb
- SHA1 e6e109b4fc6d3b989eb1eef6e949cca8be60ab03
- SHA512 05f21cb6d967aa972b059ca45b3ee1e330681c8dd3dcab9f4adf911e8ceb1fe8f6fb8aadb52cd9232a028086ca5347a04baef1ef6cb2875ba858b768aff00bb7
- SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NNc/zEOVHFLLNiXicJFFRGNzj3
- TLSH T118858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 f6316f91fa7d352ed5f9f5f74ecc60cb936ba03d8d2ec6393f8966aa67e0963a
- MD5 79734b5df82f91da994efc7b4d8e5b8c
- SHA1 c2c3fcbf83f58570b7840d8ae8c3ec02a78779d0
- SHA512 ff3622fc9b24a1ade7292a0e17081a440abfb2def809738a40f889c7281376e5bc4092f22fab55535e872fdb98854dba702623138be87feadeaa4a0d47cfb2aa
- SSDEEP 24576:mzkNvNnaFeYhJNtmZBmY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mzMwBtOmYLNiXicJFFRGNzj3
- TLSH T18A55AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 07fe26cffe036b53a561f0e75a734aef85bd6b82d9ef94b4223045f6b0c379d5
- MD5 0d92b45fe462ed3a14b77d29b55f068d
- SHA1 64f96cc368246ba30a88e531a82a704c2cdc064c
- SHA512 8afd65aac5e12998e516c6e27ee4f732edb96a2857c59483597ffe5b9b980177adbcd5e0fd12f7d3679fd8162362644dd52c62c437297d1a0a542da980b740bb
- SSDEEP 24576:dPUr+NQk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dJQkLNiXicJFFRGNzj3
- TLSH T1B105F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 2fcb4597c966b6063a1eb484565c46a46ff31a5b4291658027d0277fb4a8c268
- MD5 c23264d8bdd57ff01cee1e0477b129c2
- SHA1 b4bd30e9948634a4a4e34304104f282bb63886bb
- SHA512 c9533738fac32b41d446a99eb4bea15b3db218e098e8274d7ad1956543fb4ce0aaff8fb11294358cc8a3c07ff233ff8aab705bfa468dd0f4b964bbd71785deac
- SSDEEP 24576:MD3FHshBIYQgAt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MDVHeBIAAtLNiXicJFFRGNzj3
- TLSH T19625E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH