d488dfa4db535a5b0b6d80471bf7bcf1ca58772192dbcc1dcc364883e2f33a9c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
Size 933KB
Sample260727-ndvbhs1bjc
SHA256 d488dfa4db535a5b0b6d80471bf7bcf1ca58772192dbcc1dcc364883e2f33a9c
MD5 8c7bc14b78e7468e68a8aeab8035162f
SHA1 18a351aa8fdf597988bfe41efc8e615019e2850f
SHA512 730193a95acf2a8d2ac00849eba6aaf9c8989d954f79ebe0a42f1d1778d1e9c0d4f6ef956a40e6183a13e3c591cb7504778cc41780851b1a0d146b3ca305663f
SSDEEP 12288:wU2SixQyGk/bZ7vnmPxzTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:wU0Cy/mdDnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10D15BF1173E405A8F9B7A6788DF68122EA337C855B78C69F0354416A2FB3F91CD35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2732	elevation_service.exe
2604	elevation_service.exe
5484	maintenanceservice.exe
4240	OSE.EXE
2980	PerceptionSimulationService.exe
4596	perfhost.exe
5568	ReFsDedupSvc.exe
5480	SensorDataService.exe
5924	ssh-agent.exe
3016	AgentService.exe
2240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\508f207fe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007706ee8ab91ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fe5a78bb91ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd630fcdb91ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfcd668ab91ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2dc4acdb91ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7c9c78ab91ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000af7e48bb91ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2604	elevation_service.exe
2604	elevation_service.exe
2604	elevation_service.exe
2604	elevation_service.exe
2604	elevation_service.exe
2604	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4836	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	2732	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3016	AgentService.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: 33	2240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2240	SearchIndexer.exe
Token: SeDebugPrivilege	2732	elevation_service.exe
Token: SeDebugPrivilege	2604	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1224	4836	2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe	89
PID 2240 wrote to memory of 4600	2240	SearchIndexer.exe	102
PID 2240 wrote to memory of 2416	2240	SearchIndexer.exe	103
PID 2240 wrote to memory of 672	2240	SearchIndexer.exe	104
PID 2240 wrote to memory of 3540	2240	SearchIndexer.exe	105
PID 2240 wrote to memory of 3044	2240	SearchIndexer.exe	107
PID 2240 wrote to memory of 1680	2240	SearchIndexer.exe	108
PID 2240 wrote to memory of 1984	2240	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar.exe" uninstall
  2⤵
  PID:1224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3a03936b75aeccf596bf33247e6ac3ed923925f902df8a9380d771deaf8cdb12
MD5 0f111f510d828cf91a1bf76f61f01016
SHA1 208db1a731e038d001123e98f364e652afee0c7c
SHA512 1e34cfc329b7059d11dd9645971f81eb56933477f2bb4867de52dcdb6fed7a979403867856b3f8002d2a236c90d77bd6ce0d9d26620773f53ba8556b1f9fd6d3
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZQ/lFTjN4:43q6HjBZLm
TLSH
T1B5D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 5b75ab1ad556510db81efff8e454f9c6c851b8637fd74174e94111f5b9cd7b3c
MD5 62618c3985ba78b98615a2f1a237d52c
SHA1 2e8b273b1933d5e510f4d528c89faf5edcb610c8
SHA512 5e73035723933672d974fe3ba01082a8c303304c1a5501751af86922d29764e4243ffc0665233bb0e73c9d8654e7abe4d01abaee77f9cac7d8f5ed79b6c79663
SSDEEP 12288:U1XLsswWkxy2lRq2czAyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:yXYfDtczAynQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1D005F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 abaa999e9431b0279fbf9cd6b323e36571961ec52c70b5630fa761782cd19971
MD5 017f9f5c7fb878f7e49bb791728142de
SHA1 f86744882c155b12f099acfbc7504b6c6182661e
SHA512 97e6c21a95757907b12125455aa0b0d15b8d16c7924c859873ad3a4c8623088b027f84ca30399d7399b928a7c0cd64e9da76d093be148bc52f0432c2ccb92243
SSDEEP 24576:G0Le5ji0hmxirMRnQ/tbw/2Mkjy6Fr7g0oR:GPji0Ac0Q/lFTjN4
TLSH
T1A7359E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea1d42f76e961ed40cd077f6a1a9ea2d2f3b729cb5c11496115607ae0489efb8
MD5 2d5c90dda2e101d3dbf4cbd65815716d
SHA1 177df0c10c5eda137dfdf315ae4d572d8939ae59
SHA512 4a562efa42dd8ff9478cbe6291222e6640f5fdef5db09d1175a15b5ec11016ac56a57e22bff4fe9651f1bcbe6caf4d6d1099eab259edd159821145a9dbceab43
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWE6q8wyuPnQ/tbw/2Mkjy6Fr7g0o4:5/ezSC6vUzPvxHjyIQ/lFTjN4
TLSH
T110755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 886dfd763130e0405777407e65efec8cfeb0390c6b868cdc1252595dcbaa24ac
MD5 b625142945fdd3377fc08c25a477ea16
SHA1 fab69059b3c890b71f8c31637a52e584974ac4f8
SHA512 2820f59e2574dcede7570ea2b167f8ab71deb518e52eb14183aaeff153ebebf68e05ce8b1c3f14f94247b01a773a2e5bdad8d63342ae35f2ccddbb3f09d9b1f6
SSDEEP 24576:lVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0on:lVO88hXl+FQ/lFTjN4
TLSH
T161559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9c92ddbaf3fdce150d302f291ccdf7c660512df04243030f6feb63cf471ca926
MD5 c69d8562447fb8b56fcdcb8eeb3fd0f8
SHA1 66921eebce13cf0bd8d132229e2ad5a0377e200b
SHA512 7be8af24a0c8c8a822e4e33b8e00e30a9e022dad217e666808842052834898d675332bdf3aec8f0bec56a0301352cc53748771be4b75c15d7b919c4f9e4ce7f8
SSDEEP 12288:sRNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:sRtnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1C5C423796A24F897FF2B06B55C8284826B3B0EC1BFD4A74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 01f8df5ff09900689f2dc24cdfea859b1b2fcc876087df5a296e20e545d47ba1
MD5 27b7bf5748f7c7121d55416e7e8b7870
SHA1 41a2221dd4d1b778fc95306e08998d034a9ed13d
SHA512 74535a1ef983c79a4eb8380fcc8691eeae7ad18adab8a581316acc7f8f2e65972026034be101fbde1fc91397067c132416a595efaa736b0655c10eac73a76925
SSDEEP 12288:meBNUbTVO86UmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:mJIUGnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12D05CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3b57b2fab74119f6164e09d940744f0a9a2adcd27ae2228f78e4642706636201
MD5 139cc3874987fc170c8c793e24060da1
SHA1 bb049b1dca1ade28b397d7a8eb1a3305d0825d68
SHA512 b08a0c56be2b27b1f1859bee8af9017349b8b019b54f3da6b542e0d33d183e1b36bc6dcb119e3c9bd0d4b5c09c032daba742e1b60898fd9b73741d320b777e66
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:wQvGAdlCEL8c/yRNw5C0Lm
TLSH
T153267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a754c17023de3dba6d3a9fbc295cfee214ede1274b91d400c6aee138ef6ed7e9
MD5 b8f38c9bcab74386e780c6a99f6c472c
SHA1 a3d82f0e7a4ebeaafc8d08ec75f1de08f28457b4
SHA512 333476f5771e0c8c014b307c0914fc95926b5e390b034ca2ff94bd33f7147979a1bcb23bd28d7d72fc786c84f10e7b40098d9f539b7dc168d3930344a560622d
SSDEEP 12288:tAwSfxL/2Dc34DLLmt0LDQewsAjEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgu:edewsAjknQ/tbw/2Mkjy6Fr7g0o0
TLSH
T18315E031FE74E436C77F0DB61B26C706183D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 23daa9d0ded8aeed24c3f4027d5fa67c4046919e286e1ed70b352d0bb6c5e2d0
MD5 66be89478451b700a2583f553785aa7a
SHA1 011ac7256de6a258e1ce10e96cd506ada2994236
SHA512 cb54e3b665b53098a308d80dff9832a625b62c7ca40d95dee539e0fecf05ec24ada9791c59f9ac08324adcb8c7096aef06f9a34c0e1adb863226f1da23028795
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHPL:qUEtQevvqc2W1cpV2EI32
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4e89d3d9e337d48fb9a9ba96e951ad80dc897d35fede69b6a989048aac707a4a
MD5 8de0fba4d6821f84ac8b6df1f0f23800
SHA1 357fb9135485edef124a193af59d66a85e208bda
SHA512 432de615de4f285662b956e96a7f9260fc19cac502d1076ab3dd230fc10b3bd460db772748d392aaaee47c884352c5d23ec56d03fe673a935639770796520726
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zEQ/lFTjN4:qoqtVjnmYLm
TLSH
T1D5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 658dfec5c833e9b7384b663573f3bac0d7782f85a60bb679c7da508f8547c89a
MD5 40c6b6193fcc47ab78e07ce969277826
SHA1 d8a0ecec7e910ff90b4bba18af49d1631c082269
SHA512 7d9657a2a84767ab0d19085d49f5129c9f29d7aa32a4653bb2b69d690c71ae03e35b5eefb8058f92cfbbc9965d5f9ff5bf11fca44d4e8f09da00c0f567e88d8f
SSDEEP 24576:pAhGLJIFoiwtA5l7S53TnQ/tbw/2Mkjy6Fr7g0ox:pAMyFoiq5jQ/lFTjN4
TLSH
T11435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3042829787bf84eebb2719e438f7683bad2007900ad514e6fb0126cf1434afc0
MD5 1f7491f9e88534c70b90e5186f823393
SHA1 80b3f50a377bdb3a1b12bbd529ac63021b4035e2
SHA512 470028257b6cee6f7253ebd67263e3441286341d92d3f6ba4c33d2afd139e2ee9356d38d8b1ee87b0ba8abdbc10c9b93a74c83e891a1c3b8177fb1b6a10f9b9a
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMq:vwuoOWonQ/tbw/2Mkjy6Fr7g0on
TLSH
T12705F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6d069973f7b41f7ff277a266bf49b5eb3d1ebcff8c39bcf1f4ef1cfd01c5db5a
MD5 1434201d1ea8ba1f63a60d11e73473e9
SHA1 0c3fe2d16d342f2b1c7353e67fa7f0c3aa531072
SHA512 d310704eef6d6f415f8954de2158553906a31beee17aed98de371216a41f36d73a281db40093c2b9fe25a1dfd4c3056b5fe79a7aa0eb3379fa4f87d985bc47dc
SSDEEP 12288:ZBZ1Iy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:3ZuJnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1FEE4126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cbb39fcff647d0caa836963346add22b2d231efa27f7f6c6b0ddb55ba38bb470
MD5 eb2d6e4b90845c14e91b905d7129f971
SHA1 3ae2f61580dd73e8a30d4f9c26410b32595c0443
SHA512 f58a7f167fe624a1ff0a6f2b3c6b088b1645fa3c92ca46308cff0a01d1fdc99d4fbaeb9114564820cf9528f5caec7022095b2e27e78a20cea10ad3f369ce5617
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:TQRQyi36YOcPQLvw2gAf+PN3FLm
TLSH
T1B4666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 711dc30f176a46a225ff542aaebbb0729fc8dbf4ccb3cb30da37a7aeb6d9d92f
MD5 a33affc65d411491c514104ab2f9b854
SHA1 aef96c3b40e575d0f3ed4cf9d9633f1aa34c3a9b
SHA512 e93c0672262e98a2f59d555c854bff348017bbc2ce38eee000beb2a1d684de1cb72146bac98a914e4e7a82c614ed2ec92fb8252debfa8785d0983dab82b163d3
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:0QRQyi36YOcPQLvw2gAf+PN3FLm
TLSH
T123666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 83bb23163504b0b20a13858ca5d2e865ef9e3f0b786e1d86fd62f61caa52a80f
MD5 4dbc926c8a080e9360abd0807aa91993
SHA1 720bf8fa6e29d488124e4efa2ad178b7bff9750e
SHA512 f94dd89c060b0f6aed73b1f0f2818ea4ae0c7b7647462b47011aa2fcb2e5e612980dc46f0b625fde54a9e037e01f5c534f99bf42c76e93081cb5443578be6bb3
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ZnQ/tbw/2Mkjy6T:068Qg55nhheWu7PNU3/0Q/lFTjN4
TLSH
T1A4B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8001b84e744a8d09ce4a2f571009b751f11f83bfa4e3d74498a89f9521b88d82
MD5 a2b3174f449b98549737b64957b001e6
SHA1 a755c03fb9a1ea3831906fe1f4c516c0392bc345
SHA512 2994c89261c2fe9e31dc8fd3e8de7c09f16891f4c10d292abc9d9e1fae9cc279d88de5c46f73460ed165b67b6fe8245cd32b0c38bc1164b2873035fe06cf00af
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:Ry5112gYy5azzVvL69nLKnhZiLm
TLSH
T15D167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8a6424c1c661e244f956033a8c1a3425a8dcf9b4de0476e9eaf2c765866f395d
MD5 a6f06504c22b2d240d98b6ed4fe69f3f
SHA1 16fb825ed20289372c491be2829f9bac43239eb4
SHA512 0d232780ce4a6c8d9725594706e17b6b610968789e9edd8962b562c717fa75d778139ad10403c3d316fb33c5fe73b2e1de457a2579d6bd4f769d86243c13bfbf
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:Yu6JmVxd2dpLm
TLSH
T1FCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3f50fa4a5310deccb2bc496cc8b365ef399f4ae17df34c5324a28d3e977b2997
MD5 9628f72c14112d346bd513306f22a2eb
SHA1 dfa161f218ae4319062fb9881eab0071d5ef7655
SHA512 80dbbf0ca40923e8c0e7e93ff518d784e245112027bce1e0ea9ad28c89165d804908347a2ea9f0232448aefb3d15f0f57d2a25f49250e6e4b8aa95c7570a8604
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xmQ/lFTjN4:bmifPbRYLm
TLSH
T1AFB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1979e8d2ab7971beab399cf2f1fb663583d2fc59c56eb7ffd37078dd4fb7b91a
MD5 aa9e1a25337202f85fd81557120a7a15
SHA1 cc4599a577eb40e63a46f4ceb206307981ad8b1e
SHA512 7e3cc72f937ef3f134a88764683cc17a6efbe6344a2b9b4ee9d67edc4879f5d25833869b118740c7c96fd3a2a2bbb1daa7c9da7d55219803a1ea60483f69fe0f
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqJQ/lFTjN4:F5dKTi61+Lm
TLSH
T15FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9540adf74bc5a0d8808f5cdda06265673f82cbc9603a3dc04e33f40264666f9c
MD5 5503c5c9355da35e1685d7b2bc769708
SHA1 bb761b96dd70493782f844db696f10015b4a17f2
SHA512 52a3c164cf522fd84763afcec52f9783d1a78c6c678686c1a12317ea2a3712524665b9a4a461ead60da19d41e867a176fbc5749a78d93304a0830dc669c375b8
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wyQ/lFTjN4:oX2iyphMLm
TLSH
T18995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d646efbd00c5312b65ca63961eafb2023e241a0bbb869612f39606eaf8feadbb
MD5 03a2e2096cc7d402928587c5891b5882
SHA1 5cd2ccd2484b57932a68b4766bdc7de82f7c56df
SHA512 9a8db2db7fbc657c8c099c7d1eea9a0dada002e5f74a51df3ea97ff77fa0745f54492c5f16d32ae9e814288e076dee87f2fc1938fd6c9a888864f0431cf7955b
SSDEEP 12288:clGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:cFnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T129C423697964F99BFB1706F18C828182A73F0DC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a134ba2d592345fb639e84c631d3b1ace23c37dea165e9556a4b0be7b69682e6
MD5 6f6d85a182817d3b455c9af69bf39701
SHA1 d9e5678b439eb3736d3d060025563dce9dcdf00d
SHA512 cc0e23528f34c8cb0973befa70335e4dda0abb8dc6ec7f06ed13833364d468e80ba79b0bf268582b49b350e1fb128b0f95d8a781cc56a06aacb166349f611d29
SSDEEP 12288:uQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:uwnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T167C423697964F99BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0366f9982f7e2ff9c99a6ef20a2d1fcbca7665acb02578da2186429dd445c128
MD5 4e1e90245f78c3eda74645f53447e3c9
SHA1 a9f2316584b885df5b2e942014076a33867a9216
SHA512 467dc1b3e5008bc2c510a1e9680fb0284e4616773438385b244533751e3b3cfd238aa9e7b82c5da5b81f581e0826f4c4e0408128f8f0cf90c5f311b6c9768489
SSDEEP 12288:h+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:h+nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T152C423697925F98BFB1706F54C8381829B7B0DC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4477ae261267ffefcfb82dc26c829f0bd2153c821e258d0aa0b6ebd99e1ac8ee
MD5 2521b6a758e7ab0d9e77c762ab87c3e3
SHA1 767d869854f7cda22328a19631d96dcbed6ac3b3
SHA512 988285710be203da3da9ea67a68c980471128d8eb32dcb3d502d27d83b89f90b0c7ccf468859f7c8954b37fbf21d3a51b7430cd40716a80f5668b82d5b2ad793
SSDEEP 12288:3VDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:FnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T138D423693769F4C7F92742B4CC928142E77B3DC6BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 eca9616cb87ab8e04d4740a8521514d315503e251548ce556faf90fd8ec9e40b
MD5 9ce072a445139ac4ab7012748a2d5dab
SHA1 94dd6b8df4b52098525d181fd50fef3d083af4ad
SHA512 06ef63470b8e499f6fa8606952719b66d63006fd92adb5c0cdab1159a9d656d3b8924b0203034bbdac8c8af77404809641d075275ee469c12afa1ff070cd5d15
SSDEEP 12288:lLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:l7nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T151C423697925F98BFA1706F14C828182977F0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5525be032d23cf7fcb5f72312e8a5fc46753781bbd70180d4995ec7dbe56f3d8
MD5 581a0f43607a78af33925c2620237319
SHA1 26074e76e5ce24e9e19793634956b5e3537c3848
SHA512 ab70d6f87f281b037404595a50c3e9ed4fc273b85fe1ad796e442d2441717f401b646b284f0e6a878638b236b81409719aa23b7a4e5afd6d14c983fe5e7839a5
SSDEEP 12288:fcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:fcnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1CCC423697964F99BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 71a47b15456e11d3357275e71e9e32e3cf558c2d37c0ba62997e9fdcd3e0d1a5
MD5 7b5346483a677d8b66b1f795f562dea4
SHA1 99b65ef896817de4a3b4f732c0132fb3c24a6ca9
SHA512 bbdd73528cb0054a5826ad4c8402c55bd56036cdb5dc756cdd6381671b63b7c39e5820dd75499eb29daba126551beeba0b643133900d7f3d2b11221edd5e1242
SSDEEP 12288:o4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:o4nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T174C423697924F98BFB2706F54C828182973F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8f2db5149c9a9ecea1c10a9758ce5619cc517495a405d30f62bba9680c060e91
MD5 d5d0fd85ea348a64e7f361f0b3361714
SHA1 1762d707878c3da6e7d2eac73adcda1102dfd6e5
SHA512 4e04a04f9c91e1e83443d2afbc64905cbde0f37f7da879b32213436c90bf74e64564649d97a3cd60c20780411bd6c764ce1ce86f69d5a84ff8e23cb356b8f2c6
SSDEEP 12288:SiZwb6zzFEoS2cPvywGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:1ZMSzFVSOQnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1AF0501A5B35068F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8da051b018e07609b66850eb0391c43ef489b99911ebb50effefc1f97e24a3bc
MD5 ea36690f727abb9df542a67577857144
SHA1 99014155f2cba46e0f788a0a99255682ac9634be
SHA512 868e9480755bac96e829eeb7e613d59dfc4d2cb11045b56e1f191d009ae2477079647e7b60caa108b395b1cca43e7f49c165b57e401dbbba070dacc04dd1fcb5
SSDEEP 12288:MpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:M5nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T10EC423697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 bcb4850fbecf03224e856692b3d4abb04f0bc75e068a2aa2493fe8fca6ea6e4f
MD5 736332fd0b398b4320a79b1f42b4f9ec
SHA1 e94b686f60bbb6e1d598b5bf79d9a71347e4b973
SHA512 9820a9da341fdfe48d97e241cffc1a1f64c33b208dd38580b15538a34c30bb2f571c81f824a51116836dd2b38a1bec9a90adb6bff931a650a21cfa1d1f9cd6a3
SSDEEP 12288:/9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:/dnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T12DC423697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ddb3be765394ddae0ad154e0013b4c64a3c00e302b29d8c1d3cba071d826fbc5
MD5 7994f16252b0c63026eb86a3798a94d6
SHA1 90a21dcb3ccaea28afdcedcf37ca9016becb5983
SHA512 2b995df49305a51a8f7f4d7ac9a608aa35784be7f6958d427f56b1970e9ec41905798791ef898bec400f2093faedfd836fcd8dbcfbb14b90c5316ac78b1364b9
SSDEEP 12288:AyPz5L80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:xzyUnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T11AF4021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 eb15490ddc196e4fd762de8cf8c9f3a5022fb634f31f0b0e920f4c44e31003c0
MD5 704e7c317fb37e48accbbee08a30b1a8
SHA1 7532b37cae0c982e2472af2f86e1c1c6063a5e36
SHA512 62a2ee55ee77d375fee4f028b1568c16e8e83b7d5be8469d1bf4ca59ae965ed9a9faa7480cbae8b570bd17cbe110ac15bd3c35c4f07fcaf7dd017622123d29e3
SSDEEP 12288:ipGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:i5nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T187C423697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 22ea188afa5bfc450f60550ddb35b648ac67875d74f6b09a5c26999ec3e631a2
MD5 6afffa3f60cae79efc5367d3bf3a4fe5
SHA1 7ec496eb0f0c92a2db614e75a45f5c58940975fd
SHA512 ee24cea4d1fda858a2a9cf6681495c25a93a33aaeabbc838f2eae89b807f23597ecf9f5e5ca4ae8e4d976dc35de3115e397166267f101d385f380b1d0f332fd1
SSDEEP 12288:HpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:H5nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T16CC423697924F98BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f5ced7a70330bd77c303f69c356f69e5855d80f6f800e2d7b62ce1e7527f8f30
MD5 1fb9595e69cd7d5e370949c31a28d66e
SHA1 626df08226b57b75e54e827c7e0f400a727dcf1b
SHA512 2374f2e03ddefb416107b960e64246850eca51e4fb38fbc49e1d215cd64a970c353da38c710968610c8ae3d946ba509a403952fcecf19bb6273f42d8ac482fd6
SSDEEP 12288:myPz5L80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:bzyUnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T199F4021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 85fd871c6fb7c3b4dc79ebe4717349b53b6be7d95e425c5c2038465ba5607b9d
MD5 a6c0470b69129cebf154b40dc26b8d21
SHA1 232807a7669a6f1f78b575f79224df92956eb98f
SHA512 065a87d23d9822ec5a0c4f48d55d76f38920e09f39fa08a0fffeadf0baf03c793b6fee7b5f0eb4691224cb5fb8d20155e5a3afe33ac68720609376f31a10d90b
SSDEEP 24576:DTHaLl3z0zDOnQ/tbw/2Mkjy6Fr7g0o/:DT6LljPQ/lFTjN4
TLSH
T1CE0502A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4c51eeff35cd72e51efeccbaed3a40cbd563cef1b149648eba4ee6d999b2bf22
MD5 0ddf41f7fd75a0a320d74fb0e5a56314
SHA1 955ca6f6f4d9fd0a0ea890fbc79db191165903c8
SHA512 248a2704afe3cfdba0c35b73b7599b4d210f9e5d5c30042af8a3da17bb1a8d365d8d5a2f0e90f0483d34d784c5e879644e308296a5632ca5896cbaa9999fcf09
SSDEEP 24576:p37d9CHKy7GZqnQ/tbw/2Mkjy6Fr7g0oV:57d9CHKyaMQ/lFTjN4
TLSH
T15C25CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 60997d1c322f41492e61cd5d0b53806ad74d1ebd160e364b29b738aa417af643
MD5 793e7ecaec05cfd095652aa396203733
SHA1 2666555c8935a1195338abd9a2916ff368f58826
SHA512 79571311db1d53ba03bbd31f046d92d750dc3474d11317882795dd22206f0a196c99bb7b6142bdee5ae6413178efe46f19d5ab326afb79195683e5e8a8bd82d3
SSDEEP 12288:+eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:+enQ/tbw/2Mkjy6Fr7g0oB
TLSH
T18FC423697925F98BFB1706F14C8281829B7B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3e997fd34ea2c10d64982d9f841e17b526e5cf889b2bc2edd16c851c410d6e0e
MD5 00431fe0a8842eda4fed1baf4a0cd068
SHA1 43bf8411bf6ce03837a8154e2d43ba3db1e2d7b1
SHA512 5dda6fd44e81c65e9d7f2847e63b8941cea57c8473a18e30933f854d19666758e41bc55b8568e1af8e20184bf8585bf42b030a1e5ff22a8f08775f6a30e6ed3a
SSDEEP 12288:8UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:80nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1B6C423787924F99BFA2B06F54C8281829B7F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5358b2a4e578074e5c017a99042ab839cef58506dd8483f131a0012c88dfe5f8
MD5 23780cf2651097a4d3bc5c666c0bc808
SHA1 b3a99db8e9b0430f904257a200577fe11f7fc251
SHA512 fd19407c8de1d665f7e23b4eb277bdae46daff6cf876c7ac810b9bf391d9b01e93c5e0472ca70de5c40258a02a49f0b2ca44ab643e7c0feae529c6e42e153099
SSDEEP 12288:L3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:LXnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T120C423697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 21297246bef546cfe149d323f71947d36f611d9de2bdb83be3a655f64944c01e
MD5 48d5f54ba3faf3a5b72fff09ff6cd3bc
SHA1 81cb4a2acdce13016e1b96794f4098ae921aa191
SHA512 6790de28e3f6686e8a3088ae4c20d8d8b5ca90448053031bc44d80ca8e82838cbada49ce0d1492a9e3a4f7e73e0fd661dd16874b5d17e8c43ad7d0ec4e93fe92
SSDEEP 12288:2pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:25nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1E0C423697924F98BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8acc5da91919a7c063ba34922b750de4a38dd6157cf2c233b67c59175f3a646f
MD5 e423b8f9781c8b936e4e88adade5af8b
SHA1 a322a91d37eb56fe29f2fbb64a716113d51afde3
SHA512 03cb8a96d204b9a1b7379212354520863cb7e3c3118829fd9fd44a03cefdef74adcdbcf2c340e42125fb1fbb2ebdc9b728deab3c042d177ace0d7582051b9e7d
SSDEEP 12288:seGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:senQ/tbw/2Mkjy6Fr7g0oD
TLSH
T155C423697924F98BFB1706F54C828182977F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 982c476a26734a12e64f61618c5d7f1d95d93f9254f6b8059eb4c02802a2ad4a
MD5 c296b9b180bae63e1de78e9a93005960
SHA1 86ff070425cda4d2147f06d1449182340016441d
SHA512 1b164940f8cd37ec883dd7b12c447607d0c2d589224514648f4531c0beea9dc65d5b32bd9c6faf292ce2c51d99d5db29225066f0c3d2130c7c0d74d6d4fe7454
SSDEEP 12288:eRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:ehnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T116C423797924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 52f1baf6397b28ff90c05723331fe58eb8ccf3a114a283ef3ff3dee44bd56d28
MD5 3fe334aec48b51e1acc90a9f47c187fc
SHA1 4a91ff8115d5aec627a537e0f14f1d11fd808880
SHA512 9f9d5ed82f642ef1fb1afaf7d73f8cac5e791879bf181058854b89c4e331527ec5499a6642ae002c46292fb9aae07016531574b99b84f8d6f8dcbed8d4d31134
SSDEEP 24576:kfwvok9RX6wkyAINnQ/tbw/2Mkjy6Fr7g0oi:EMnYINQ/lFTjN4
TLSH
T1F635DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7cbfeabb6dc917410e7a670228b1ee2379d69006332d51ddd81e3dac97d8358f
MD5 9bcb8fafca13a6719fb8fbd03539d9dc
SHA1 a1dfc4334a1b379419f51fc2fc28dfb0dccbceab
SHA512 96cbc0f07d9a80879084c71d6ef62bb0952b3741a8d3008129eaf5dc8d4cbc6a2ed9bbf2988f187816765226de2e3800ef0480cce33c8089da9769f5ea7b6d2f
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SQ/lFTjN4:1ySzPlLm
TLSH
T102066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 82e58341a5f0b8c45b8a53e3f96cc8fde5ebc01276352ed795827df7465401c3
MD5 f843a047f826aaaa11814b41c2d3458b
SHA1 8228356c3f6506f8c15c3e7476e071348ecad5b1
SHA512 a85d7228ead3410ea00234645aca56578032bf8c1aecc7d509878f3c4f1e329b86794904bcbf517f4b99d841a9533c0ce93ad8e6d0859dd29985cd6499ba103e
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYAnQ/tbw/2Mkjy6Fr7g0os:147JUQj1irIhCnDHUPfF/CQ/lFTjN4
TLSH
T19D65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 44e79cd0546a4727dc4a52f70ee0e27f59274cb0df1756d3f00c02a8d6ef1f42
MD5 de540b33bf08cfbe343918450fa3dcc9
SHA1 8606ecddb6d4f0977ec9b98bc7e15714f6f7bc9c
SHA512 22373b0943180aba18a9b65c24967ae9f0fb1d89cb9521748bf25ef3a70ecc198c4de38dbf503306a3f01e37fe90a446296c0eb7ad85f06357333d5f317b3f21
SSDEEP 12288:1Nsf5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:KJnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T151E4F119E29852E9D12E5275CB428641B3373C9597E1D3CB67C0F53E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 48eee0b877843551ed817d549192e05d6b326e3fe744977252bb43877bd0972f
MD5 63e58f19e51ffe9509d47d763a6f8b40
SHA1 134e5fb0ca05b2c2180067f396d5c083ebe2a231
SHA512 2ce6a905880017a1cf1712bfdbd3ed1f7e123619f4fb6e196190eba2a5d7f5d71b40ab4464a0ef9bebc918a7ed05bf5694b433ad48d655fe316308276dce141d
SSDEEP 12288:pQdd7U3f6g2ZGYc5M7b0a6EDT17+oeWZ/VEz39LCARMAzTjV:pQd1UP68uDB7heWZtEL92ARMc
TLSH
T1F1551741762BC79FC6A940325E32D6CCA7707D01FE05AF0773C8873E9476669BAB5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 079c953edd87a5a178dd0f0fd2f761a76144c4802c92b8410747cc27ae97c361
MD5 3cfceeb7d76a3aede95b3ca5ffd2c4df
SHA1 a9bba8e41b55320c64576e6c3847cbd0b8e55d81
SHA512 8ebe0f4883e1c35c7812188ed6c03dfbb720cce692b433a7571890f9bdc359117da76a7067a268b19ca21a255d438787c39313d6c0977c0648861458c9155afb
SSDEEP 12288:vC31KvFVBtBAHDjb37RGEOxX6g3eHnmobILRWmgsY4L:vCFn/rVVQXteHVUECY4L
TLSH
T19045FA41A5B7E35FCDFE50370632C68DAB785C06BB452B0573408A3C9867A7EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

508f207fe62f061e.bin

Path C:\Users\Admin\AppData\Roaming\508f207fe62f061e.bin
Size 12KB
SHA256 b009589ce3a04dca898f151c082660fa4a5c8adfd8c40ae488638effaffc8af7
MD5 2e33ad7305fad8ea8bbda542b477bfeb
SHA1 80262585b599350ca4194c559a362dd4fbaf4411
SHA512 b32a287e5116c889913fa1cbedea95fe567cc0190a4b09ac50a456ea08455c2f6c7d1290e9c67ec94951e61f2d1b34b9ac5c2694e0c7bfbf00be464f5790f084
SSDEEP 192:gU81IVgSPBVV1bxIDD4eax+h7zyEZ8UiNj5aBQVcAt+YFPBMnRrQGRsm16KnMZSm:gU816bLBy1axmNVsj0CcAtZKRBJEZS7a
TLSH
T15D42BF851041F88FD2588F67C8B4A316F84991C2F9C9913EFB327191DFAC7C89665ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 34c97ed1e101c51a0c395c730a1aa286bb24441b3fff24297de2220f7ed4a9c1
MD5 bd6b28176b9ffbf489c122b63d555733
SHA1 178e715563ffce13e920a40981c4391940ce0daa
SHA512 c36d5e927655e46db3ce7d75e2dfd7e6b5f6b2c4ee02eaa2376a74899f651f3b9ba431703f32061944966a525516a45b298a8aec75878f8ac0482990f047de6f
SSDEEP 12288:fM7hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:UxnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T17ED423656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 326ef49c713b1b28d305cd445d271a169e9af97a651047545714dd1d15313dce
MD5 2edcbf62ca0852544bc613b6fcabebad
SHA1 7d4cb9b1dfcb12f46df28d1d5ca17633507225d0
SHA512 c04d3cbf5312e51ceb46da1a9d967a4e1141b6388a85517d26bb462448f50b2e70b89bca15b32cbd6ed27a1e67ef70c752afa0ea5373376eea569b8ea4a9a44f
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYPnQ/tbw/2Mkjy6Fr7g0oP:Ygb4mBIBhGFAQ/lFTjN4
TLSH
T1E765AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d4b1fecbcd158778e83dc8ee9c2780041808ae0ff8caf7e4297f9dea1f441a31
MD5 77a237e3cfa7941f443c99941fe84272
SHA1 228c5e79f4e2c99d4912f6ed087ddd0ece44ed36
SHA512 743e03de733cc5a133485bed81a2768fbe7548f9ada2bfd3ca4bc9ea7ea064d454ba5b3ca7e788888767036b175bf280079f646458d86ed3f6d8e0e54b5c7bd6
SSDEEP 24576:PG88u8FpJqH1bzria7/mQnQ/tbw/2Mkjy6Fr7g0od:+7ZFPqVea7/3Q/lFTjN4
TLSH
T10035F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 83bfdbecbf7b485890c89b92817fa96e8c8a8032220d2e23b992f558b4924316
MD5 7ac785d59d3c2167656abd679bf60c2f
SHA1 9befc56911b16bcddaf08fb8ff5dc8b9a6893333
SHA512 f54e7bb65ca7cf756113d19aa432a795467af3c363791df2c8ceb37adff2e7d54af6f5eef67f95d514f05863b8c0ab099622acba20fb913f583389a248ee4574
SSDEEP 12288:oHvUrBFrEjwaQMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:oPUr+NQMnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1C505E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d3ac90376a8b253ec5d2b45e38b67c9d82cca10e16719e9013e03f77502df437
MD5 dbb4671bfb0528e027a1b6c35f846078
SHA1 3cd0b091657c6bc55eda4868ff16b5ed0419547a
SHA512 9ea80e8933c7e93cd91c05dfb1179bef04d7d9236b457cf0e4d1554ed7e1f24f8984fb84d744048eebf75010c2b8785b3e0691b43a153e6cc59affd34f49f7dd
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcQ/lFTjN4:RG05lO43baLm
TLSH
T167D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 485319ae5667df9d7a1efe9e7c81ed66b8a43d1d5a2229dbc5c9f89c4f24baa2
MD5 b2e8b5a7bcb878e8b9e3375acbd75efe
SHA1 a90af4dd7e60ee8ab9c02f246163c01e62925747
SHA512 4f0d47075b9fe20e2690a60b05fb9c86ead148bb15cd6dd0d6c4b176caf67399083079ed77d383972b752dea5a6e7acf608ba8916f76e90d38d136689b28bb5b
SSDEEP 24576:dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnSnQ/tbw/2Mkjy6Fr7g0oh:ta5POZ3+Jt2pasx2+m0Q/lFTjN4
TLSH
T15F65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bf4ecc8f7d6beeaff954fdec5084831da35224eb10868d259af6f56f9f852209
MD5 a0d13e12c5a5b0c3a7b5ef6c22416288
SHA1 1911113d53c8380395c90d33d8eed7452ad10b44
SHA512 a890ead21c1968cf51d3cf859062957e25dc7b4a06e5c06b38f13d8d9c440d7fd8fcd947cbdab7283f3245296c4c97c59963519ae8c8b17b5e892ba9a3f88e6c
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkInQ/tbw/2Mkjy6Fr7g0oT:wNc/zEOVHFXQ/lFTjN4
TLSH
T1CC858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bab8edcba7d2126bb691045aca48901a3256fbe5c32a8b0e6336ff988b5dc386
MD5 6ad3c783081b271a4c80534837e535d9
SHA1 c146bf28adef8520afb2e54257743412a14ea3a1
SHA512 70a65420acb3221adbd5e8e53e16d503c29d50c2287db4d45faf31e94c542e9e9c6900590f392375ecf0c944333bf76a753983d48c209bca72eec4825115c323
SSDEEP 24576:E8kNvNnaFeYhJNtmZBmCnQ/tbw/2Mkjy6Fr7g0oX:E8MwBtOmCQ/lFTjN4
TLSH
T19B55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 af5b40f2a28754bc584f2823f9eacacb316f4d2c9ceb523d726689503e19b01d
MD5 839772a39b5f6a4c256a9e9c7be040f3
SHA1 4bc9cc0e1519ac900eb32afde09b0780f616eceb
SHA512 acb7070f11c064e85812fd747e0ee8a99275b4c09520366ebb78895e4b02c8174cd989f5f485289da38832cdbed03e57902d9c1ce648e0fad99ec34a4c9c32a2
SSDEEP 24576:nD3FHshBIYQgAlnQ/tbw/2Mkjy6Fr7g0oL:nDVHeBIAAlQ/lFTjN4
TLSH
T11425E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-338-0x00007FFC14260000-0x00007FFC14406000-memory.dmp

Download

memory/1224-36-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1224-43-0x0000000140000000-0x00000001400EE000-memory.dmp

Download

memory/1224-41-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1224-29-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1224-14-0x0000000140000000-0x00000001400EE000-memory.dmp

Download

memory/1224-37-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2240-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-186-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2240-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2604-323-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2604-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2604-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2732-20-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2732-322-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2732-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2732-26-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2732-27-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2980-185-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2980-83-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2980-89-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3016-145-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3016-135-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3016-141-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3016-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-72-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/4240-167-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4240-78-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/4596-168-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4596-93-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/4596-98-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/4836-16-0x0000000140000000-0x00000001400EE000-memory.dmp

Download

memory/4836-7-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4836-17-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4836-0-0x0000000140000000-0x00000001400EE000-memory.dmp

Download

memory/4836-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4836-8-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/5480-183-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5480-324-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5480-113-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5480-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5480-119-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5484-64-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/5484-58-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/5484-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5484-70-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5484-68-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/5568-108-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5568-169-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5568-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5568-102-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5568-340-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5924-125-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5924-131-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5924-184-0x0000000140000000-0x000000014013E000-memory.dmp

Download