536cb7ca48db17a3ed4c5ba5fc1ab607bb782fbb5e610544e6cc535272e3502a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260724-jhsahafa95
SHA256 536cb7ca48db17a3ed4c5ba5fc1ab607bb782fbb5e610544e6cc535272e3502a
MD5 e1c262de8b30552bedcc2dbdaa92f197
SHA1 97fe9ee623537611f87bcdc95dcaa10589f470da
SHA512 a7ac167a3da8e3a78afe5535491c60578c414af4ede5abdee6df9fa3c13d6739357366fb9d38f014be0805f4fbb31c2d26e29cc17a962021d3779f6fcb3f9687
SSDEEP 49152:9qgLkwBTKhjBvqKHjUCQOrhjuwJSt3cZZM/DVAaTP/P3BjwQKKYpWwl1+NY:EnjBSKHjBGt8MaKYpfg
TLSH
T1D5067C47E6B941E5C0BBD1398A469A57FAB1384A873197CB47A0475B1F23BF09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4080	elevation_service.exe
1784	elevation_service.exe
4816	maintenanceservice.exe
5956	OSE.EXE
3400	PerceptionSimulationService.exe
4072	perfhost.exe
3960	ReFsDedupSvc.exe
248	SensorDataService.exe
3544	ssh-agent.exe
1752	AgentService.exe
3492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\18ff9813238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049bf00c03f1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ecacf9c13f1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009afd5902401bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e93c9be3f1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd6e19c03f1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055d24502401bdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
4080	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe
1784	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1328	2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4080	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1752	AgentService.exe
Token: SeBackupPrivilege	3960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3960	ReFsDedupSvc.exe
Token: 33	3492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3492	SearchIndexer.exe
Token: SeDebugPrivilege	4080	elevation_service.exe
Token: SeDebugPrivilege	1784	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2868	3492	SearchIndexer.exe	100
PID 3492 wrote to memory of 1500	3492	SearchIndexer.exe	101
PID 3492 wrote to memory of 3312	3492	SearchIndexer.exe	102
PID 3492 wrote to memory of 6020	3492	SearchIndexer.exe	103
PID 3492 wrote to memory of 4896	3492	SearchIndexer.exe	105
PID 3492 wrote to memory of 5992	3492	SearchIndexer.exe	106
PID 3492 wrote to memory of 5752	3492	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_e1c262de8b30552bedcc2dbdaa92f197_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4816

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:248

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3544

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7139bce58b65d0608d13a3cdf250db725d4bd682323454698568556eea42ebfe
MD5 d0bd1237633cacbb13181fd4033009c5
SHA1 40bc985703f506d57c59716572ca72fce0baaf7b
SHA512 1e70f097b8ef718a15d0a6647baa0b553f4938eb4d0429b86e8f13fcb9961f2368e04d8a05a19c0ab186ebb2adde58d82bea13ed39b13415ee1e88d8e32e8f27
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnhQKKYpWwl1+NY:O3q6sjBSKYpfg
TLSH
T126D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e15f0c7af5bc3f3c83ce073a64ad694fc05a70ddd3016e16c66e306ebfb9bba5
MD5 81b474996806980df43ff362651ba1dd
SHA1 8b4f80c9805a2402a26d82401fe7c82d5f109414
SHA512 ae1b81ccedf79c8a144a0d820df7ddde00bae469b8781d8545ce985863816b5d580ae8cc12ff6b682911e4f9e6611ab7f78156099ad81f4cfc966ece90df1593
SSDEEP 12288:C1XLsswWkxy2lRq2czA81JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rQ:IXYfDtczA81voKFLgYHJWwl24C15rDY
TLSH
T15E65F12973E508F8ED67817DCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fa45170903931bb206ac09446c17cbc631008d180d18be89b2343570ce91af92
MD5 4e323df629a2234cc7a96b3c5f54ec76
SHA1 8c18776b61e21ad1d0bf269da9d44105b03a1daf
SHA512 91b7ca21455dd8e57e080166d1c88c81f838ff0b19f57f8bdae1cd7f0778f2ec89168c690e340ba0dbf594517ea19c86a6e31ecee76f6052007a4428b1dd3110
SSDEEP 24576:50Le5ji0hmxxrMT1voKFLgYHJWwl24C15rDY:5Pji0AjIQKKYpWwl1+NY
TLSH
T1EE85AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 96d86ebc649b907a68935e1fc1f71bf2267bde2b4f903db110cdea6bc45fa382
MD5 59d0a01df9749dcde1d0e1c17bdefc86
SHA1 3af0de20882e50b339ddda92991db29faedc8754
SHA512 621f30a92b61f97178db6dd8caaaa5f19ab5114c4389795c08e318b31e7046bda68ec843728f5875df1980ef5b8cabe31e094afb1de7ec07345d46ad71f2a762
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyuN1voKFLgYHJWwl24C15rDY:a/ezSC6vUzPveHjykQKKYpWwl1+NY
TLSH
T1A0756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 02647531a82cc97bd9e3af7f1a45f60bd573418a7c3d11e31334d200f38532e7
MD5 d45f684180709f3265a316c2ea20a272
SHA1 c6d6be2e39006256ceeb58922acebe9c765a4cbe
SHA512 bfd232601ff321dadadc5032b7a15415b257058c2af0d21405048d55ef6eef4c80a8a504f8445ce4bed0b30380ee6f8de0a436c660570a18af9098610f2f2657
SSDEEP 24576:JVbqPb88hv/l+Y41voKFLgYHJWwl24C15rDY:JVO88hXl+XQKKYpWwl1+NY
TLSH
T126559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 074fdc0ca049345e79dcdade85bbdb8c439aadd991dfa77fcb40e38af7ad1ed4
MD5 2d3a6ee580a71e0129741be0410a77f6
SHA1 6cf9972906cddc0ea134276fae951c1f96e085cc
SHA512 9b096268b08da1775669e4a9e08c446ea152ef827681503777b984712722910a7aa5d6d072d713bad8aa78c3fa74b201235ff97209b4054257b341d7cf2c4e0e
SSDEEP 12288:wL/1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:wL/1voKFLgYHJWwl24C15rDY
TLSH
T1D545230771ED80F0EF5A0EB5BAEA64478130CF0858C84A57D5117ABF28B7EE8B71E159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a934dafcc02c9816b05c43e6011a6beb1d9e2fec9ab8565f1cd07079659561fb
MD5 37082af30e2841b538bcaf5ba77d171b
SHA1 375d109de941ec217b961de13d36b090b3a11c67
SHA512 409cf113bc000f48e99c24e3854c1511a83214a7ce3778025d644509b079924d0a7bda80a54d45a9874deae4badb68b54f97e16f585cc60a00b442f95b8f9d45
SSDEEP 12288:GeBNUbTVO86Ug1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GJIUg1voKFLgYHJWwl24C15rDY
TLSH
T1D865CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f69e48fcafb090273813dc379426e34ec4c456e93a39a1745247dc17cce7721a
MD5 e6785668276eabaea4e7ce495896e267
SHA1 a6f50d2d3f41f2a7f14b35b8285203294cfa402d
SHA512 17cf26936d3906b1ebfb640430665757cba6825d622c6fd3df08056989997824fe629a345a06ca3e4d51daea1dc784d6183d909a6f2a3904bb565a430b8fccfa
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:OQvGAdlCEL8c/DRNw5CvKYpfg
TLSH
T102267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1cdafdd14379afb5a853a9606c23bc20d531d54ab4f4a7267e88bc11e4285a73
MD5 92bfc4eaca47e9c75cf4e03a373564a2
SHA1 2835411b530d1a406e5ba160fd42b5baf00500bd
SHA512 067348bd1158265a29358831603f3cb4cdd2d04cf253d16f8dfdf718c943e4680066e22ce6dd4ccf56a6a47da794b813c48f00bd6c0caf018c01038c7c9ca9e2
SSDEEP 12288:6AwSfxL/2Dc3RDLLmt0LDQewsAjK1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225Z:P0ewsAjK1voKFLgYHJWwl24C15rDY
TLSH
T16A75E031FA74D036C77F0DB61B26D706543CBE204B911AC3E3A89E9E59706D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7a50965ec33a353c7f8f783a64c279c86629757ecd9d667ceedf70380f4ac0a2
MD5 78330ba3bb9063d8887f5162c8c90e5e
SHA1 995d7b7925c3ac2d5d4192f3fb6105cccbb26ce4
SHA512 1dcbcc43cc35710894b0754dceb75acdeb8d2f79d49ea0f2b88be24c213d6c81d6ab85876c7e8857f42361c25c324ca2840ed9a7036d741b6c89bdf4132eaa2f
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0I:uUEtQevvqc2W1cpV2tI32H
TLSH
T1B9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7abd6536af87a96d40e3da3eea80de8e22db52317079c72b8aa30dcde56d890d
MD5 81ee89d4cf7c1e01165ec9967dce98c4
SHA1 1ce4be41c0835cd7ee46483ef2313914bbb23887
SHA512 2053a71388b31b0ca886173dee05c3bab75e4fcec73f852ce86fe742d8edb1ce52c42dc1d58b8a8dec6f2ffaa6243658ea89cd318c4011e7af57e9baf7a7b862
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zYQKKYpWwl1+NY:MoquVjnmbKYpfg
TLSH
T18ED58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 67bedc05e72888f518098550aa4a3c547947b17532727faf5d63fd18c26d4f09
MD5 c2e5d6abd68e05e9057ea8fcde753a6f
SHA1 a07a492e538bda0bdfaad4846171819942845a77
SHA512 27ff3ccc3dc1f79f67f4fdca6781bcf557241f5d76988f7fc5c6457277e8effd759b21b9ee54ac67aefd877bc4083758ded68c1dc4d51207f1a085defc14793e
SSDEEP 24576:SAhGL3IFoiwtA5l7S53x1voKFLgYHJWwl24C15rDY:SAMUFoiq57QKKYpWwl1+NY
TLSH
T16335AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 43d4832876e70c6fdf9d4e9d30cd7cdd1fe8bf76cffa9f787f31f9925553d877
MD5 8ca2c1afe9e8425ebbf0e85d9e0ca4fd
SHA1 8a5f48574462e0498a0f2f1387c6166e917a4553
SHA512 c3f714fde85e95372bf79f46fe92401d864ea41583bc3044153c8db83431e80155aaa776d816b96bf39a45951b70c1389a7ed3fe8c6a2b9f578ed07074103035
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+Ct1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKS:wwu4OWu1voKFLgYHJWwl24C15rDY
TLSH
T12265F14A72E90CF9EA678639C597C036E7B2BC012A64C71F5760C65B2F373616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f828134da03309a4cedb8175f3fde3d1f7cc7ec06fa8b7554b64b9df63ca72e4
MD5 fc3cebdcd21e6f67abfd3e41904fd0ac
SHA1 56e2ca951f03754fe66b3197d292f297ea3d2d06
SHA512 f3ba3ae0af4a03f664db550f7d7b304d46e8c7f9c8e9b9613d0defb16bbe0fbe16270ce57f05d8bbd11499ada1ae2193fac826a636caae0395846042742b773e
SSDEEP 12288:qeZ1Iy61JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:nZu71voKFLgYHJWwl24C15rDY
TLSH
T11A55124A32E860F4EAA7467CD9E55506C372BC1627B443CF512162AF2E73ED52E3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ebcccdcda29b2f4296160dd4a0548bc0cd3524d12c16e42472486c2a697deb41
MD5 19f7d81d6f925f6dc4f536608544d2aa
SHA1 3bc70be3a573923d109cdee7b454abe145953135
SHA512 a29a57f7149eedd0b03aac17b1031596ad578a51fca4b3e29c1f15d6a2a4ed14241692d035fcd11338f05d81e18b2ad35d651dac9d0f70f3f46c19483eb976f8
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:TQRQyi36YOcPbLvw2gAf+PN3mKYpfg
TLSH
T1F1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 147bd5846f9940a17860630ec74ffd1ab463e64290df9a3740e3b35fa1224c03
MD5 79694090edfb3cccc1c0d578ed4aa143
SHA1 7994518e0a97f67d3e9d69614411845c219c9f70
SHA512 d404b80b9181506aad2535248542029c1d4c7c19ed6a3a7b6b9236a4aa64fd57e18aebde319f7c16ebc526b90cb1064c3fb118dd3670abe21d562a7d6282375d
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:0QRQyi36YOcPbLvw2gAf+PN3mKYpfg
TLSH
T17F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 75d0dc534ca398c19965b2aa2b3b5329028afa4aafa2df7246dde1cfae14f446
MD5 32c92cafa77f706cc0e56f4c9f863d5e
SHA1 6887ed14beaebbae5e0acf06715204610e8ba014
SHA512 7760bd59b306d8b3d4975d1d36453fd02d93e4663f5619f57a67c233b92b44c7764a60eaf403a1f1b9d55a69442186e4a8326b8e077fd29e6e5c555f30db0887
SSDEEP 49152:368Qg55nhceWu7PNU3/IQKKYpWwl1+NY:hthLRc/cKYpfg
TLSH
T1EDB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d4fdd865884bdc706dcaf05571428e8b2da1d99f37c4b4662872fc155b296485
MD5 ca45caf3d29f1131daa8a57401acb725
SHA1 d3460df1294210dbd19de1f974e3d540def28db5
SHA512 65762858fec003ac2d6b2f7c74ee385f958a4d9695a796fea6d65b23387d2555080370732999caabffdb3ea0114d1af25c35bd223b1afecd8c5d1ab6c1386f71
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Q:Fy5112gYy5azzVvt69nLKnhZxKYpfg
TLSH
T1B6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5b1737ba816e9a7a999babe39237d7085c7947b7158ce73e91b4c93a8f4e3511
MD5 aac84d4b272937315a9fc50255ef480c
SHA1 fab537e4fa4b926cc62ce70b3f0c6d30e2e2b5a6
SHA512 271c7bafea58d0e300a108c260b844d2bf51ccf07330ef678241f22b1a4bee050d05450b3c30417e27499b99a9ba55889a911d93c260849f1927cb5218492e93
SSDEEP 49152:bB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5QKKYpWwl1+NY:Nu6Jmdxd2d9KYpfg
TLSH
T152D59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0ad74b6a473736757908689278733813b1405facaad8bb65f225afeb17cf5c7d
MD5 06cd180800bf03603fe43335af8b8d0a
SHA1 9d314bef250f5a6a1d810bf601a20cbaf17eb055
SHA512 27ed2d21ce7326ffc8311510e5d187140d10e86fb38566d104e4302d2e3882acac6ab953689e67be14ce81cf4a79ba998b60bcf77c4edebdc6cf41b525ba8349
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4xCQKKYpWwl1+NY:8mifPWRbKYpfg
TLSH
T1C3B5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f753d399e214b5313863daeed14efb47ccb908f3ff9327a741e83dd3cc3300cb
MD5 b62a6fef635b7b55ed8736dfb891cebe
SHA1 5bac6e51bd188af7743a3e244fefd48788b3a07d
SHA512 493b5f31397f951804e6e179fb0dc0fee8c17c8cd1449c954e8be06d7310899cce57aecfffccf42381e52e9a24f2d723fabc9052666717e27ba5145c6a7a6b1e
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqRQKKYpWwl1+NY:u5dKii61FKYpfg
TLSH
T177C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3b1990bcef4d0742f5d05e22ab540dbe5cb1a7b30c5f90cea65304d36aabf5f
MD5 63e95f5d9aef5a31338cf4e5cdf0691b
SHA1 53547e57ff52dd057d595dae4bcb93c829db52ac
SHA512 815a9f4d71219e4a7e996c0bb55d87f0473ea3d57a4ee262f63cbdcdf21b2704f6538487fb1921b826839c930021fc83dab4ca1fb994ecc4db588df5d7efb57c
SSDEEP 49152:rhtSn8EApI0fig3giDn0AP5wGQKKYpWwl1+NY:qX2imph3KYpfg
TLSH
T1BF95BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8a53907dbf51c3ed2acc5e778725d61a708e200d44ecc8923402571fcc9b4c53
MD5 d01dd2db3c42de8ccc7437d37e999ba2
SHA1 94a39c743db876eff5ee027d3249746993c78030
SHA512 689aec76f1c202d8fa83865a31fe03cf6f5d277d03d7624b990465041106f4ed0aa7540182a5f693d9ab212f4241d9276693a2155c00ebdbddb4d7ebce9af817
SSDEEP 12288:ZH1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:ZH1voKFLgYHJWwl24C15rDY
TLSH
T1AD45234B74EF81F4EF054AF5AAD66047C1249F0AB8C8066BE512756F28B3EE8371D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 343d53c67d2f677da5fc8285331931bbeba7d952ef2f00aa8e951a74f7f51c6c
MD5 4a0f40b4b7d1d235bb7582c9e9e24d1d
SHA1 34ae6632eda249d5db10cbf2c682b67fed87a72d
SHA512 71d53c5e6ddeb012cbc7557038784e92a156e95de0ea5745fcc2165db971e888a4d94349d476bbfe2c977b79b612e3c05c18bf9c5958505704ec36922bf7e87b
SSDEEP 12288:9G1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:9G1voKFLgYHJWwl24C15rDY
TLSH
T15045234B74EF81F4EF054AF5AAD66047C0249F0A78C446ABE512756F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fa4260e4ec91e79933a35e06fe2f214104cbc11d6a277e46eac95bd391f7c300
MD5 b3f0a7fe8dc1ed55124e3dd017d6d4d6
SHA1 f7a9d3d1eb46dc011198ad539fdab1a8693d8564
SHA512 5d73f721404f86c20012d69642997ee30d3887179571efead4a300bdf93e82e948317f3e5be3641a025e089f5dba5ba145e8d4712b178ebc7996a7b1510b022d
SSDEEP 12288:0I1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:0I1voKFLgYHJWwl24C15rDY
TLSH
T1B345234B74EF81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 75c1e2408352a5a9d24f3a3edb8b7c1cba1f8b2617cac6731872d2e980838e80
MD5 5371df831fe64b142d13d6b4fec3bbfc
SHA1 4ebd85826375066bb0e314d3c5857b95bb3edced
SHA512 e61e85c4354f281b2e3444b47c327137618f8093797d0e37ae7e1cdf8e895ca15681e9b9c6d3ae1d1b43ef1eed5eb5a3a8658a88f1914055b1f4fc2616e9586c
SSDEEP 12288:0VR1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:E1voKFLgYHJWwl24C15rDY
TLSH
T1A245230732EE41E0EE16C6B9D9A65003C271BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 320e1517bebb0cabc9202ee4c1761eba207cb8f1360a9cadbde93efaa5d93d52
MD5 2841c206cbe5ced2911ff63d683dc818
SHA1 efd0d56a7dcb099aea85d768dd38c656d3a023d1
SHA512 02956031ee0337baf656624f861a0e95e0090e073cdedd4b6b6613ba7ba8668316c681e0d1728ccc91e6cf5b0274bc05aa43b61b70f206ad493a514a1c637666
SSDEEP 12288:IJ1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:IJ1voKFLgYHJWwl24C15rDY
TLSH
T1E745234B74EF81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 56507847de85915505c65d18a21b574d362a0cb1c66d58a4ff7a7ee3ec9410d3
MD5 75d53851e2d9ad9303736287e8daa760
SHA1 6b9076f7a9f6837010c03459d26b0625ec5ff7c0
SHA512 b180465eee8a8b860cafecfffa0bbda57201229c44818ac08cb8d2503b6bbc4a22a9958137a827f5bc75c0d59f4e062a73e641932e7c8ee14864e8389aac810b
SSDEEP 12288:yS1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:yS1voKFLgYHJWwl24C15rDY
TLSH
T13645234B74EF81F4EF054AF5AAD56047C0349F0AB8C8466BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f7cff87cd31a392b5cbbf5e80bea4d2c7d0ebd44e5fde84b4544f4451e3918f7
MD5 0cedd7d8be7f25942ab862a69ebc581a
SHA1 3bd6e2dd3a30766cb28fa6f8dcadf2c837cc0bb4
SHA512 6814628f54b07e8e47906618215ab5c725fec0d0f75e516005b074a74badd59b94dc370eb1787f54015f3a80262ca907075ba7540d36242d36580868bce17dc6
SSDEEP 12288:C+1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:C+1voKFLgYHJWwl24C15rDY
TLSH
T1DD45230B74EF81F4EF054AF5AAD56047C1249F0AB8C8465BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f29cc66db2e4b3a8ca1716e8ca56def1553f9d38f6f1c34fd0d2987f23d2b286
MD5 dff09bdc5f17c438b4c5526c3844ce1c
SHA1 e181386b454ef846f7fe5f940e861ef9c237eea2
SHA512 c072af4f4cd0a8ddbd2c55bc6ab7fc9d1914c6219d2c27ee07c1054461ccbb5f442c1d4d5e7dbf9dc60567a95dc77c941e0732e65193c221ce841ea25d328c03
SSDEEP 12288:liZwbVzzFEoS2cPvym1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRM:oZMRzFVSOm1voKFLgYHJWwl24C15rDY
TLSH
T19465029573A408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 884e73f77a4df6474dfe22b99b82600162463658e6c72a83dc386d6f10e730e8
MD5 c75fa53899f72ee2e822fb89523a9f58
SHA1 f16b4c2d35c12cfbcb00f27a7aed1e8558ff8275
SHA512 deaa96fabe787efd59f0365d8d9050f39017ff2c738a239500ded471495b1e7b2336b35c415d52fe53a7839908b08752cdef55e2d654495dcf21a37a2837d63b
SSDEEP 12288:2r1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:2r1voKFLgYHJWwl24C15rDY
TLSH
T1DD45234B70EF81F4EF054AF9AAD66047C0349F0A78C4469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 224e3d5432f18c1897b82c8ce4dcc1ce6b98d8e6da06b5cac073be661273c4bf
MD5 38de19ff301660b266df275de0d3d25d
SHA1 72baf43ee4182306a916f90ad6f768fe8fe15140
SHA512 fe9632e6a8f1ea33f8505ec93fd3a98e2ea254761f62fd3ec2774ab92ce221fa76e356bafe5c4fe43e05c21b606727ee665efd1e9a70882d15102fac15b467ec
SSDEEP 12288:Kv1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Kv1voKFLgYHJWwl24C15rDY
TLSH
T1EA45234B70EE81F4EF054AF5AAD56047C1349F0AB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ec6579ba8ae58e521dab32cf9d52edf05877144497132b0c1b0e703210f13699
MD5 c0ef519cc215cb7f854becf3ae25285b
SHA1 4ef3d658b7a79e0ff74bfb1734fe1c047e24160f
SHA512 6ff1c5f82a0837830a4ffbad73535a582fde178a8d8663a456d3ca3c591b2531e06d27cf5506fd341398df15e1f8f3d6130f46cbc59673295575bc96d672f92d
SSDEEP 12288:pyPz5L861JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Izy61voKFLgYHJWwl24C15rDY
TLSH
T1D055020773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ca226ff7071b679e5decb9843cd1a17fa9defd450b584e488aacbcb6e83b17e
MD5 5cba20c5ef528f06466473de9faa4575
SHA1 0c2f1279c9d28a8fc88f89731a0f01fb78fdc370
SHA512 b7602823e9720ced6ae4d046d7263bbf7fd2e5baa2fd67ef339d0562ac270f04884a25b2b54c09f72f4d6f3d4c450731e5e25c821ce5ae1e61a5d6e262a3f26e
SSDEEP 12288:Jr1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Jr1voKFLgYHJWwl24C15rDY
TLSH
T1BF45234B74EF81F4EF054AF9AAD66047C0349F0A78C4469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fcd6ff60559fcb1b0dc6083cf6db7392d8bcd82030bd371a35d1d97d02237ae9
MD5 10d71bb538601a0ec98004059a7cc588
SHA1 eeda2f223bfbee890aa24717b8593643491c8379
SHA512 72cd9cbe69a6db4fe85d397bf24f7dc93410f0a9675f4e98f644d7dbc392c8fdac50c653a10e5aa4dd1f81fdea4baf401830c256403c1e56b65f6c07e18b2bec
SSDEEP 12288:Wr1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Wr1voKFLgYHJWwl24C15rDY
TLSH
T10745234B74EF81F4EF054AF9AAD66047C0349F0A78C4469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9b5385e3d654f0e8c108d00119840266944dd9f1ba6cc2ef544c03b4c4edee8d
MD5 0f0a83a1d09689f4e714ba257409fb2d
SHA1 8e3e3d729aa42eb367be4dadb0a2cb5706447d16
SHA512 99adc0266a73bddf39f031a2c9d50e93d98b9fc38347a6543ee7b01e563124a8de980a000d2623a962fff6edfb28b81668da184355734ca26f5fc400b947f777
SSDEEP 12288:YyPz5L861JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:5zy61voKFLgYHJWwl24C15rDY
TLSH
T10F55020772A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7e85c52547932220fb54f10f94b67e324967b95c9eec2054febf1d24cdc22f65
MD5 4d7e667ca236c63e360e9d0abc26ef97
SHA1 0ba7bd83524b1f12dbfde0dc95d2db438369b875
SHA512 3beea12a9e52a96e074e669f1b801545669e2f0ee1f414d310153800fcaaa80ce02416ec0fcf34348771a61ddbcb3caa577928b2579e611cd277a641cf5bd6d2
SSDEEP 24576:kTDaLl3z0zDY1voKFLgYHJWwl24C15rDY:kTuLljfQKKYpWwl1+NY
TLSH
T1AA650295B3A008F8ED67857ECD558806C2B2BC1A07A0C65F53A4366B1F337E11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9ff782f7b70ae00fbf2158838324242a2faea5dfe50d5f642b0079c1ed0f21ad
MD5 57a460493912f28b3690fcbc8ebae8a3
SHA1 87fbfc7a31a6e44b7fbb0ec1cde3d041aaa323dc
SHA512 18a8c5cb67cb28f1179b41aef53ca95665a39366ff150820ad0b0dc6a203a69236ca20263c6934f203ba5f53964b86a6e9e8195cc17e67650525475cfd94907d
SSDEEP 24576:J3vd9CHKy7GZk1voKFLgYHJWwl24C15rDY:Zvd9CHKyaQQKKYpWwl1+NY
TLSH
T1D075CF91F3E810E4F1B79A35C9765512CA767C5A1B60CE8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 de639a48e7587536827ae428d263460054b4b74ab6c457664533519aec3128c4
MD5 e6ab50d6974090e9ddc443492ce1b0e1
SHA1 f7d8038c666a54db9220d39890111a4333f99bc7
SHA512 4aadd587eae39b07924c0e956f2fe0eb54a481dbe609673ff0255bf5c4c601960c47cd0113c0053b71013ddc4e15d3b86bad047a969da66218f70fe61b11a3b3
SSDEEP 12288:vo1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:vo1voKFLgYHJWwl24C15rDY
TLSH
T15345234B74EF81F4EF054AF5AAD66047C0349F0A78C8466BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 652551eee785475f0e3ab1840af29a336a6dcf5c440a73169feeede5f6d24b12
MD5 9ec8662a114272816889392c00043139
SHA1 9458ffeaa52ed7dc17d0e581982e4c4d5518a93c
SHA512 6a414f4ced42cbdf160f87c78e1b1e347d8762c9661d3e97cbab070843835f2b679aba35a2cc35ffc5a23d02dceab5495b1feb094f9e5d91f73fce15c6abf8c0
SSDEEP 12288:Da1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Da1voKFLgYHJWwl24C15rDY
TLSH
T12545230B70FE81F4EF094AF5AAD65047C1249F0AB8C4469BE512757F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cbb1cb193d36c9d1d58347897e6e14bdaa5fedd2131e5f4185fafab4aca5f59f
MD5 db8ef015208cc494472ce54cf45ec16f
SHA1 40b0f808dfd7bcd3ef1b735da20f87ae76cd00d4
SHA512 f9be7cc43f8dcbf5d0f967900b974ebadaacaaca027f2a245fd5c33cc16efdbcd3af79f111321e34ed8343e74b94c3b39f44ebf236d019c4aabecca41322a41b
SSDEEP 12288:ql1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:ql1voKFLgYHJWwl24C15rDY
TLSH
T14445234B74EF81F4EF054AF9AAD66047C0749F0A78C4469BE512756F28B3EE8271D0AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 deba96715d4fd5598f648c5c8546c07dd4c90aed7a230a645836f3061984c8e8
MD5 56a18c98453d75049dde347635f23b89
SHA1 922e56cc060a2542aa0af92d33501a1ac9119be8
SHA512 ab48a29736d3ab0f20852489c02706a63aae4f4f121c619a00f0ae6597e4181e0318eb68958efb0776a92c456b8ff9fa2b6c986edb4eaa2dec080b6816d569bf
SSDEEP 12288:Ur1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Ur1voKFLgYHJWwl24C15rDY
TLSH
T1FE45234B70EF81F4EF054AF9AAD66047C1349F0A78C4469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b997afb66f77114fd81671dbe5cdf9640948ac12cf9cb9405ef7d8b9255e20e1
MD5 9ee08c0c96491d74e7276aa394e6531b
SHA1 9f8a6458cda9cef1a6103fda8f0787a2035032f1
SHA512 d5b410ec4d85f9a82bdc80d8d2d60987407e8eb303bd02f47889fb8ca0dd3fc96c324ef649475c1d2f87e8e342960b6a17140a86ef604d6fa69b0fc2f9521688
SSDEEP 12288:uo1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:uo1voKFLgYHJWwl24C15rDY
TLSH
T1E045234B74EF81F4EF054AF5AAD66047C0349F0A78C846ABE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6481f2dd174561b4f5f0e2303c01113910da281ad0805ad7a48f36ffe34efb5d
MD5 002bc33f9eb4358173c7be3cf9c264fd
SHA1 123ff78ca2f4a697541ad724bd29486eab7b2b81
SHA512 cb2858b5c64f8aa6c2b3b884db6f98b1ede2edb144aa30be76742caaf541a8432c9bfd5aa0569293fb37b64bde724e84f7ad2b0d385141a8c54add087c13331f
SSDEEP 12288:Uj1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Uj1voKFLgYHJWwl24C15rDY
TLSH
T14E45234B74EF81F4EF054AF5AAD65047C0749F0AB8C846ABE512756F28B3EE8271D06C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0fabf93d8e9865533effe7aa07d00ed28ddf6276e4ee4f71acc192eec6c10a6f
MD5 5db056c24a97823159afc2c13c03733f
SHA1 b12803c8791c33b6099673fb861802ff4d015dec
SHA512 062f8b3158735f98acea2d5c3d2f031e61e6b930523ac2f1aa7f5439775278f39a2586f20f97647b2f3bc4ddfb60541890b57b334fa424a01d73f95a3ba55faa
SSDEEP 12288:RJ1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:RJ1voKFLgYHJWwl24C15rDY
TLSH
T11145234B74EF81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 71917ce5023b2b3851820183e67b4baed25c11326ca0fd61857f6fef3edea30f
MD5 3a5bf166e630ed2d791e49078f52b59b
SHA1 a42e70e8e75ccbb54bc02fab9448d701faef9610
SHA512 e0cdfcf1200f8de42001f6c3f7a0291fd9e4cbd71d5bcffa2af2ff8d0d710b5b212f52b5cdd0732ba9c2eb373d465e72559ed659d619ac72bbd57421580f2fe1
SSDEEP 24576:afwvUk9RX6wkyAIf1voKFLgYHJWwl24C15rDYi:KMnYItQKKYpWwl1+NY
TLSH
T14085D029EBDC44E5E177923C99B7460AF2B178591B31C2CF125A53AE0E33ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e202046875710b5376e4f76ff5c92959363e0233c4e0f6618f496f38eded132a
MD5 f2748107c31c530afaad49781cd9ff4c
SHA1 1115fee615c4b97e9fdd6ced0d4381305f503c3e
SHA512 d047dcd6dfed14815363efc33353c5571ec5bd860781908cf03fcebe8502473536d2678315fbe6de55a37d8c84b5836d551945ecaaa681dbeeed512d7a76ab3f
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mQKKYpWwl1+NY:zySzPGKYpfg
TLSH
T103066C57A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 03fabd9e4c58fa127ff794fe9035e6f6d66f53dc71e13e443c74f1895995e807
MD5 af008647b5e05458fd9e332ff55ea139
SHA1 1f9603e30a84208c32943891fdcf662688a2c3ed
SHA512 8b6d88bcf16306c13d397d1d93be1cd32e616aed0b057f62e1941d141e39ec105d8f15f3b55119b89ea39f9e460c9ea6e58640def8d3df4c5068677a47d297a0
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYW1voKFLgYHJWwl24C15rDY:y47JUQjTirIhCnDHUPfF/WQKKYpWwl1T
TLSH
T13365AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 29d5e8ebcdc3cf6e838238b4f8363b263513b0e3b32491aa8670a75949b897f9
MD5 f0965b4b278291d29aa31c8f28b3f2f2
SHA1 ead295c5e02a5468b25d4ae2f1a82e446fdd189f
SHA512 1ce2565a29f8b191db72bd80b8d1fec309352a1c59a8e8275a3e6fed83e686d75d85805cf49da54f0f3f77ad63a0e3809a469189c0a735c51e1188796ae94b0a
SSDEEP 12288:Bbsf71JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:c71voKFLgYHJWwl24C15rDY
TLSH
T1DD55F10AE29802E8D56E5279CB965541F3337C2597E0C3CB92C0F53E1F76AD46EEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 353e3d9ad949f4e9c7e65ca5e745f5209b23817fac300e74f4bfbacb034417f1
MD5 1ed4c7dbce30db471c85d015a8475bb6
SHA1 2188a52ddf785b53d2df543aae93d4b80fcd745b
SHA512 6b4f902de530445ab5c97bd47d7cffd453a5cea7aa91d08582d06cef253b436b39341e8a247c237b206ab2947f1c76c2823c73467eebd0bbb0303546f30143ae
SSDEEP 24576:T5TFFXKwu+WDjXyjSAJ2KPxZceTjRJfxQy:T5plKw8PXyjSAJ2Kz7TjRJfx
TLSH
T14B654A50762AC75FC6AD80325E32D2CCA7707D05EE446F0773C89B3F9576668BAA2381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a962b72584ed26440103eed8f665fc1fba3bbe6db6cbff4d0662482b7203d98e
MD5 c2c156dd12d611306667ceac3c5a649a
SHA1 d9411995d3c37aaa4111e00835cc3fdf50ff1f5e
SHA512 b84c15a419c23fe459b6e74bb03b8f815d92a98cc6d9e99c6df724d34809a30f4792b31a9fd96d66d319bd3796e39a7b8a2396fbddf3434ee14a3b75676d6ff1
SSDEEP 6144:ec1y9WXyjSAJ2+jE1s74V9u+IYKDexHifhgGdyYKDexHEpzPkzwvT1RsUVA:jyAXyjSAJ2u74VVIvI3pHBq7
TLSH
T13B65E7816137E3DFD1F650320339AA8CA764EC07B7496F26B3C8453AD46A725B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cb8068a39f982f5eb78f8e642a816e8848d8b67d2f5c28b1a72c8382000ffd1f
MD5 2667e596a49fecebd75e4b5af366de34
SHA1 599a1d1f1da07adc71c92ef357d8e1c1b8c9a6f9
SHA512 fc99f064a301c095626397497ab76f74a9b47d90b425548461b9ca7bb1d6dca4fe02750cba52d9cd83342dc01847d296739bb6004ab5bc8496f7c6e1f5a439d1
SSDEEP 12288:C07z1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Tz1voKFLgYHJWwl24C15rDY
TLSH
T1AD45230772EE84E4FF394AB469DA90128129EF195F8442D7F40172AF2872ED82F3D25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6d4c91c8f6e0587d17ded96e2021d4d2c9f4e460e3631b37686fff3b65235791
MD5 662b91efa4b2c0b9228a82462a58511e
SHA1 be1c4e51a241ae2b712a2b558e2500876963361a
SHA512 1122287a2959e09024b28b008bc653308ce40891920673a9f3e19921d6cf181ab862addf7c6ef264effe2aa9ab75eb13acfdef970c2a6046c1a65d6124d85204
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYN1voKFLgYHJWwl24C15rDY:Dgb4mBIBhGFsQKKYpWwl1+NY
TLSH
T14765AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9eda65c98fcffd04d43b7b5592c479a907cffd0f2d5cff76cec3e3b4386201f9
MD5 68bac6bfb1a3f3e77dee2d6d40bf0340
SHA1 a87ad86c5e9dfffa22eab9e10ec0b9e814cb23cd
SHA512 8121e3f5d51cf12c054bc7ea91df10db062fbdd49c77265e48fafe3bd3091333f3672e1207b4aeb57c06dea716e1c65622bdecd4deddf9dfba2db7d3ccee4c3e
SSDEEP 24576:lG88u8FpJqH1bzria7/mm1voKFLgYHJWwl24C15rDYT:I7ZFPqVea7/XQKKYpWwl1+NY
TLSH
T1E285016676E501F0D47BD13889864663F6B1B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6b647658e83b958b432163cd746458dde3883e33748d063d31d1da7d14caac8c
MD5 56ddd80d21ddde5f1fb64cb728bf5b5e
SHA1 a9804663ccfc3652a44a682c30c167176b8ec0f8
SHA512 ad108928d917575417af857f8176ece7251fe44c1126e07453379f134dd92bcc097d07b8696b65aabccb0425b55eb33a3066f211a7862954d6df57b184611385
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgQKKYpWwl1+NY:IG05lO43b5KYpfg
TLSH
T184D5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 96ff88714a8d4836a8a1b28b6496ad2aa9d0f0b3bcf68fa0337170fd16ef91ab
MD5 5e7a576bc7c9c56d701ab3ce424d7ca6
SHA1 2b45deae0db928bad3a4194a55db030364b0209f
SHA512 a759ef11421ebe29ec106865bd9100a89fd3270cd90b13b8b41d298b31dc8009b7b6c6ac3bc4e323cceb98e0512eb20d852710c0753adda0348acbfeea86a80e
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnc1voKFLgYHJWwl24C15rDY:Sa5POZ3BJt2pasx2+mIQKKYpWwl1+NY
TLSH
T1C965BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 08fbe474d010e0fdc45507eb202c312359427795777ccd3aedfac3780e26e573
MD5 031518e483f0e1037f84bf5b75467425
SHA1 befb5f57f2fde6a4fa635326bd28cb73704dda84
SHA512 d92d7a0cd914136457c83d85ed6e410e5042a61876475845c1003427be92ce1827a7132919417c0320fe95e9657d0ee2a622b794671432a3baa17a8fc07baf80
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkO1voKFLgYHJWwl24C15rDY:3Nc/zEOVHF3QKKYpWwl1+NY
TLSH
T177857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2d7cc3e2cc21dce7feb7a8639b8a5bb1b7c152046dca04542be35b44b51e21b0
MD5 36131177520a6d9969d6455fff31afc3
SHA1 396f8320a9a0433299dc7b64270a14fc89c39376
SHA512 1e7187f968250b5dfba6c3385c9441c11a92a40edfebf0fbafcdabbb5fd037116a8677a413bcf41152afd46674f9d8219f38bb922bd396ebc1a6c85ca0560966
SSDEEP 24576:bTkNvNnaFeYhJNtmZBmVvoKFLgYHJWwl24C15rDY:bTMwBtOmVQKKYpWwl1+NY
TLSH
T1D755AF2EB6F846E4D1FAC6B5CD238512E6727861173253CB9290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ad16942ac52b3f9f0bdc963ee6cd11abf004165a9216a2e6868046b413a256fe
MD5 d1f1e524be79b01a64a16869151f462b
SHA1 8f48f316672034e7762b5e61df4b763c2f87f735
SHA512 71b04df116818aa2468733284bf34f4e03a2641e37a9ab214f4ce4bf8adce9983381fcb48bec7aed2fc9104c51ca5e1b48f25234ef6896e26929e6cf6a6ee4de
SSDEEP 12288:uHvUrBFrEjwaQC1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:uPUr+NQC1voKFLgYHJWwl24C15rDY
TLSH
T13565F11F32ED18E4E67AE17D89828609E371B8621751D2CF02A1917F1E63EE87D3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4378d97f40f4a910e2d44778853132f2f99f55f16cf7f177d2043b612d4fbe39
MD5 856609f307c2c6c76a8c23c1cd02149b
SHA1 3c691a542b6845b99f930e13157acf5ad7ecd90c
SHA512 9a290f922bd65a5bccc4fabc96e204531859c8deb79926241933952483b7f332cb2a1e300f8bd7ae42d63b71ad7ff95050d135aaa7c9a1c7909ca61efb8b9e52
SSDEEP 24576:+D3FHshBIYQgAn1voKFLgYHJWwl24C15rDY:+DVHeBIAA1QKKYpWwl1+NY
TLSH
T1D075E13EE69D04E4E57BD1BCDAA38506E77138A9032156DB029091BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/248-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/248-315-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/248-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/248-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/248-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1328-33-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/1328-1-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1328-0-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/1328-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1328-30-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1328-8-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1752-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1752-134-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1752-137-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1752-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1752-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1784-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1784-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1784-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1784-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1784-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3312-329-0x00000228A2200000-0x00000228A23CA000-memory.dmp

Download

memory/3400-76-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3400-82-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3400-74-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3400-296-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3492-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3492-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3492-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3492-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3544-122-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3544-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3544-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3544-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3960-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3960-332-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3960-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3960-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3960-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3960-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4072-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4072-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4080-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4080-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4080-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4080-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4080-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4816-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4816-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4816-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4816-48-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4816-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5956-70-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5956-64-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5956-63-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5956-281-0x0000000140000000-0x000000014020E000-memory.dmp

Download